menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Spain) language
Contact our local member in Spain mail_outline
Visit the website of RPCC Estudio Jurídico account_balance

arrow_backPrevious Article
Article 58
Next Articlearrow_forward

Powers

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 58 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 58 keyboard_arrow_up

Key words related to article 58

Show the recitals of the Regulation related to article 58 keyboard_arrow_down Hide the recitals of the Regulation related to article 58 keyboard_arrow_up

(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Show the recitals of the Directive related to article 58 keyboard_arrow_down Hide the recitals of the Directive related to article 58 keyboard_arrow_up

(63) Whereas such authorities must have the necessary means to perform their duties, including powers of investigation and intervention, particularly in cases of complaints from individuals, and powers to engage in legal proceedings; whereas such authorities must help to ensure transparency of processing in the Member States within whose jurisdiction they fall;

The GDPR

The Regulation aims, in order to ensure consistency in control and enforcement throughout the Union, that the supervisory authorities have, in each Member State, the same effective powers.

Article 58 provides quite precisely three types of powers, which the Member States must, by law, grant to their national supervisory authority:

- investigative powers (paragraph 1): to include ordering communication of information - including the processed data - needed by the supervisory authority to perform its duties (a) to carry out investigations in the form of data protection audits (b), to carry out a review on certifications issued pursuant to Article 42 (7) (c), to notify the controller or the processor of an alleged infringement of this Regulation (d); access to all personal data and to all information (e); access to any premises of the controller and the processor in compliance with Union law and national procedural law (f).

- powers to take corrective action (paragraph 2): to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation (a), to issue reprimands to a controller or a processor in case of any infringement found (b), to order the controller or the processor to comply with the data subject's requests to exercise his or her rights  (c), to order the controller or processor to bring processing operations into compliance in a specified manner and within a specified period (d), to order the controller to communicate a personal data breach to the data subject (e), to impose a temporary or definitive limitation including a ban on processing (f), to order the rectification or erasure of personal data or restriction of processing and the notification of such actions to recipients to whom the personal data have been disclosed (g), to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met (h), to impose an administrative fine pursuant to Article 83 (i), to order the suspension of data flows to a recipient in a third country or to an international organisation (j).

- authorisation and advisory powers (paragraph ): to advise the controller in accordance with the prior consultation procedure referred to in Article 36 (a); to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data (b); to authorise processing referred to in Article 36 (5), if the law of the Member State requires such prior authorization (c); to issue an opinion and approve draft codes of conduct (d); to accredit certification bodies (e); to issue certifications and approve criteria of certification (f); to adopt standard data protection clauses referred to in Article 28 (8) and in point (d) of Article 46 (2) (g); to authorise contractual clauses (h); to authorise administrative arrangements (i) or to approve binding corporate rules pursuant to Article 47 (j).

According to paragraph 4, the exercise of powers of the supervisory authorities must be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union (see developments in recital 129).

Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation (paragraph 5).

Finally, the Member States may provide by law that its supervisory authority shall have additional powers and the exercise of those powers shall not impair the effective operation of Chapter VII relating to the cooperation and the consistency (paragraph 6).

The Directive

Article 28 of the Directive provided for two types of powers given to supervisory authorities: a power of consultation of the national authorities drawing up administrative measures or regulations relating to the protection of the rights and freedoms of individuals with regard to the personal data processing (paragraph 2); effective powers of control expressed in investigative powers, effective powers of intervention and powers to engage in legal proceedings (paragraph 3).

However. A wide space for manoeuvring was left to Member States so that eventually, the powers of national supervisory authorities could differ widely from one Member State to another.

Potential issues

The powers provided to the national supervisory authorities are considerable - including sanctions - and probably will change the relationship profoundly between them and the controllers or the processors, in particular, where the authorities were previously organized as mere advisory and conciliation bodies. Thus they acquire coercive powers similar to those of the administrative authorities such as the competition authorities, with the well-known fear that they generate for the enterprises. They are therefore established for the future as real "policemen" of the data protection.

This extension of powers will necessarily involve a dramatic strengthening of human and financial resources available to existing authorities if we are to prevent these from remaining a dead letter. This will certainly raise some reluctance from the Member States, but will undoubtedly allow for the protection to be taken much more seriously than at present. In any event, the status of these authorities may change profoundly and give them institutional importance that they did not have before.

It should be noted that the Member States will retain discretion as to the application of fines to public authorities and organizations (see the comments on Article 83).

arrow_back Previous Article • Article 58 • Next Article arrow_forward
arrow_back Previous Article • Article 58 Next Article arrow_forward

Summary

European Union

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the application and setting of administrative fines - wp253 (3 October 2017)

(Endorsed by the EDPB)

The EU has completed a comprehensive reform of data protection regulation in Europe. The reform rests on several pillars (key components): coherent rules, simplified procedures, coordinated actions, user involvement, more effective information and stronger enforcement powers.

Data controllers and data processors have increased responsibilities to ensure that personal data of the individuals is protected effectively. Supervisory authorities have powers to ensure that the principles of the General Data Protection Regulation (hereafter ‘the Regulation’) as well as the rights of the individuals concerned are upheld according to the wording and the spirit of the Regulation.

Consistent enforcement of the data protection rules is central to a harmonized data protection regime. Administrative fines are a central element in the new enforcement regime introduced by the Regulation, being a powerful part of the enforcement toolbox of the supervisory authorities together with the other measures provided by article 58.

This document is intended for use by the supervisory authorities to ensure better application and enforcement of the Regulation and expresses their common understanding of the provisions of article 83 of the Regulation as well as its interplay with articles 58 and 70 and their corresponding recitals.

In particular, according to article 70, (1) (e), the European Data Protection Board (hereafter ‘EDPB’) is empowered to issue guidelines, recommendations and best practices in order to encourage consistent application of this Regulation and article 70, (1), (k) specifies the provision for guidelines concerning the setting of administrative fines.

These guidelines are not exhaustive, neither will they provide explanations about the differences between administrative, civil or criminal law systems when imposing administrative sanctions in general.

In order to achieve a consistent approach to the imposition of the administrative fines, which adequately reflects all of the principles in these guidelines, the EDPB has agreed on a common understanding of the assessment criteria in article 83 (2) of the Regulation and therefore the EDPB and individual supervisory authorities agree on using this Guideline as a common approach.

Link

Retour au sommaire
arrow_back Previous Article • Article 58 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-230/14 (1 october 2015) - Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court 

C-311/18 (19 December 2019) - Facebook Ireland et Schrems

1.   Article 2(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that that regulation applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, irrespective of whether, at the time of that transfer or thereafter, that data is liable to be processed by the authorities of the third country in question for the purposes of public security, defence and State security.

2.   Article 46(1) and Article 46(2)(c) of Regulation 2016/679 must be interpreted as meaning that the appropriate safeguards, enforceable rights and effective legal remedies required by those provisions must ensure that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses are afforded a level of protection essentially equivalent to that guaranteed within the European Union by that regulation, read in the light of the Charter of Fundamental Rights of the European Union. To that end, the assessment of the level of protection afforded in the context of such a transfer must, in particular, take into consideration both the contractual clauses agreed between the controller or processor established in the European Union and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the personal data transferred, the relevant aspects of the legal system of that third country, in particular those set out, in a non-exhaustive manner, in Article 45(2) of that regulation.

3.   Article 58(2)(f) and (j) of Regulation 2016/679 must be interpreted as meaning that, unless there is a valid European Commission adequacy decision, the competent supervisory authority is required to suspend or prohibit a transfer of data to a third country pursuant to standard data protection clauses adopted by the Commission, if, in the view of that supervisory authority and in the light of all the circumstances of that transfer, those clauses are not or cannot be complied with in that third country and the protection of the data transferred that is required by EU law, in particular by Articles 45 and 46 of that regulation and by the Charter of Fundamental Rights, cannot be ensured by other means, where the controller or a processor has not itself suspended or put an end to the transfer.

4.   Examination of Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EU of the European Parliament and of the Council, as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016 in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights has disclosed nothing to affect the validity of that decision.

5.   Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US Privacy Shield is invalid.

Opinion of Advocate general

Judgment of the Court

C-210/16 (7 June 2018) - Wirtschaftsakademie Schleswig-Holstein

1.      Article 2(d) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as meaning that the concept of ‘controller’ within the meaning of that provision encompasses the administrator of a fan page hosted on a social network.

2.      Articles 4 and 28 of Directive 95/46 must be interpreted as meaning that, where an undertaking established outside the European Union has several establishments in different Member States, the supervisory authority of a Member State is entitled to exercise the powers conferred on it by Article 28(3) of that directive with respect to an establishment of that undertaking situated in the territory of that Member State even if, as a result of the division of tasks within the group, first, that establishment is responsible solely for the sale of advertising space and other marketing activities in the territory of that Member State and, second, exclusive responsibility for collecting and processing personal data belongs, for the entire territory of the European Union, to an establishment situated in another Member State.

3.      Article 4(1)(a) and Article 28(3) and (6) of Directive 95/46 must be interpreted as meaning that, where the supervisory authority of a Member State intends to exercise with respect to an entity established in the territory of that Member State the powers of intervention referred to in Article 28(3) of that directive, on the ground of infringements of the rules on the protection of personal data committed by a third party responsible for the processing of that data whose seat is in another Member State, that supervisory authority is competent to assess, independently of the supervisory authority of the other Member State, the lawfulness of such data processing and may exercise its powers of intervention with respect to the entity established in its territory without first calling on the supervisory authority of the other Member State to intervene.

Opinion of Advocate general

Judgment of the Court

C-645/19 (15 June 2021) - Facebook Ireland Ltd e.a. c. Gegevensbeschermingsautoriteit

1) Article 55(1), Articles 56 to 58 and Articles 60 to 66 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read together with Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a supervisory authority of a Member State which, under the national legislation adopted in order to transpose Article 58(5) of that regulation, has the power to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where necessary, to initiate or engage in legal proceedings, may exercise that power in relation to an instance of cross‑border data processing even though it is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, with respect to that data processing, provided that that power is exercised in one of the situations where Regulation 2016/679 confers on that supervisory authority a competence to adopt a decision finding that such processing is in breach of the rules contained in that regulation and that the cooperation and consistency procedures laid down by that regulation are respected.

2) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, in the event of cross-border data processing, it is not a prerequisite for the exercise of the power of a supervisory authority of a Member State, other than the lead supervisory authority, to initiate or engage in legal proceedings, within the meaning of that provision, that the controller or processor with respect to the cross-border processing of personal data against whom such proceedings are brought has a main establishment or another establishment on the territory of that Member State.

3) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that the power of a supervisory authority of a Member State, other than the lead supervisory authority, to bring any alleged infringement of that regulation to the attention of a court of that Member State and, where appropriate, to initiate or engage in legal proceedings, within the meaning of that provision, may be exercised both with respect to the main establishment of the controller which is located in that authority’s own Member State and with respect to another establishment of that controller, provided that the object of the legal proceedings is a processing of data carried out in the context of the activities of that establishment and that that authority is competent to exercise that power, in accordance with the terms of the answer to the first question referred.

4) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that, where a supervisory authority of a Member State which is not the ‘lead supervisory authority’, within the meaning of Article 56(1) of that regulation, has brought a legal action, the object of which is an instance of cross-border processing of personal data, before 25 May 2018, that is, before the date when that regulation became applicable, that action may, from the perspective of EU law, be continued on the basis of the provisions of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which remains applicable in relation to infringements of the rules laid down in that directive committed up to the date when that directive was repealed. That action may, in addition, be brought by that authority with respect to infringements committed after that date, on the basis of Article 58(5) of Regulation 2016/679, provided that that action is brought in one of the situations where, exceptionally, that regulation confers on a supervisory authority of a Member State which is not the ‘lead supervisory authority’ a competence to adopt a decision finding that the processing of data in question is in breach of the rules contained in that regulation with respect to the protection of the rights of natural persons as regards the processing of personal data, and that the cooperation and consistency procedures laid down by that regulation are respected, which it is for the referring court to determine.

5) Article 58(5) of Regulation 2016/679 must be interpreted as meaning that that provision has direct effect, with the result that a national supervisory authority may rely on that provision in order to bring or continue a legal action against private parties, even where that provision has not been specifically implemented in the legislation of the Member State concerned.

Opinion of Advocate General

Judgment of the Court

C-306/21 (20 October 2022) - Koalitsia "Demokratichna Bulgaria - Obedinenie"

Article 2(2)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) must be interpreted as meaning that the processing of personal data in the context of the organisation of elections in a Member State is not excluded from the scope of that regulation.

Article 6(1)(e) and Article 58 of Regulation 2016/679 must be interpreted as meaning that those provisions do not preclude the competent authorities of a Member State from adopting an administrative measure of general application which provides for the limitation or, where appropriate, the prohibition of video recording during the vote count at polling stations in elections in that Member State.

Judgment of the Court

C-807/21 (5 December 2023) - Deutsche Wohnen SE v. Staatsanwaltschaft Berlin

1.      Article 58(2)(i) and Article 83(1) to (6) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

must be interpreted as precluding national legislation under which an administrative fine may be imposed on a legal person in its capacity as controller in respect of an infringement referred to in Article 83(4) to (6) only in so far as that infringement has previously been attributed to an identified natural person.

2.      Article 83 of Regulation 2016/679

must be interpreted as meaning that an administrative fine may be imposed pursuant to that provision only where it is established that the controller, which is both a legal person and an undertaking, intentionally or negligently committed an infringement referred to in Article 83(4) to (6) thereof.

Opinion of the Advocate General

Judgment of the Court

C-46/23 (14 mars 2024) - Újpesti Polgármesteri Hivatal

1.      Article 58(2)(d) and (g) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that the supervisory authority of a Member State is entitled, in the exercise of its corrective powers foreseen under those provisions, to order the controller or processor to erase unlawfully processed personal data, even though no request to that end has been made by the data subject with a view to exercising his or her rights pursuant to Article 17(1) of that regulation.

2.      Article 58(2) of Regulation 2016/679 must be interpreted as meaning that the power of the supervisory authority of a Member State to order the erasure of unlawfully processed personal data may apply both to data collected from the data subject and to data originating from another source.

Judgment of the Court

C-768/21 (26 September 2024) - Land Hessen 

Article 57(1)(a) and (f), Article 58(2) and Article 77(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), must be interpreted as meaning that when a breach of personal data has been established, the supervisory authority is not required to exercise a corrective power, in particular the power to impose an administrative fine, under that Article 58(2) where such action is not appropriate, necessary or proportionate to remedy the shortcoming found and to ensure that that regulation is fully enforced.

Opinion of Advocate General 

Judgment of the Court

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 58 Next Article arrow_forward
Regulation
1e 2e

Art. 58

1.   Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2.   Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3.   Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

4.   The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5.   Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6.   Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.
1st proposal close

Art. 53 

1.           Each supervisory authority shall have the power:

(a)     to notify the controller or the processor of an alleged breach of the provisions governing the processing of personal data, and, where appropriate, order the controller or the processor to remedy that breach, in a specific manner, in order to improve the protection of the data subject;

(b)     to order the controller or the processor to comply with the data subject's requests to exercise the rights provided by this Regulation;

(c)     to order the controller and the processor, and, where applicable, the representative to provide any information relevant for the performance of its duties;

(d)     to ensure the compliance with prior authorisations and prior consultations referred to in Article 34;

(e)     to warn or admonish the controller or the processor;

(f)      to order the rectification, erasure or destruction of all data when they have been processed in breach of the provisions of this Regulation and the notification of such actions to third parties to whom the data have been disclosed;

(g)     to impose a temporary or definitive ban on processing;

(h)     to suspend data flows to a recipient in a third country or to an international organisation;

(i)      to issue opinions on any issue related to the protection of personal data;

(j)      to inform the national parliament, the government or other political institutions as well as the public on any issue related to the protection of personal data.

2.           Each supervisory authority shall have the investigative power to obtain from the controller or the processor:

(a)     access to all personal data and to all information necessary for the performance of its duties;

(b)     access to any of its premises, including to any data processing equipment and means, where there are reasonable grounds for presuming that an activity in violation of this Regulation is being carried out there.

The powers referred to in point (b) shall be exercised in conformity with Union law and Member State law.

3.           Each supervisory authority shall have the power to bring violations of this Regulation to the attention of the judicial authorities and to engage in legal proceedings, in particular pursuant to Article 74(4) and Article 75(2).

4.           Each supervisory authority shall have the power to sanction administrative offences, in particular those referred to in Article 79(4), (5) and (6).
2nd proposal close

Art. 53

 1. Each Member State shall provide by law that its supervisory authority shall have at least the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller’s representative to provide any information it requires for the performance of its tasks; (aa) to carry out investigations in the form of data protection audits;

(ab) to carry out a review on certifications issued pursuant to Article 39(4);

(b) (…)

(c) (…)

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(da) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(db) to obtain access to any premises of the controller and the processor , including to any data processing equipment and means, in conformity with Union law or Member State procedural law.

1a. (…).

1b. Each Member State shall provide by law that its supervisory authority shall have the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

 (b) to issue reprimands to a controller or processor where processing operations have infringed provisions of this Regulation;

(c) (…);

(ca) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period; in particular by ordering the rectification, restriction or erasure of data pursuant to Articles 16, 17 and 17a and the notification of such actions to recipients to whom the data have been disclosed pursuant to Articles 17(2a) and 17b;

(e) to impose a temporary or definitive limitation on processing (…);

(f) to order the suspension of data flows to a recipient in a third country or to an international organisation;

(g) to impose an administrative fine pursuant to Articles 79 and 79a, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case.

1c. Each Member State shall provide by law that its supervisory authority shall have the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 34,

(aa) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with national law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(ab) to authorise processing referred to in Article 34(7a), if the law of the Member State requires such prior authorisation;

(ac) to issue an opinion and approve draft codes of conduct pursuant to Article 38(2);

(ad) to accredit certification bodies under the terms of Article 39a; (ae) to issue certifications and approve criteria of certification in accordance with Article 39(2a); (b) to adopt standard data protection clauses referred to in point (c) of Article 42(2);

(c) to authorise contractual clauses referred to in point (a) of Article 42 (2a);

(ca) to authorise administrative agreements referred to in point (d) of Article 42 (2a);

(d) to approve binding corporate rules pursuant to Article 43. 2. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter of Fundamental Rights of the European Union.

3. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and (…), where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

4. (…)

5. (…)
Directive close

Art. 28

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Each authority shall in particular be endowed with:

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.
Spain
compare_arrows
visibility Old law

Artículo 51. Ámbito y personal competente.

1. La Agencia Española de Protección de Datos desarrollará su actividad de investigación a través de las actuaciones previstas en el Título VIII y de los planes de auditoría preventivas.

 

2. La actividad de investigación se llevará a cabo por los funcionarios de la Agencia Española de Protección de Datos o por funcionarios ajenos a ella habilitados expresamente por su Presidencia.

 

3. En los casos de actuaciones conjuntas de investigación conforme a lo dispuesto en el artículo 62 del Reglamento (UE) 2016/679, el personal de las autoridades de control de otros Estados Miembros de Unión Europea que colabore con la Agencia Española de Protección de Datos ejercerá sus facultades con arreglo a lo previsto en la presente ley orgánica y bajo la orientación y en presencia del personal de esta.

 

4. Los funcionarios que desarrollen actividades de investigación tendrán la consideración de agentes de la autoridad en el ejercicio de sus funciones, y estarán obligados a guardar secreto sobre las informaciones que conozcan con ocasión de dicho ejercicio, incluso después de haber cesado en él.

 

Artículo 52. Deber de colaboración.

1. Las Administraciones Públicas, incluidas las tributarias y de la Seguridad Social, y los particulares estarán obligados a proporcionar a la Agencia Española de Protección de Datos los datos, informes, antecedentes y justificantes necesarios para llevar a cabo su actividad de investigación.

 

Cuando la información contenga datos personales la comunicación de dichos datos estará amparada por lo dispuesto en el artículo 6.1 c) del Reglamento (UE) 2016/679.

 

2. En el marco de las actuaciones previas de investigación, cuando no haya podido realizar la identificación por otros medios, la Agencia Española de Protección de Datos podrá recabar de las Administraciones Públicas, incluidas las tributarias y de la Seguridad Social, las informaciones y datos que resulten imprescindibles con la exclusiva finalidad de lograr la identificación de los responsables de las conductas que pudieran ser constitutivas de infracción del Reglamento (UE) 2016/679 y de la presente ley orgánica.

 

En el supuesto de las Administraciones tributarias y de la Seguridad Social, la información se limitará a la que resulte necesaria para poder identificar inequívocamente contra quién debe dirigirse la actuación de la Agencia Española de Protección de Datos en los supuestos de creación de entramados societarios que dificultasen el conocimiento directo del presunto responsable de la conducta contraria al Reglamento (UE) 2016/679 y a la presente ley orgánica.

 

3. Cuando no haya podido realizar la identificación por otros medios, la Agencia Española de Protección de Datos podrá recabar de los operadores que presten servicios de comunicaciones electrónicas disponibles al público y de los prestadores de servicios de la sociedad de la información los datos que obren en su poder y que resulten imprescindibles para la identificación del presunto responsable de la conducta contraria al Reglamento (UE) 2016/679 y a la presente ley orgánica cuando se hubiere llevado a cabo mediante la utilización de un servicio de la sociedad de la información o la realización de una comunicación electrónica. A tales efectos, los datos que la Agencia Española de Protección de Datos podrá recabar al amparo de este apartado son los siguientes:

 

a) Cuando la conducta se hubiera realizado mediante la utilización de un servicio de telefonía fija o móvil:

 

1.º El número de teléfono de origen de la llamada en caso de que el mismo se hubiese ocultado.

 

2.º El nombre, número de documento identificativo y dirección del abonado o usuario registrado al que corresponda ese número de teléfono.

 

3.º La mera confirmación de que se ha realizado una llamada específica entre dos números en una determinada fecha y hora.

 

b) Cuando la conducta se hubiera realizado mediante la utilización de un servicio de la sociedad de la información:

 

1.º La identificación de la dirección de protocolo de Internet desde la que se hubiera llevado a cabo la conducta y la fecha y hora de su realización.

 

2.º Si la conducta se hubiese llevado a cabo mediante correo electrónico, la identificación de la dirección de protocolo de Internet desde la que se creó la cuenta de correo y la fecha y hora en que la misma fue creada.

 

3.º El nombre, número de documento identificativo y dirección del abonado o del usuario registrado al que se le hubiera asignado la dirección de Protocolo de Internet a la que se refieren los dos párrafos anteriores.

 

Estos datos deberán ser cedidos, previo requerimiento motivado de la Agencia Española de Protección de Datos, exclusivamente en el marco de actuaciones de investigación iniciadas como consecuencia de una denuncia presentada por un afectado respecto de una conducta de una persona jurídica o respecto a la utilización de sistemas que permitan la divulgación sin restricciones de datos personales. En el resto de los supuestos la cesión de estos datos requerirá la previa obtención de autorización judicial otorgada conforme a las normas procesales cuando resultara exigible.

 

Quedan excluidos de lo previsto en este apartado los datos de tráfico que los operadores estuviesen tratando con la exclusiva finalidad de dar cumplimiento a las obligaciones previstas en la Ley 25/2007, de 18 de octubre, de conservación de datos relativos a las comunicaciones electrónicas y a las redes públicas de comunicaciones, cuya cesión solamente podrá tener lugar de acuerdo con lo dispuesto en ella, previa autorización judicial solicitada por alguno de los agentes facultados a los que se refiere el artículo 6 de dicha ley.

 

Artículo 53. Alcance de la actividad de investigación.

1. Quienes desarrollen la actividad de investigación podrán recabar las informaciones precisas para el cumplimiento de sus funciones, realizar inspecciones, requerir la exhibición o el envío de los documentos y datos necesarios, examinarlos en el lugar en que se encuentren depositados o en donde se lleven a cabo los tratamientos, obtener copia de ellos, inspeccionar los equipos físicos y lógicos y requerir la ejecución de tratamientos y programas o procedimientos de gestión y soporte del tratamiento sujetos a investigación.

 

2. Cuando fuese necesario el acceso por el personal que desarrolla la actividad de investigación al domicilio constitucionalmente protegido del inspeccionado, será preciso contar con su consentimiento o haber obtenido la correspondiente autorización judicial.

 

3. Cuando se trate de órganos judiciales u oficinas judiciales el ejercicio de las facultades de inspección se efectuará a través y por mediación del Consejo General del Poder Judicial.

 

Artículo 53 bis. Actuaciones de investigación a través de sistemas digitales.

Las actuaciones de investigación podrán realizarse a través de sistemas digitales que, mediante la videoconferencia u otro sistema similar, permitan la comunicación bidireccional y simultánea de imagen y sonido, la interacción visual, auditiva y verbal entre la Agencia Española de Protección de Datos y el inspeccionado. Además, deben garantizar la transmisión y recepción seguras de los documentos e información que se intercambien, y, en su caso, recoger las evidencias necesarias y el resultado de las actuaciones realizadas asegurando su autoría, autenticidad e integridad.

La utilización de estos sistemas se producirá cuando lo determine la Agencia y requerirá la conformidad del inspeccionado en relación con su uso y con la fecha y hora de su desarrollo.

 

Artículo 54. Planes de auditoría.

1. La Presidencia de la Agencia Española de Protección de Datos podrá acordar la realización de planes de auditoría preventiva, referidos a los tratamientos de un sector concreto de actividad. Tendrán por objeto el análisis del cumplimiento de las disposiciones del Reglamento (UE) 2016/679 y de la presente ley orgánica, a partir de la realización de actividades de investigación sobre entidades pertenecientes al sector inspeccionado o sobre los responsables objeto de la auditoría.

2. A resultas de los planes de auditoría, la Presidencia de la Agencia Española de Protección de Datos podrá dictar las directrices generales o específicas para un concreto responsable o encargado de los tratamientos precisas para asegurar la plena adaptación del sector o responsable al Reglamento (UE) 2016/679 y a la presente ley orgánica.

En la elaboración de dichas directrices la Presidencia de la Agencia Española de Protección de Datos podrá solicitar la colaboración de los organismos de supervisión de los códigos de conducta y de resolución extrajudicial de conflictos, si los hubiere.

3. Las directrices serán de obligado cumplimiento para el sector o responsable al que se refiera el plan de auditoría.

 

Artículo 55. Potestades de regulación. Circulares de la Agencia Española de Protección de Datos.

1. La Presidencia de la Agencia Española de Protección de Datos podrá dictar disposiciones que fijen los criterios a que responderá la actuación de esta autoridad en la aplicación de lo dispuesto en el Reglamento (UE) 2016/679 y en la presente ley orgánica, que se denominarán «Circulares de la Agencia Española de Protección de Datos».

2. Su elaboración se sujetará al procedimiento establecido en el Estatuto de la Agencia Española de Protección de Datos, que deberá prever los informes técnicos y jurídicos que fueran necesarios y la audiencia a los interesados.

3. Las circulares serán obligatorias una vez publicadas en el Boletín Oficial del Estado.

---

Article 51. Scope and competent personnel.

1. The Spanish Data Protection Agency will develop its investigation activity through the actions provided for in Title VIII and the preventive audit plans.

2. The investigation activity will be carried out by officials of the Spanish Data Protection Agency or by officials from outside the Agency expressly authorized by its Presidency.

3. In cases of joint investigative actions in accordance with the provisions of Article 62 of Regulation (EU) 2016/679, the staff of the supervisory authorities of other Member States of the European Union who collaborate with the Spanish Data Protection Agency shall exercise their powers in accordance with the provisions of this Organic Law and under the guidance and in the presence of the staff of the Spanish Data Protection Agency.

4. Officials carrying out investigative activities shall be considered agents of the authority in the performance of their duties, and shall be bound to keep secret any information they may learn in the course of their duties, even after they have ceased to perform them.

 

Article 52. Duty of collaboration.

1. The Public Administrations, including the tax and Social Security Administrations, and individuals shall be obliged to provide the Spanish Data Protection Agency with the data, reports, background information and supporting documents necessary to carry out its investigation activities.

 

Where the information contains personal data the communication of such data shall be covered by the provisions of Article 6(1)(c) of Regulation (EU) 2016/679.

2. Within the framework of preliminary investigation actions, when the Spanish Data Protection Agency has not been able to carry out the identification by other means, it may request the following from the Public Administrations, including tax and Social Security authorities

Social, information and data that are essential for the sole purpose of identifying those responsible for conduct that could constitute an infringement of Regulation (EU) 2016/679 and this Organic Law.

In the case of the Tax and Social Security Administrations, the information will be limited to that which is necessary to be able to unequivocally identify against whom the Spanish Data Protection Agency must take action in cases of creation of corporate networks that would make it difficult to obtain direct knowledge of the alleged perpetrator of the conduct contrary to Regulation (EU) 2016/679 and to this Organic Law.

3. When it has not been able to carry out the identification by other means, the Spanish Data Protection Agency may request from the operators that provide publicly available electronic communications services and from the providers of information society services the data in its possession that are essential for the identification of the alleged perpetrator of the conduct contrary to Regulation (EU) 2016/679 and to this Organic Law when it has been carried out through the use of an information society service or the making of an electronic communication. For such purposes, the data that the Spanish Data Protection Agency may collect under this section are the following:

a) When the conduct has been carried out through the use of a fixed or mobile telephone service:

1. ° The telephone number of origin of the call in case it has been hidden.

2. ° The name, identification document number and address of the subscriber or registered user to whom the telephone number corresponds.

3. ° The mere confirmation that a specific call has been made between two numbers at a specific date and time.

b) When the conduct has been carried out through the use of an information society service:

1. The identification of the Internet protocol address from which the conduct was carried out and the date and time of the conduct.

2. ° If the conduct was carried out by e-mail, the identification of the Internet protocol address from which the e-mail account was created and the date and time at which it was created.

3. ° The name, identification document number and address of the subscriber or registered user to whom the Internet Protocol address referred to in the two preceding paragraphs has been assigned.

These data must be transferred, upon a reasoned request from the Spanish Data Protection Agency, exclusively within the framework of investigation actions initiated as a result of a complaint filed by an affected party regarding a conduct of a legal person or regarding the use of systems that allow the unrestricted disclosure of personal data. In all other cases, the transfer of this data will require prior judicial authorization granted in accordance with the procedural rules when required.

Excluded from the provisions of this section are traffic data that operators are processing for the sole purpose of complying with the obligations set forth in Law 25/2007, of October 18, 2007, on the conservation of data relating to electronic communications and public communications networks, the transfer of which may only take place in accordance with the provisions thereof, upon prior judicial authorization requested by any of the authorized agents referred to in Article 6 of said Law.

 

Article 53. Scope of the research activity.

1. Those carrying out the investigation activity may collect the information necessary for the fulfillment of their functions, carry out inspections, require the exhibition or sending of the necessary documents and data, examine them at the place where they are stored or where the processing is carried out, obtain copies of them, inspect the physical and logical equipment and require the execution of processing and management programs or procedures and support of the processing subject to investigation.

2. When it is necessary for the personnel carrying out the investigative activity to access the constitutionally protected domicile of the inspected person, it will be necessary to have his or her consent or to have obtained the corresponding judicial authorization.

3. In the case of judicial bodies or judicial offices, the exercise of the powers of inspection shall be carried out through and by means of the General Council of the Judiciary.

 

Article 53 bis. Investigation activities through digital systems.

Investigation activities may be carried out through digital systems which, by means of videoconferencing or other similar systems, allow the bidirectional and simultaneous communication of image and sound, as well as visual, auditory and verbal interaction between the Spanish Data Protection Agency and the inspected party. In addition, such systems must ensure the secure transmission and receipt of the documents and information exchanged and, where appropriate, enable the collection of the necessary evidence and the outcome of the actions carried out guaranteeing their authorship, authenticity and integrity.

The use of such systems shall take place when determined by the Spanish Data Protection Agency and shall require the consent of the inspected party regarding their use and the date and time of their conduct.

 

Article 54. Audit plans.

1. The Presidency of the Spanish Data Protection Agency may agree to carry out preventive audit plans, referring to the processing of a specific sector of activity. They will be aimed at analyzing compliance with the provisions of Regulation (EU) 2016/679 and of this Organic Law, based on the performance of research activities on entities belonging to the inspected sector or on the controllers subject to the audit.

2. As a result of the audit plans, the Presidency of the Spanish Data Protection Agency may issue the general or specific guidelines for a specific controller or processor required to ensure the full adaptation of the sector or controller to Regulation (EU) 2016/679 and to this Organic Law.

In the preparation of such guidelines, the Presidency of the Spanish Data Protection Agency may request the collaboration of the supervisory bodies of the codes of conduct and extrajudicial resolution of conflicts, if any.

3. The guidelines shall be mandatory for the sector or manager to which the audit plan refers.

 

Article 55. Regulatory powers. Circulars of the Spanish Data Protection Agency.

1. The Presidency of the Spanish Data Protection Agency may issue provisions establishing the criteria to be followed by this authority in the application of the provisions of Regulation (EU) 2016/679 and this Organic Law, which shall be called "Circulars of the Spanish Data Protection Agency".

2. Its preparation shall be subject to the procedure established in the Statute of the Spanish Data Protection Agency, which shall provide for the necessary technical and legal reports and the hearing of the interested parties.

3. The circulars will be binding once published in the Official State Gazette.
Old law close

Organic Law 15/1999 on Personal Data Protection regulated. This law has been repealed by Organic Law 3/2018.

 
Serbia close

arrow_back Previous Article • Article 58 Next Article arrow_forward
close

2016 - www.itiplaw.eu.