Artikkel 58
Powers

Offisielle tekster Retningslinjer
og beslutninger
Vurderinger
EU-regulering
Vurderinger
nasj. regulering
Vis forordningens fortaletekst relatert til art. 58 keyboard_arrow_down Skjul forordningens fortaletekst relatert til art. 58 keyboard_arrow_up

(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Vis direktivets fortaletekst relatert til art. 58 keyboard_arrow_down Skjul direktivets fortaletekst relatert til art. 58 keyboard_arrow_up

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, and powers to engage in legal proceedings; whereas such authorities must help to ensure transparency of processing in the Member States within whose jurisdiction they fall;

GDPR

The Regulation aims, in order to ensure consistency in control and enforcement throughout the Union, that the supervisory authorities have, in each Member State, the same effective powers.

Article 58 provides quite precisely three types of powers, which the Member States must, by law, grant to their national supervisory authority:

- investigative powers (paragraph 1): to include ordering communication of information - including the processed data - needed by the supervisory authority to perform its duties (a) to carry out investigations in the form of data protection audits (b), to carry out a review on certifications issued pursuant to Article 42 (7) (c), to notify the controller or the processor of an alleged infringement of this Regulation (d); access to all personal data and to all information (e); access to any premises of the controller and the processor in compliance with Union law and national procedural law (f).

- powers to take corrective action (paragraph 2): to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation (a), to issue reprimands to a controller or a processor in case of any infringement found (b), to order the controller or the processor to comply with the data subject's requests to exercise his or her rights  (c), to order the controller or processor to bring processing operations into compliance in a specified manner and within a specified period (d), to order the controller to communicate a personal data breach to the data subject (e), to impose a temporary or definitive limitation including a ban on processing (f), to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients to whom the personal data have been disclosed (g), to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met (h), to impose an administrative fine pursuant to Article 83 (i), to order the suspension of data flows to a recipient in a third country or to an international organisation (j).

- authorisation and advisory powers (paragraph ): to advise the controller in accordance with the prior consultation procedure referred to in Article 36 (a); to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data (b); to authorise processing referred to in Article 36 (5), if the law of the Member State requires such prior authorization (c); to issue an opinion and approve draft codes of conduct (d); to accredit certification bodies (e); to issue certifications and approve criteria of certification (f); to adopt standard data protection clauses referred to in Article 28 (8) and in point (d) of Article 46 (2) (g); to authorise contractual clauses (h); to authorise administrative arrangements (i) or to approve binding corporate rules pursuant to Article 47 (j).

According to paragraph 4, the exercise of powers of the supervisory authorities must be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union (see developments in recital 129).

Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation (paragraph 5).

Finally, the Member States may provide by law that its supervisory authority shall have additional powers and the exercise of those powers shall not impair the effective operation of Chapter VII relating to the cooperation and the consistency (paragraph 6).

Direktivet

Article 28 of the Directive provided for two types of powers given to supervisory authorities: a power of consultation of the national authorities drawing up administrative measures or regulations relating to the protection of the rights and freedoms of individuals with regard to the personal data processing (paragraph 2); effective powers of control expressed in investigative powers, effective powers of intervention and powers to engage in legal proceedings (paragraph 3).

However. A wide space for manoeuvring was left to Member States so that eventually, the powers of national supervisory authorities could differ widely from one Member State to another.

Utfordringer

The powers provided to the national supervisory authorities are considerable - including sanctions - and probably will change the relationship profoundly between them and the controllers or the processors, in particular, where the authorities were previously organized as mere advisory and conciliation bodies. Thus they acquire coercive powers similar to those of the administrative authorities such as the competition authorities, with the well-known fear that they generate for the enterprises. They are therefore established for the future as real "policemen" of the data protection.

This extension of powers will necessarily involve a dramatic strengthening of human and financial resources available to existing authorities if we are to prevent these from remaining a dead letter. This will certainly raise some reluctance from the Member States, but will undoubtedly allow for the protection to be taken much more seriously than at present. In any event, the status of these authorities may change profoundly and give them institutional importance that they did not have before.

It should be noted that the Member States will retain discretion as to the application of fines to public authorities and organizations (see the comments on Article 83).

Forordning
1e 2e

Art. 58

1.   Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2.   Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3.   Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6.   Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.

1. forslag close

Art. 53 

1.           Each supervisory authority shall have the power:

(a)     to notify the controller or the processor of an alleged breach of the provisions governing the processing of personal data, and, where appropriate, order the controller or the processor to remedy that breach, in a specific manner, in order to improve the protection of the data subject;

(b)     to order the controller or the processor to comply with the data subject's requests to exercise the rights provided by this Regulation;

(c)     to order the controller and the processor, and, where applicable, the representative to provide any information relevant for the performance of its duties;

(d)     to ensure the compliance with prior authorisations and prior consultations referred to in Article 34;

(e)     to warn or admonish the controller or the processor;

(f)      to order the rectification, erasure or destruction of all data when they have been processed in breach of the provisions of this Regulation and the notification of such actions to third parties to whom the data have been disclosed;

(g)     to impose a temporary or definitive ban on processing;

(h)     to suspend data flows to a recipient in a third country or to an international organisation;

(i)      to issue opinions on any issue related to the protection of personal data;

(j)      to inform the national parliament, the government or other political institutions as well as the public on any issue related to the protection of personal data.

2.           Each supervisory authority shall have the investigative power to obtain from the controller or the processor:

(a)     access to all personal data and to all information necessary for the performance of its duties;

(b)     access to any of its premises, including to any data processing equipment and means, where there are reasonable grounds for presuming that an activity in violation of this Regulation is being carried out there.

The powers referred to in point (b) shall be exercised in conformity with Union law and Member State law.

3.           Each supervisory authority shall have the power to bring violations of this Regulation to the attention of the judicial authorities and to engage in legal proceedings, in particular pursuant to Article 74(4) and Article 75(2).

4.           Each supervisory authority shall have the power to sanction administrative offences, in particular those referred to in Article 79(4), (5) and (6).

2. forslag close

Art. 53

 1. Each Member State shall provide by law that its supervisory authority shall have at least the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller’s representative to provide any information it requires for the performance of its tasks; (aa) to carry out investigations in the form of data protection audits;

(ab) to carry out a review on certifications issued pursuant to Article 39(4);

(b) (…)

(c) (…)

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(da) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(db) to obtain access to any premises of the controller and the processor , including to any data processing equipment and means, in conformity with Union law or Member State procedural law.

1a. (…).

1b. Each Member State shall provide by law that its supervisory authority shall have the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

 (b) to issue reprimands to a controller or processor where processing operations have infringed provisions of this Regulation;

(c) (…);

(ca) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; in particular by ordering the rectification, restriction or erasure of data pursuant to Articles 16, 17 and 17a and the notification of such actions to recipients to whom the data have been disclosed pursuant to Articles 17(2a) and 17b;

(e) to impose a temporary or definitive limitation on processing (…);

(f) to order the suspension of data flows to a recipient in a third country or to an international organisation;

(g) to impose an administrative fine pursuant to Articles 79 and 79a, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.

1c. Each Member State shall provide by law that its supervisory authority shall have the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 34,

(aa) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with national law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(ab) to authorise processing referred to in Article 34(7a), if the law of the Member State requires such prior authorisation;

(ac) to issue an opinion and approve draft codes of conduct pursuant to Article 38(2);

(ad) to accredit certification bodies under the terms of Article 39a; (ae) to issue certifications and approve criteria of certification in accordance with Article 39(2a); (b) to adopt standard data protection clauses referred to in point (c) of Article 42(2);

(c) to authorise contractual clauses referred to in point (a) of Article 42 (2a);

(ca) to authorise administrative agreements referred to in point (d) of Article 42 (2a);

(d) to approve binding corporate rules pursuant to Article 43. 2. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union.

3. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and (…), where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

4. (…)

5. (…)

Direktiv close

Art. 28

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Each authority shall in particular be endowed with:

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.

Art. 58

Myndighet

1. Hver tilsynsmyndighet skal ha følgende undersøkelsesmyndighet:

a) pålegge den behandlingsansvarlige og databehandleren og, dersom det er relevant, disses representant, å framlegge all informasjon den trenger for å kunne utføre sine oppgaver,

b) utføre undersøkelser i form av personvernrevisjoner,

c) foreta en gjennomgåelse av sertifiseringer utstedt i henhold til artikkel 42 nr. 7,

d) underrette den behandlingsansvarlige eller databehandleren om en påstått overtredelse av denne forordning,

e) få tilgang, fra den behandlingsansvarlige og databehandleren, til alle personopplysninger og all informasjon som er nødvendig for å kunne utføre oppgavene den er gitt,

f) få adgang til alle lokaler hos den behandlingsansvarlige eller databehandleren, herunder til alt databehandlingsutstyr og -midler, i samsvar med unionsretten eller medlemsstatenes prosessrett.

2. Hver tilsynsmyndighet skal ha myndighet til å beslutte følgende korrigerende tiltak:

a) utstede advarsler til en behandlingsansvarlig eller databehandler om at de planlagte behandlingsaktivitetene sannsynligvis er i strid med bestemmelsene i denne forordning,

b) utstede irettesettelser til en behandlingsansvarlig eller databehandler dersom behandlingsaktivitetene er i strid med bestemmelsene i denne forordning,

c) pålegge den behandlingsansvarlige eller databehandleren å imøtekomme den registrertes anmodninger om å utøve sine rettigheter i henhold til denne forordning,

d) pålegge den behandlingsansvarlige eller databehandleren å sørge for at behandlingsaktivitetene skjer i samsvar med bestemmelsene i denne forordning og, dersom det er relevant, på en bestemt måte og innen en bestemt frist,

e) pålegge den behandlingsansvarlige å underrette den registrerte om brudd på personopplysningssikkerheten,

f) innføre en midlertidig eller varig begrensning av, herunder et forbud mot, behandling,

g) pålegge retting eller sletting av personopplysninger eller begrensning av behandlingen i henhold til artikkel 16, 17 og 18 og underretning av mottakere som personopplysningene er utlevert til i henhold til artikkel 17 nr. 2 og artikkel 19, om nevnte tiltak,

h) trekke tilbake en sertifisering eller pålegge sertifiseringsorganet å trekke tilbake en sertifisering utstedt i henhold til artikkel 42 og 43, eller pålegge sertifiseringsorganet å ikke utstede sertifisering dersom kravene til sertifisering ikke lenger er oppfylt,

i) ilegge overtredelsesgebyrer i henhold til artikkel 83 i tillegg til, eller i stedet for, tiltak som det vises til i dette nummer, avhengig av omstendighetene i hvert enkelt tilfelle,

j) gi påbud om et midlertidig opphold i datastrømmene til en mottaker i en tredjestat eller til en internasjonal organisasjon.

3. Hver tilsynsmyndighet skal ha følgende myndighet til å godkjenne og gi råd:

a) rådgi den behandlingsansvarlige i samsvar med framgangsmåten for forhåndsdrøftinger nevnt i artikkel 36,

b) avgi uttalelse, på eget initiativ eller på anmodning, til det nasjonale parlamentet, medlemsstatens regjering eller, i samsvar med medlemsstatenes nasjonale rett, til andre institusjoner og organer samt allmennheten om eventuelle spørsmål knyttet til vern av personopplysninger,

c) godkjenne behandlingen nevnt i artikkel 36 nr. 5 dersom det i medlemsstatens nasjonale rett kreves slik forhåndsgodkjenning,

d) avgi uttalelse om og godkjenne utkast til atferdsnormer i henhold til artikkel 40 nr. 5,

e) akkreditere sertifiseringsorganer i henhold til artikkel 43,

f) utstede sertifiseringer og godkjenne kriterier for sertifisering i samsvar med artikkel 42 nr. 5,

g) vedta standard personvernbestemmelser nevnt i artikkel 28 nr. 8 og i artikkel 46 nr. 2 bokstav d),

h) godkjenne avtalevilkår som nevnt i artikkel 46 nr. 3 bokstav a),

i) godkjenne administrative ordninger som nevnt i artikkel 46 nr. 3 bokstav b),

j) godkjenne bindende virksomhetsregler i henhold til artikkel 47.

4. Utøvelse av den myndighet som tilsynsmyndigheten gis i henhold til denne artikkel, skal være underlagt nødvendige garantier, herunder effektive rettsmidler og rettferdig rettergang, fastsatt i unionsretten og medlemsstatenes nasjonale rett i samsvar med pakten.

5. Hver medlemsstat skal ved lov fastsette at dens tilsynsmyndighet skal ha myndighet til å opplyse rettshåndhevende myndigheter om overtredelser av denne forordning og, der det er relevant, til å innlede eller på annen måte opptre i rettssaker med det som mål å håndheve bestemmelsene i denne forordning.

6. Hver medlemsstat kan ved lov fastsette at dens tilsynsmyndighet skal ha mer omfattende myndighet enn det som angis i nr. 1, 2 og 3. Utøvelsen av nevnte myndighet skal ikke hindre en effektiv anvendelse av kapittel VII.

Gamle loven close

Pol. § 42 Datatilsynets organisering og oppgaver

Datatilsynet er et uavhengig forvaltningsorgan administrativt underordnet Kongen og departementet. Kongen og departementet kan ikke gi instruks om eller omgjøre Datatilsynets utøving av myndighet i enkelttilfeller etter loven.

Datatilsynet skal

1) føre en systematisk og offentlig fortegnelse over alle behandlinger som er innmeldt etter § 31 eller gitt konsesjon etter § 33, med opplysninger som nevnt i § 18 første ledd jf. § 23,

2) behandle søknader om konsesjoner, motta meldinger og vurdere om det skal gis pålegg der loven gir hjemmel for dette,

3) kontrollere at lover og forskrifter som gjelder for behandling av personopplysninger blir fulgt, og at feil eller mangler blir rettet,

4) holde seg orientert om og informere om den generelle nasjonale og internasjonale utviklingen i behandlingen av personopplysninger og om de problemer som knytter seg til slik behandling,

5) identifisere farer for personvernet, og gi råd om hvordan de kan unngås eller begrenses,

6) gi råd og veiledning i spørsmål om personvern og sikring av personopplysninger til dem som planlegger å behandle personopplysninger eller utvikle systemer for slik behandling,3 herunder bistå i utarbeidelsen av bransjevise atferdsnormer,

7) etter henvendelse eller av eget tiltak gi uttalelse i spørsmål om behandling av personopplysninger, og

8) gi Kongen årsmelding om sin virksomhet.

Datatilsynet ledes av en direktør som utnevnes av Kongen. Kongen kan bestemme at direktøren ansettes på åremål.Avgjørelser som Datatilsynet fatter i medhold av § 9, § 12, § 27, § 28, § 30, § 33, § 34, § 35, § 44, § 46 og § 47 kan påklages til Personvernnemnda.4 Avgjørelser som fattes i medhold av § 27 eller § 28 kan påklages videre til Kongen dersom avgjørelsen gjelder personopplysninger som behandles for historiske formål.

close