Article 58 GDPR

← Article 58 - Powers →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 58 - Powers

1. Each supervisory authority shall have all of the following investigative powers:

(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information it requires for the performance of its tasks;

(b) to carry out investigations in the form of data protection audits;

(c) to carry out a review on certifications issued pursuant to Article 42(7);

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2. Each supervisory authority shall have all of the following corrective powers:

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights pursuant to this Regulation;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3. Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

(e) to accredit certification bodies pursuant to Article 43;

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

(j) to approve binding corporate rules pursuant to Article 47.

4. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6. Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.

Relevant Recitals

Recital 132: Awareness-Raising Activities and Specific Measures

Awareness-raising activities by supervisory authorities addressed to the public should include specific measures directed at controllers and processors, including micro, small and medium-sized enterprises, as well as natural persons in particular in the educational context.

Recital 129: Tasks and Powers of Supervisory Authorities

In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Recital 164: Professional and Other Equivalent Secrecy Obligations of the Controller

As regards the powers of the supervisory authorities to obtain from the controller or processor access to personal data and access to their premises, Member States may adopt by law, within the limits of this Regulation, specific rules in order to safeguard the professional or other equivalent secrecy obligations, in so far as necessary to reconcile the right to the protection of personal data with an obligation of professional secrecy. This is without prejudice to existing Member State obligations to adopt rules on professional secrecy where required by Union law.

Commentary

Article 58 GDPR standardises the powers that supervisory authorities (“SAs”) can use in performing their tasks under Article 57 GDPR. The provision includes a comprehensive catalogue of investigative, corrective and advisory powers. Such powers result directly from the GDPR and therefore do not need implementation by member states’ law. Under Article 70(1)(k) GDPR, the EDPB should in principle adopt guidelines regarding the concrete and consistent application of such powers. In this regard, all the SA’s powers are important. However, under Article 83(5)(e) GDPR, non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows by the SA pursuant to Article 58(2) GDPR or failure to provide access in violation of Article 58(1) GDPR, may result in the highest fines possible. It seems, therefore, that the legislator considers some of the powers described in Article 58 GDPR to be crucial for the functioning of SAs and, in turn, the entire GDPR system.

(1) Investigative powers

A necessary step to enforcing the GDPR and handling data subjects’ complaints is the possibility of carrying out investigations. Article 58(1) GDPR differentiates between different types of investigative powers. This powers are needed to establish the facts of a case. Only on the basis of a comprehensive clarification of the facts of the case the SA is in a position to exercise its corrective powers under Article 58(2) GDPR or its authorisation powers under Article 58(3) GDPR. SAs can combine several invegistative powers according to the needs of the investigation. To grant an example, the SA may link the data protection audit to further powers under paragraph 1, such as the access powers to obtain access to personal data processed, to information and to the premesis under Article 58(1)(e)(f) GDPR.

(a) Order the controller to provide information

The SA can instruct the controller, processor and, if applicable, the representative to provide all information that is necessary for the performance of their tasks. The obligation to provide the information relates to all information (knowledge) that is at ones disposal in any form, e.g. in written, visual, audio or data processing form, as well as data stored or accessible in other information media. It is intended to prevent that only individual pieces of information are provided to the SA during the investigation. Information includes the personal data processed, but also the information on the purpose, nature and methods of processing, origin and recipients of the data, contracts, certifications. In cases of cross-border processing information and evidence may also be important as to which of several establishments is the main establishment (Article 56 GDPR in connection with Article 4(16) GDPR).

Information can be provided, for example, by transmitting documents to the SA, submitting written statements or replying to questionnaires. In addition to this, Article 30(4) GDPR stipulates that the controller or processor or, if applicable, the representative shall make the record of processing activities available to the SA on request.

Example: xxx

Where the controller or processor would incriminate themselves by providing certain information and thus be subject to sanctions, they can invoke their right to refuse information based on the rule of law clause in Article 58(4) GDPR (see bellow) and the privilege against self-incrimination (nemo tenetur principle).

Example: xxxx

(b) Carry out data protection audits

The SAs can carry out investigations in the form of audits of data protection and of data security. An audit implies that a comprehensive qualitative examination of the effectiveness of procedures is conducted. In this context SAs can take different measures to analyse processing operations on personal data at a controller or processor, such as access to documents, the examination of hardware and software used, networks, databases, applications, interfaces, as well as the testing of security measures found or the evaluation of data records.

The initial version of Article 58 GDPR limited the scope of the audit to the business premises of the controller. After the Corrigendum of the GDPR, however, the term “business premises” was replaced by “premises”. It follows that private rooms, where at least a part of the processing takes place, are also included.

(c) Review certifications

Under Article 58(1)(c) GDPR a SA can review certifications issued in accordance with Article 42(7) GDPR when they are being renewed as well as the activities of accredited certification bodies within the meaning of Article 43(1) GDPR. During the review the SA is exemining whether the requirements of certification are still met.

(d) Notifify the controller of an alleged infringement

In accordance with Article 58(1)(d) GDPR, a SA can inform a controller or processor about an alleged – i.e. possible, but not yet determined – infringement of the GDPR ('Regulation'). Such a notice can be given, for example, directly in connection with a data protection audit, a data subject’s complaint or official information from another SA. The notice establishes a presumption of a violation of the GDPR, which, however, can be rejected by the controller or the processor. This appears to be a constructive and proportional approach which gives controllers and processors a chance to know the provisional understanding of the SA and react accordingly, making submissions and/or bringing the processing into compliance, if a violation exists.

(e) Obtain access to personal data and all relevant information

The powers of investigation of the SAs also include a right of access to personal data and information in accordance with Article 58(1)(e) GDPR. This includes the right to directly access personal data, inspect internal documents, databases and procedures, and therefore is wider and more incisive than the right to (request and) obtain information under Article 58(1)(a) GDPR. SAs can obtain access to documents and systems on site and/or to connect into the processing systems. SAs are also authorised to record the technical and organisational background of data processing, which means that all documents on procedures and security documentation are subject to access, including technical information on systems which do not yet process personal data, but which may enable a link with or to personal data. Controllers and processors must cooperate with the SA during the inspection (Article 31 GDPR). However, if the cooperation yields a violation of the nemo tenetur principle (privilege against self-incrimination), it seems possible for the investigated party to lawfully refuse such cooperation. Failure to provide access can pursuant to Article 83(5)(e) GDPR result in an administrative fine of up to 20 000 000 EUR or up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.

(f) Obtain access to premises including equipment and means

Finally, data protection SAs – similarly to the Commission and the national competition authorities in EU antitrust proceedings – are given the power to search the controller’s (or processor’s) premises in accordance with Article 58(1)(f) GDPR. The search is not restricted to the business premises but a judge’s authorization is indispensable with regard to the inviolability of the home and comparable places. The term “premises” includes all data processing systems and all data processing devices. Member States might adopt special provisions in relation to controllers or processors that are subject to an obligation of professional secrecy or other equivalent obligations of secrecy with regard to SAs authorisation to access under Article 58(1)(e)(f) GDPR (Article 90(1) GDPR).

Example: The Norvegian SA enters the premises and is granted access to the data base of a Norvegian company during an investigation.

(2) Corrective powers

The corrective powers provided for in Article 58(2) GDPR enable the SAs to restore GDPR-compliant conditions in the event of violations. For this purpose, Article 58(2) GDPR builds a system of powers which should be proportionally used having in mind the type of the envisaged violation and the risks for the data subjects.

“Where, following its investigation, such an authority finds an infringement of the provisions of that regulation, it is required to react appropriately in order to remedy the shortcoming found. To that end, Article 58(2) of that regulation lists the various corrective measures that the supervisory authority may adopt [...].”

CJEU - Joined Cases C‑26/22 and C‑64/22 - SCHUFA, margin number 57.

The GDPR leaves the SA a discretion as to the manner in which it must remedy any violation found. Thus, the SA must determine which action is appropriate and necessary, and must do so taking into consideration all the circumstances of the specific case as well as its responsibility to ensure that the GDPR is fully enforced with all due diligence. In doing so, a SA has to decide at its due discretion whether exercising a milder remedial power (e.g. a warning) is sufficient to ensure the application and enforcement of the GDPR, or whether a more profound measure (e.g. a ban of on a processing activity) should be administered.

SAs are generally required to take action and use one or more of the corrective powers provided for in Article 58(2) GDPR whenever it is necessary to remedy a violation or when it is appropriate to ensure that that regulation is fully enforced. However, in exceptional cases SAs might have discretion whether to exercise corrective powers. This is might be the case when the GDPR violation has already been remedied and the processing of personal data is already brought into compliance with the GDPR. Additionally, such non-action must not undermine the consistent and high level of protection of personal data through strong enforcement of the GDPR.

"In that regard, it cannot be ruled out that, exceptionally and in the light of the particular circumstances of the specific case, the supervisory authority may refrain from exercising a corrective power even though a breach of personal data has been established. That could be the case, inter alia, where the breach established has not continued, for example where the controller, which had, in principle, implemented appropriate technical and organisational measures within the meaning of Article 24 of the GDPR, has, as soon as it became aware of that breach, taken appropriate and necessary measures to ensure that that breach is brought to an end and does not recur, in view of its obligations under, inter alia, Article 5(2) and Article 24 of that regulation."

CJEU - C-768/21 - Land Hessen, margin number 43.

The SA's decision whether and how to use its corrective powers is subject to full judicial review in accordance with Article 79 GDPR.

Article 83(5)(e) and Article 83(6) GDPR stipulate that non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows can be punished with up to €20,000,000 EUR or in the case of an undertaking, up to 4 % of the total worldwide annual turnover.

(a) Issue warnings

The mildest expression of the authority’s powers is the warning. The SA issues it if an intended processing operation is “likely” to violate the GDPR. A warning can be issued in cases where the processing has not started yet but is "intended". There are no specifics as to the form of the warning. It follows that it can be issued in writing or orally (although a formal approach appears sensible). The controller can react to a warning by redesigning the intended processing operation in a manner that makes it compliant with the law.

Example: The Danish SA issues a written warning to a Danish company that their intended data base is likely to violate the GDPR unless they they implement measures to mitigate risks, such as data encryption, after the Danish company seems to be ignoring the written advice provided in prior consultations under Article 36 GDPR, and plans to proceed with the intended processing without implementing all the adjustments that the Danish SA had identified as necessary.

(b) Issue reprimands

If the SA identifies a violation of the GDPR, it may, under Article 58(2)(b) GDPR, issue a reprimand to a controller or a processor. Contrary to what happens in case of a warning, the reprimand indicates that one (or more rarely, several) violation of the GDPR has already occurred and has been established by the SA. The SA will issue a reprimand if the threshold for imposing a fine has not yet been reached. For these reasons, scholars have defined the reprimand as the “little sister of the fine” or compared it to a “yellow card” from the SA. However, if a reprimand is disregarded, the SA can respond by exercising more stringent remedial powers and taking into account the conduct as a factor for a possible administrative fine (Article 83 GDPR).

Example: xxxx

(c) Order to comply with data subject’s requests

Article 58(2)(c) GDPR serves as a second-level remedy in case a controller or processor violates the rights of the data subject. Should that happen, the SA can then instruct the controller or the processor to comply with the data subject’s request, such as with regard to the right to access (Article 15 GDPR), rectification (Article 16 GDPR), erasure (Article 17 GDPR), restriction (Article 18 GDPR), notification (Article 19 GDPR) or data portability (Article 20 GDPR). In these cases, the SA acts through an “order”.

Example: The Bavarian SA orders a company to provide to the complainant a full copy of all of her data that they are processing within 10 days after it has received the order.

(d) Order to bring processing in compliance with the GDPR

The SA can instruct the controller or processor to bring processing operations in line with the GDPR. Adjusment of processing to become GDPR compliant can be required in a specific manner and within a specific period of time. The order must always be sufficiently specific in terms of content. The controller must be able to understand what is required of them, so that they can act accordingly. If there are several options for bringing the processing in compliance with the requirements of the GDPR, the order must be written in a manner that the controller will be in a position to choose any of the options. The order must not be restricted to a certain option in such situations for reasons of proportionality. If, for example, several equally efficient encryption methods exist according to the state of the art, it must be examined whether the order can leave the choice of the specific method to the controller. Otherwise, there is no limit to the type of instruction. The wording of the law appears to authorise any request that could serve the scope of (re-)establishing GDPR compliance. Measures include, for example, instructions to take technical and organisational measures within the meaning of Article 32 GDPR, to appoint a data protection officer according to Article 37 GDPR, to create and maintain a record of processing activities according to Article 30 GDPR, to regulate the relationship with a processor by means of a contract or other binding legal act (Article 28(3) GDPR), to change the alignment of surveillance cameras, or to change the use of pre-formulated consent within the meaning of Article 7 GDPR.

Example: xxxx

(e) Order communication of a data breach to the data subject

According to Article 58(2)(e) GDPR of the GDPR, the SA can instruct the controller to immediately notify persons affected by a data breach which triggers the notification obligations under Article 33 GDPR and Article 34 GDPR. This provision is closely connected to Article 34(4) GDPR that clarifies that the SA can require the controller to comunicate a personal data breach to a data subject, if it considers that the data breach is resulting in a high risk. The order is always addressed to the controller as controllers are obliged to inform data subjects of a data breach also, if the data breach occured on the side of the processor (Article 33(1)(2) GDPR).

Example: xxx

(f) Impose a limitation or a ban on processing

The SA can also order a limitation or ban on data processing in accordance with Article 58(2)(f) GDPR. The limitation on data processing can be temporary or permanent. A ban does not only limit but prohibits processing completely. In case of a ban the limitation not only concern certain data, processing purposes or a certain duration, but the processing as a whole is prohibited. For example, a ban of processing will be ordered if certain processing with a specific service provider cannot be organised in compliance with the GDPR.

These measures are strict and should be considered only as long as and to the extent that it is necessary and proportionate. In particularly, in the case of a ban as a particularly invasive measure, the SA must always check whether milder, equally suitable means are available, such as a limitation of processing. A ban on processing should be the last resort. At the same time, however, the ban will be a proportionate or sometimes even the only effective means, in particular in cases where it is impossible for the controller or processor to establish legal compliance for a processing operation. For example, if the processing takes place without a legal basis (Article 6 GDPR), the conditions for consent in accordance with Article 7 GDPR cannot be met in relation to the processing operation or no suitable technical and organisational measures in accordance with Article 32 GDPR can be implemented in accordance with the state of the art. Moreover, it is at the discretion of the SA whether it prefers an immediate remedy to a delayed adjustment.

A ban is to be considered also when controller or processor has shown a particularly disrespectful conduct, as it happens when a previous warning, reprimand or order has been issued and the recipient has disregarded it. For example, the Norvegian SA imposed a temporary ban on processing of data for behavioral advertising on Facebook and Instagram for Noway, after Meta failed to comply with the decison of the Irish SA adopted under the Article 60 GDPR mechanism and bring cross-border processing for behavioral advertising on Facebook and Instagram in line with the GDPR within the set time limit. Both decisions are under appeal. The ban was extended to the whole EU/EEA by a EDPB Urgent Binding Decision adopted under Article 66 GDPR instructing the Irish SA as the LSA to take, within two weeks, final measures regarding Meta and to impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire EEA.

In general, the unlawfulness of the processing is a condition for a limitation or ban of processing by a SA. However, in exceptional cases where the (un)lawfulness is not yet established (certain), but the risk for the data subjects is high, presumably unlawful processing can be limited or banned until the question of lawfulness of such processing has been clarified.

(g) Order to rectify or erase personal data

Article 58(2)(g) GDPR authorises the SA to order a correction or deletion of data (Article 16 GDPR, Article 17 GDPR) or a restriction of data processing (Article 18 GDPR), provided that the conditions for the measure laid down in respective Article are fulfilled. The SA can intervene ex officio. A prior request of the data subject or a complaint is not necessary. In addition, the SA can order that the controller has to notify the recipients of data that the data has been rectified, erased or the processing thereof had been restricted (Article 17(2) GDPR and Article 19 GDPR). The addressee of the order is always the controller, as the rights listed in Article 58(2)(g) GDPR apply only to controllers.

(h) Withdraw a certification

If a SA comes to the conclusion that the prerequisites of a previously issued certification are no longer met, it might, in accordance with Article 42(7) GDPR, revoke the certification. If the certification is granted by a certification body, the SA can do so in accordance with Article 58(2) GDPR and instruct the body to revoke the certification or not to issue it. Correspondingly, Article 43(1) GDPR provides for an obligation of the certification bodies to inform the SA in order to allow it to exercise its powers before the body issues or renews a certificate. Under Article 43(2)(c) GDPR every certification body must have their own procedures for review and revocation of certifications. The aim of this provision is that the SA intervenes in the event that it has justified doubts about the independence and credibility of a certification body so that procedures, products and services can no longer benefit from the sales-promoting effect of the certification.

(i) Impose an administrative fine

The most renowned (although probably not most important) remedy introduced by the GDPR is the imposition of a fine under Article 58(2) GDPR in conjunction with Article 83 GDPR. Their amount, which can go to up to EUR 20 million or, if superior, up to 4 % of the undertaking’s total worldwide annual turnover, is determined taking into account the type of violation (Article 83(4)(5) GDPR) as well as other qualitative factors listed in Article 83(2) GDPR, in particular according to the type, gravity and duration of the infringement. The SA can, but does not have to, impose fines for violations. The relevant decision is at the discretion of the SA, whereby the considerations mentioned in Article 83 GDPR are to be taken into account. The fine can be imposed in addition to or instead of further remedial measures within the meaning of Article 58(2)(a)-(h) GDPR.

Case law: Åkerberg Fransson ECJ ruling shows that the principle ne bis in idem does not apply if a measure with a punitive nature is imposed in addition to one without a punitive nature. It is therefore permissible to impose a fine alongside an administrative measure that is not punitive.

(j) Order suspension of data flows to a recipient in a third country

A final remedy is provided for in Article 58(2)(j) GDPR. According to this, a SA can order the suspension of data transfer to a third country or to an international organisation if the third country or international organisation concerned does not or no longer offers an appropriate level of protection within the meaning of Article 45 GDPR.

(3) Advisory powers

The authorisation and advisory powers in Article 58(3) GDPR supplement the investigative and corrective measures SAs are afforded with. Article 58(3) GDPR lists all those cases in which authorisation or approval from a SA is a prerequisite for acting in accordance with the GDPR. In these cases, the SA carries out a prior check in order to preventively ensure the application and enforcement of the GDPR. In detail, this concerns the following powers (cf. Article 58(3)(c)-(j) GDPR): Approval of processing that is particularly risky for the fundamental data protection right, provided that a member state has made use of the optional specification clause (Article 36(5) GDPR); Opinion on and approval of drafts for rules of conduct in accordance with Article 40(5) GDPR and, where relevant, Article 64(1)(b) GDPR; Accreditation of certification bodies in accordance with Article 43 GDPR; Issuing of certifications in accordance with Article 42(5), if relevant, in accordance with Article 64(1)(c) GDPR; Standard contractual clauses in accordance with Article 28(8) GDPR and, if the case, Article 46(2) GDPR; Approval of standard contractual clauses for international data transfer in accordance with Article 46(3)(a) GDPR and Article 64(1)(e) GDPR; Approval of administrative agreements for international data transfer in accordance with Article 46(3) (b) GDPR; Approval of binding corporate rules in accordance with Article 47 GDPR.

(4) Appropriate safeguards

In the absence of a uniform European administrative procedural law, the powers of the SAs must in principle be exercised in accordance with the national procedural law of the respective member state. National procedural law must meet certain requirements; in particular, it must provide for due process and effective judicial remedies.

(5) Supervisory authorities (SAs) in courts

Article 58(5) GDPR contains an opening clause that must be filled out by the legislators of the member states. According to this, SAs must always have the power to bring violations of the GDPR to court. Specifying national legal provisions must decide whether a SA itself has a right of action or whether it has to involve the national judicial authorities, which in turn have to initiate judicial proceedings. The GDPR allows the member states to insert the enforcement powers of the national SAs into the national legal system.

(6) Additional powers provided by national law

According to Article 58(6) GDPR, each member state can stipulate that its SA receives further powers in addition to those mentioned in paragraphs 1-3, provided that this not impair the effective implementation of Chapter VII of the GDPR on cooperation and coherence. Based on the express wording of paragraph 6, it can be assumed that the SAs may be given additional powers, but that the existing powers may not be restricted. A contrary view cannot be derived from any other provision of the GDPR.

Decisions

→ You can find all related decisions in Category:Article 58 GDPR