Article 58
Powers

Official
Texts
Guidelines
& Caselaw
Review of
EU Regulation
Review of
Nat. Regulation
Show the recitals of the Regulation related to article 58 keyboard_arrow_down Hide the recitals of the Regulation related to article 58 keyboard_arrow_up

(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Show the recitals of the Directive related to article 58 keyboard_arrow_down Hide the recitals of the Directive related to article 58 keyboard_arrow_up

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, and powers to engage in legal proceedings; whereas such authorities must help to ensure transparency of processing in the Member States within whose jurisdiction they fall;

The GDPR

The Regulation aims, in order to ensure consistency in control and enforcement throughout the Union, that the supervisory authorities have, in each Member State, the same effective powers.

Article 58 provides quite precisely three types of powers, which the Member States must, by law, grant to their national supervisory authority:

- investigative powers (paragraph 1): to include ordering communication of information - including the processed data - needed by the supervisory authority to perform its duties (a) to carry out investigations in the form of data protection audits (b), to carry out a review on certifications issued pursuant to Article 42 (7) (c), to notify the controller or the processor of an alleged infringement of this Regulation (d); access to all personal data and to all information (e); access to any premises of the controller and the processor in compliance with Union law and national procedural law (f).

- powers to take corrective action (paragraph 2): to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation (a), to issue reprimands to a controller or a processor in case of any infringement found (b), to order the controller or the processor to comply with the data subject's requests to exercise his or her rights  (c), to order the controller or processor to bring processing operations into compliance in a specified manner and within a specified period (d), to order the controller to communicate a personal data breach to the data subject (e), to impose a temporary or definitive limitation including a ban on processing (f), to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients to whom the personal data have been disclosed (g), to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met (h), to impose an administrative fine pursuant to Article 83 (i), to order the suspension of data flows to a recipient in a third country or to an international organisation (j).

- authorisation and advisory powers (paragraph ): to advise the controller in accordance with the prior consultation procedure referred to in Article 36 (a); to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data (b); to authorise processing referred to in Article 36 (5), if the law of the Member State requires such prior authorization (c); to issue an opinion and approve draft codes of conduct (d); to accredit certification bodies (e); to issue certifications and approve criteria of certification (f); to adopt standard data protection clauses referred to in Article 28 (8) and in point (d) of Article 46 (2) (g); to authorise contractual clauses (h); to authorise administrative arrangements (i) or to approve binding corporate rules pursuant to Article 47 (j).

According to paragraph 4, the exercise of powers of the supervisory authorities must be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union (see developments in recital 129).

Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation (paragraph 5).

Finally, the Member States may provide by law that its supervisory authority shall have additional powers and the exercise of those powers shall not impair the effective operation of Chapter VII relating to the cooperation and the consistency (paragraph 6).

The Directive

Article 28 of the Directive provided for two types of powers given to supervisory authorities: a power of consultation of the national authorities drawing up administrative measures or regulations relating to the protection of the rights and freedoms of individuals with regard to the personal data processing (paragraph 2); effective powers of control expressed in investigative powers, effective powers of intervention and powers to engage in legal proceedings (paragraph 3).

However. A wide space for manoeuvring was left to Member States so that eventually, the powers of national supervisory authorities could differ widely from one Member State to another.

Potential issues

The powers provided to the national supervisory authorities are considerable - including sanctions - and probably will change the relationship profoundly between them and the controllers or the processors, in particular, where the authorities were previously organized as mere advisory and conciliation bodies. Thus they acquire coercive powers similar to those of the administrative authorities such as the competition authorities, with the well-known fear that they generate for the enterprises. They are therefore established for the future as real "policemen" of the data protection.

This extension of powers will necessarily involve a dramatic strengthening of human and financial resources available to existing authorities if we are to prevent these from remaining a dead letter. This will certainly raise some reluctance from the Member States, but will undoubtedly allow for the protection to be taken much more seriously than at present. In any event, the status of these authorities may change profoundly and give them institutional importance that they did not have before.

It should be noted that the Member States will retain discretion as to the application of fines to public authorities and organizations (see the comments on Article 83).

Group 29

Guidelines on the application and setting of administrative fines for the purposes of the Regulation 2016/679 (3 october 2017)

The EU has completed a comprehensive reform of data protection regulation in Europe. The reform rests on several pillars (key components): coherent rules, simplified procedures, coordinated actions, user involvement, more effective information and stronger enforcement powers.

Data controllers and data processors have increased responsibilities to ensure that personal data of the individuals is protected effectively. Supervisory authorities have powers to ensure that the principles of the General Data Protection Regulation (hereafter ‘the Regulation’) as well as the rights of the individuals concerned are upheld according to the wording and the spirit of the Regulation.

Consistent enforcement of the data protection rules is central to a harmonized data protection regime. Administrative fines are a central element in the new enforcement regime introduced by the Regulation, being a powerful part of the enforcement toolbox of the supervisory authorities together with the other measures provided by article 58.

This document is intended for use by the supervisory authorities to ensure better application and enforcement of the Regulation and expresses their common understanding of the provisions of article 83 of the Regulation as well as its interplay with articles 58 and 70 and their corresponding recitals.

In particular, according to article 70, (1) (e), the European Data Protection Board (hereafter ‘EDPB’) is empowered to issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation and article 70, (1), (k) specifies the provision for guidelines concerning the setting of administrative fines.

These guidelines are not exhaustive, neither will they provide explanations about the differences between administrative, civil or criminal law systems when imposing administrative sanctions in general.

In order to achieve a consistent approach to the imposition of the administrative fines, which adequately reflects all of the principles in these guidelines, the EDPB has agreed on a common understanding of the assessment criteria in article 83 (2) of the Regulation and therefore the EDPB and individual supervisory authorities agree on using this Guideline as a common approach.

Lien : http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=611237

CJEU caselaw

C-230/14 (1 october 2015)

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court 

Regulation
1e 2e

Art. 58

1.   Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2.   Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3.   Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6.   Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.

1st proposal close

Art. 53 

1.           Each supervisory authority shall have the power:

(a)     to notify the controller or the processor of an alleged breach of the provisions governing the processing of personal data, and, where appropriate, order the controller or the processor to remedy that breach, in a specific manner, in order to improve the protection of the data subject;

(b)     to order the controller or the processor to comply with the data subject's requests to exercise the rights provided by this Regulation;

(c)     to order the controller and the processor, and, where applicable, the representative to provide any information relevant for the performance of its duties;

(d)     to ensure the compliance with prior authorisations and prior consultations referred to in Article 34;

(e)     to warn or admonish the controller or the processor;

(f)      to order the rectification, erasure or destruction of all data when they have been processed in breach of the provisions of this Regulation and the notification of such actions to third parties to whom the data have been disclosed;

(g)     to impose a temporary or definitive ban on processing;

(h)     to suspend data flows to a recipient in a third country or to an international organisation;

(i)      to issue opinions on any issue related to the protection of personal data;

(j)      to inform the national parliament, the government or other political institutions as well as the public on any issue related to the protection of personal data.

2.           Each supervisory authority shall have the investigative power to obtain from the controller or the processor:

(a)     access to all personal data and to all information necessary for the performance of its duties;

(b)     access to any of its premises, including to any data processing equipment and means, where there are reasonable grounds for presuming that an activity in violation of this Regulation is being carried out there.

The powers referred to in point (b) shall be exercised in conformity with Union law and Member State law.

3.           Each supervisory authority shall have the power to bring violations of this Regulation to the attention of the judicial authorities and to engage in legal proceedings, in particular pursuant to Article 74(4) and Article 75(2).

4.           Each supervisory authority shall have the power to sanction administrative offences, in particular those referred to in Article 79(4), (5) and (6).

2nd proposal close

Art. 53

 1. Each Member State shall provide by law that its supervisory authority shall have at least the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller’s representative to provide any information it requires for the performance of its tasks; (aa) to carry out investigations in the form of data protection audits;

(ab) to carry out a review on certifications issued pursuant to Article 39(4);

(b) (…)

(c) (…)

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(da) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(db) to obtain access to any premises of the controller and the processor , including to any data processing equipment and means, in conformity with Union law or Member State procedural law.

1a. (…).

1b. Each Member State shall provide by law that its supervisory authority shall have the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

 (b) to issue reprimands to a controller or processor where processing operations have infringed provisions of this Regulation;

(c) (…);

(ca) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; in particular by ordering the rectification, restriction or erasure of data pursuant to Articles 16, 17 and 17a and the notification of such actions to recipients to whom the data have been disclosed pursuant to Articles 17(2a) and 17b;

(e) to impose a temporary or definitive limitation on processing (…);

(f) to order the suspension of data flows to a recipient in a third country or to an international organisation;

(g) to impose an administrative fine pursuant to Articles 79 and 79a, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.

1c. Each Member State shall provide by law that its supervisory authority shall have the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 34,

(aa) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with national law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(ab) to authorise processing referred to in Article 34(7a), if the law of the Member State requires such prior authorisation;

(ac) to issue an opinion and approve draft codes of conduct pursuant to Article 38(2);

(ad) to accredit certification bodies under the terms of Article 39a; (ae) to issue certifications and approve criteria of certification in accordance with Article 39(2a); (b) to adopt standard data protection clauses referred to in point (c) of Article 42(2);

(c) to authorise contractual clauses referred to in point (a) of Article 42 (2a);

(ca) to authorise administrative agreements referred to in point (d) of Article 42 (2a);

(d) to approve binding corporate rules pursuant to Article 43. 2. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union.

3. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and (…), where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

4. (…)

5. (…)

Directive close

Art. 28

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Each authority shall in particular be endowed with:

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.

Art. 154-bis - Poteri

 

1. Oltre a quanto previsto da  specifiche disposizioni, dalla Sezione II del Capo  VI  del  Regolamento  e  dal

presente  codice,  ai  sensi  dell'articolo  58,  paragrafo  6,   del Regolamento medesimo, il Garante ha il potere di:

    a) adottare  linee  guida  di  indirizzo  riguardanti  le  misure organizzative e tecniche di attuazione dei principi del  Regolamento, anche per singoli settori e  in  applicazione  dei  principi  di  cui

all'articolo 25 del Regolamento;

    b) approvare le regole deontologiche di cui all'articolo 2-quater

 2. Il Garante puo' invitare rappresentanti  di  un'altra  autorita' amministrativa indipendente  nazionale  a  partecipare  alle  proprie riunioni,  o  essere  invitato  alle  riunioni  di  altra   autorita' amministrativa   indipendente   nazionale,   prendendo   parte   alla discussione  di  argomenti  di  comune  interesse;  puo'  richiedere, altresi', la collaborazione di  personale  specializzato  addetto  ad altra autorita' amministrativa indipendente nazionale.

  3. Il Garante pubblica i propri provvedimenti sulla base di  quanto previsto con atto di natura generale che disciplina anche  la  durata di tale pubblicazione, la pubblicita' nella Gazzetta Ufficiale  della Repubblica italiana e sul proprio sito internet istituzionale nonche' i casi di oscuramento.

  4. In considerazione delle esigenze di semplificazione delle micro, piccole  e  medie  imprese,  come  definite   dalla   raccomandazione 2003/361/CE, il Garante per la protezione  dei  dati  personali,  nel rispetto delle disposizioni del Regolamento e  del  presente  Codice, promuove, nelle linee guida adottate a norma del comma 1, lettera a), modalita' semplificate di adempimento degli obblighi del titolare del trattamento.

close