legal_corpus.jsonl

{"source": "GDPR", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 1, "article_title": "Subject-matter and objectives", "content": "Source: GDPR\nChapter I – General provisions\nArticle 1 – Subject-matter and objectives\n\n1.\nThis Regulation lays down rules relating to the protection of natural persons with regard to the processing of\npersonal data and rules relating to the free movement of personal data.\n2.\nThis Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the\nprotection of personal data.\n3.\nThe free movement of personal data within the Union shall be neither restricted nor prohibited for reasons\nconnected with the protection of natural persons with regard to the processing of personal data."}
{"source": "GDPR", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 2, "article_title": "Material scope", "content": "Source: GDPR\nChapter I – General provisions\nArticle 2 – Material scope\n\n1.\nThis Regulation applies to the processing of personal data wholly or partly by automated means and to the\nprocessing other than by automated means of personal data which form part of a filing system or are intended to form\npart of a filing system.\n2.\nThis Regulation does not apply to the processing of personal data:\n(a) in the course of an activity which falls outside the scope of Union law;\n(b) by the Member States when carrying out activities which fall within the scope of Chapter 2 of Title V of the TEU;\n(c) by a natural person in the course of a purely personal or household activity;\n(d) by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal\noffences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to\npublic security.\n3.\nFor the processing of personal data by the Union institutions, bodies, offices and agencies, Regulation (EC)\nNo 45/2001 applies. Regulation (EC) No 45/2001 and other Union legal acts applicable to such processing of personal\ndata shall be adapted to the principles and rules of this Regulation in accordance with Article 98.\n4.\nThis Regulation shall be without prejudice to the application of Directive 2000/31/EC, in particular of the liability\nrules of intermediary service providers in Articles 12 to 15 of that Directive."}
{"source": "GDPR", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 3, "article_title": "Territorial scope", "content": "Source: GDPR\nChapter I – General provisions\nArticle 3 – Territorial scope\n\n1.\nThis Regulation applies to the processing of personal data in the context of the activities of an establishment of a\ncontroller or a processor in the Union, regardless of whether the processing takes place in the Union or not.\n4.5.2016\nEN\n2.\nThis Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or\nprocessor not established in the Union, where the processing activities are related to:\n(a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data\nsubjects in the Union; or\n(b) the monitoring of their behaviour as far as their behaviour takes place within the Union.\n3.\nThis Regulation applies to the processing of personal data by a controller not established in the Union, but in a\nplace where Member State law applies by virtue of public international law."}
{"source": "GDPR", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 4, "article_title": "Definitions", "content": "Source: GDPR\nChapter I – General provisions\nArticle 4 – Definitions\n\nFor the purposes of this Regulation:\n(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an\nidentifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an\nidentifier such as a name, an identification number, location data, an online identifier or to one or more factors\nspecific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;\n(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal\ndata, whether or not by automated means, such as collection, recording, organisation, structuring, storage,\nadaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making\navailable, alignment or combination, restriction, erasure or destruction;\n(3) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in\nthe future;\n(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to\nevaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning\nthat natural person's performance at work, economic situation, health, personal preferences, interests, reliability,\nbehaviour, location or movements;\n(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer\nbe attributed to a specific data subject without the use of additional information, provided that such additional\ninformation is kept separately and is subject to technical and organisational measures to ensure that the personal\ndata are not attributed to an identified or identifiable natural person;\n(6) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether\ncentralised, decentralised or dispersed on a functional or geographical basis;\n(7) ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with\nothers, determines the purposes and means of the processing of personal data; where the purposes and means of\nsuch processing are determined by Union or Member State law, the controller or the specific criteria for its\nnomination may be provided for by Union or Member State law;\n(8) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data\non behalf of the controller;\n(9) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are\ndisclosed, whether a third party or not. However, public authorities which may receive personal data in the\n4.5.2016\nEN\nframework of a particular inquiry in accordance with Union or Member State law shall not be regarded as\nrecipients; the processing of those data by those public authorities shall be in compliance with the applicable data\nprotection rules according to the purposes of the processing;\n(10) ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject,\ncontroller, processor and persons who, under the direct authority of the controller or processor, are authorised to\nprocess personal data;\n(11) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data\nsubject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the\nprocessing of personal data relating to him or her;\n(12) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration,\nunauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;\n(13) ‘genetic data’ means personal data relating to the inherited or acquired genetic characteristics of a natural person\nwhich give unique information about the physiology or the health of that natural person and which result, in\nparticular, from an analysis of a biological sample from the natural person in question;\n(14) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physio­\nlogical or behavioural characteristics of a natural person, which allow or confirm the unique identification of that\nnatural person, such as facial images or dactyloscopic data;\n(15) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including\nthe provision of health care services, which reveal information about his or her health status;\n(16) ‘main establishment’ means:\n(a) as regards a controller with establishments in more than one Member State, the place of its central adminis­\ntration in the Union, unless the decisions on the purposes and means of the processing of personal data are\ntaken in another establishment of the controller in the Union and the latter establishment has the power to\nhave such decisions implemented, in which case the establishment having taken such decisions is to be\nconsidered to be the main establishment;\n(b) as regards a processor with establishments in more than one Member State, the place of its central adminis­\ntration in the Union, or, if the processor has no central administration in the Union, the establishment of the\nprocessor in the Union where the main processing activities in the context of the activities of an establishment\nof the processor take place to the extent that the processor is subject to specific obligations under this\nRegulation;\n(17) ‘representative’ means a natural or legal person established in the Union who, designated by the controller or\nprocessor in writing pursuant to Article 27, represents the controller or processor with regard to their respective\nobligations under this Regulation;\n(18) ‘enterprise’ means a natural or legal person engaged in an economic activity, irrespective of its legal form, including\npartnerships or associations regularly engaged in an economic activity;\n(19) ‘group of undertakings’ means a controlling undertaking and its controlled undertakings;\n(20) ‘binding corporate rules’ means personal data protection policies which are adhered to by a controller or processor\nestablished on the territory of a Member State for transfers or a set of transfers of personal data to a controller or\nprocessor in one or more third countries within a group of undertakings, or group of enterprises engaged in a\njoint economic activity;\n(21) ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to\nArticle 51;\n4.5.2016\nEN\n(22) ‘supervisory authority concerned’ means a supervisory authority which is concerned by the processing of personal\ndata because:\n(a) the controller or processor is established on the territory of the Member State of that supervisory authority;\n(b) data subjects residing in the Member State of that supervisory authority are substantially affected or likely to be\nsubstantially affected by the processing; or\n(c) a complaint has been lodged with that supervisory authority;\n(23) ‘cross-border processing’ means either:\n(a) processing of personal data which takes place in the context of the activities of establishments in more than\none Member State of a controller or processor in the Union where the controller or processor is established in\nmore than one Member State; or\n(b) processing of personal data which takes place in the context of the activities of a single establishment of a\ncontroller or processor in the Union but which substantially affects or is likely to substantially affect data\nsubjects in more than one Member State.\n(24) ‘relevant and reasoned objection’ means an objection to a draft decision as to whether there is an infringement of\nthis Regulation, or whether envisaged action in relation to the controller or processor complies with this\nRegulation, which clearly demonstrates the significance of the risks posed by the draft decision as regards the\nfundamental rights and freedoms of data subjects and, where applicable, the free flow of personal data within the\nUnion;\n(25) ‘information society service’ means a service as defined in point (b) of Article 1(1) of Directive (EU) 2015/1535 of\nthe European Parliament and of the Council (1);\n(26) ‘international organisation’ means an organisation and its subordinate bodies governed by public international law,\nor any other body which is set up by, or on the basis of, an agreement between two or more countries."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 5, "article_title": "Principles relating to processing of personal data", "content": "Source: GDPR\nChapter II – Principles\nArticle 5 – Principles relating to processing of personal data\n\n1.\nPersonal data shall be:\n(a) processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and\ntransparency’);\n(b) collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible\nwith those purposes; further processing for archiving purposes in the public interest, scientific or historical research\npurposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with\nthe initial purposes (‘purpose limitation’);\n(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data\nminimisation’);\n(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that\nare inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay\n(‘accuracy’);\n4.5.2016\nEN\n(1) Directive (EU) 2015/1535 of the European Parliament and of the Council of 9 September 2015 laying down a procedure for the\nprovision of information in the field of technical regulations and of rules on Information Society services (OJ L 241, 17.9.2015, p. 1).\n(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for\nwhich the personal data are processed; personal data may be stored for longer periods insofar as the personal data\nwill be processed solely for archiving purposes in the public interest, scientific or historical research purposes or\nstatistical purposes in accordance with Article 89(1) subject to implementation of the appropriate technical and\norganisational measures required by this Regulation in order to safeguard the rights and freedoms of the data subject\n(‘storage limitation’);\n(f) processed in a manner that ensures appropriate security of the personal data, including protection against\nunauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical\nor organisational measures (‘integrity and confidentiality’).\n2.\nThe controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’)."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 6, "article_title": "Lawfulness of processing", "content": "Source: GDPR\nChapter II – Principles\nArticle 6 – Lawfulness of processing\n\n1.\nProcessing shall be lawful only if and to the extent that at least one of the following applies:\n(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;\n(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps\nat the request of the data subject prior to entering into a contract;\n(c) processing is necessary for compliance with a legal obligation to which the controller is subject;\n(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person;\n(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official\nauthority vested in the controller;\n(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party,\nexcept where such interests are overridden by the interests or fundamental rights and freedoms of the data subject\nwhich require protection of personal data, in particular where the data subject is a child.\nPoint (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of\ntheir tasks.\n2.\nMember States may maintain or introduce more specific provisions to adapt the application of the rules of this\nRegulation with regard to processing for compliance with points (c) and (e) of paragraph 1 by determining more\nprecisely specific requirements for the processing and other measures to ensure lawful and fair processing including for\nother specific processing situations as provided for in Chapter IX.\n3.\nThe basis for the processing referred to in point (c) and (e) of paragraph 1 shall be laid down by:\n(a) Union law; or\n(b) Member State law to which the controller is subject.\nThe purpose of the processing shall be determined in that legal basis or, as regards the processing referred to in point (e)\nof paragraph 1, shall be necessary for the performance of a task carried out in the public interest or in the exercise of\nofficial authority vested in the controller. That legal basis may contain specific provisions to adapt the application of\nrules of this Regulation, inter alia: the general conditions governing the lawfulness of processing by the controller; the\ntypes of data which are subject to the processing; the data subjects concerned; the entities to, and the purposes for\nwhich, the personal data may be disclosed; the purpose limitation; storage periods; and processing operations and\nprocessing procedures, including measures to ensure lawful and fair processing such as those for other specific\n4.5.2016\nEN\nprocessing situations as provided for in Chapter IX. The Union or the Member State law shall meet an objective of\npublic interest and be proportionate to the legitimate aim pursued.\n4.\nWhere the processing for a purpose other than that for which the personal data have been collected is not based\non the data subject's consent or on a Union or Member State law which constitutes a necessary and proportionate\nmeasure in a democratic society to safeguard the objectives referred to in Article 23(1), the controller shall, in order to\nascertain whether processing for another purpose is compatible with the purpose for which the personal data are\ninitially collected, take into account, inter alia:\n(a) any link between the purposes for which the personal data have been collected and the purposes of the intended\nfurther processing;\n(b) the context in which the personal data have been collected, in particular regarding the relationship between data\nsubjects and the controller;\n(c) the nature of the personal data, in particular whether special categories of personal data are processed, pursuant to\nArticle 9, or whether personal data related to criminal convictions and offences are processed, pursuant to Article\n10;\n(d) the possible consequences of the intended further processing for data subjects;\n(e) the existence of appropriate safeguards, which may include encryption or pseudonymisation."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 7, "article_title": "Conditions for consent", "content": "Source: GDPR\nChapter II – Principles\nArticle 7 – Conditions for consent\n\n1.\nWhere processing is based on consent, the controller shall be able to demonstrate that the data subject has\nconsented to processing of his or her personal data.\n2.\nIf the data subject's consent is given in the context of a written declaration which also concerns other matters, the\nrequest for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an\nintelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes\nan infringement of this Regulation shall not be binding.\n3.\nThe data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall\nnot affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject\nshall be informed thereof. It shall be as easy to withdraw as to give consent.\n4.\nWhen assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the\nperformance of a contract, including the provision of a service, is conditional on consent to the processing of personal\ndata that is not necessary for the performance of that contract."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 8, "article_title": "Conditions applicable to child's consent in relation to information society services", "content": "Source: GDPR\nChapter II – Principles\nArticle 8 – Conditions applicable to child's consent in relation to information society services\n\n1.\nWhere point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child,\nthe processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is\nbelow the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised\nby the holder of parental responsibility over the child.\nMember States may provide by law for a lower age for those purposes provided that such lower age is not below 13\nyears.\n4.5.2016\nEN\n2.\nThe controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the\nholder of parental responsibility over the child, taking into consideration available technology.\n3.\nParagraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation\nor effect of a contract in relation to a child."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 9, "article_title": "Processing of special categories of personal data", "content": "Source: GDPR\nChapter II – Principles\nArticle 9 – Processing of special categories of personal data\n\n1.\nProcessing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or\ntrade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a\nnatural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be\nprohibited.\n2.\nParagraph 1 shall not apply if one of the following applies:\n(a) the data subject has given explicit consent to the processing of those personal data for one or more specified\npurposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not\nbe lifted by the data subject;\n(b) processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the\ncontroller or of the data subject in the field of employment and social security and social protection law in so far as\nit is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for\nappropriate safeguards for the fundamental rights and the interests of the data subject;\n(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data\nsubject is physically or legally incapable of giving consent;\n(d) processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation,\nassociation or any other not-for-profit body with a political, philosophical, religious or trade union aim and on\ncondition that the processing relates solely to the members or to former members of the body or to persons who\nhave regular contact with it in connection with its purposes and that the personal data are not disclosed outside that\nbody without the consent of the data subjects;\n(e) processing relates to personal data which are manifestly made public by the data subject;\n(f) processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in\ntheir judicial capacity;\n(g) processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which\nshall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for\nsuitable and specific measures to safeguard the fundamental rights and the interests of the data subject;\n(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working\ncapacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management\nof health or social care systems and services on the basis of Union or Member State law or pursuant to contract\nwith a health professional and subject to the conditions and safeguards referred to in paragraph 3;\n(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious\ncross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal\nproducts or medical devices, on the basis of Union or Member State law which provides for suitable and specific\nmeasures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;\n4.5.2016\nEN\n(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or\nstatistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be propor­\ntionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific\nmeasures to safeguard the fundamental rights and the interests of the data subject.\n3.\nPersonal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2\nwhen those data are processed by or under the responsibility of a professional subject to the obligation of professional\nsecrecy under Union or Member State law or rules established by national competent bodies or by another person also\nsubject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.\n4.\nMember States may maintain or introduce further conditions, including limitations, with regard to the processing\nof genetic data, biometric data or data concerning health."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 10, "article_title": "Processing of personal data relating to criminal convictions and offences", "content": "Source: GDPR\nChapter II – Principles\nArticle 10 – Processing of personal data relating to criminal convictions and offences\n\nProcessing of personal data relating to criminal convictions and offences or related security measures based on\nArticle 6(1) shall be carried out only under the control of official authority or when the processing is authorised by\nUnion or Member State law providing for appropriate safeguards for the rights and freedoms of data subjects. Any\ncomprehensive register of criminal convictions shall be kept only under the control of official authority."}
{"source": "GDPR", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 11, "article_title": "Processing which does not require identification", "content": "Source: GDPR\nChapter II – Principles\nArticle 11 – Processing which does not require identification\n\n1.\nIf the purposes for which a controller processes personal data do not or do no longer require the identification of\na data subject by the controller, the controller shall not be obliged to maintain, acquire or process additional\ninformation in order to identify the data subject for the sole purpose of complying with this Regulation.\n2.\nWhere, in cases referred to in paragraph 1 of this Article, the controller is able to demonstrate that it is not in a\nposition to identify the data subject, the controller shall inform the data subject accordingly, if possible. In such cases,\nArticles 15 to 20 shall not apply except where the data subject, for the purpose of exercising his or her rights under\nthose articles, provides additional information enabling his or her identification."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "1", "title": "Transparency and modalities"}, "article_number": 12, "article_title": "Transparent information, communication and modalities for the exercise of the rights of the data", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 1 – Transparency and modalities\nArticle 12 – Transparent information, communication and modalities for the exercise of the rights of the data\n\nsubject\n1.\nThe controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and\nany communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent,\nintelligible and easily accessible form, using clear and plain language, in particular for any information addressed\nspecifically to a child. The information shall be provided in writing, or by other means, including, where appropriate, by\nelectronic means. When requested by the data subject, the information may be provided orally, provided that the\nidentity of the data subject is proven by other means.\n4.5.2016\nEN\n2.\nThe controller shall facilitate the exercise of data subject rights under Articles 15 to 22. In the cases referred to in\nArticle 11(2), the controller shall not refuse to act on the request of the data subject for exercising his or her rights\nunder Articles 15 to 22, unless the controller demonstrates that it is not in a position to identify the data subject.\n3.\nThe controller shall provide information on action taken on a request under Articles 15 to 22 to the data subject\nwithout undue delay and in any event within one month of receipt of the request. That period may be extended by two\nfurther months where necessary, taking into account the complexity and number of the requests. The controller shall\ninform the data subject of any such extension within one month of receipt of the request, together with the reasons for\nthe delay. Where the data subject makes the request by electronic form means, the information shall be provided by\nelectronic means where possible, unless otherwise requested by the data subject.\n4.\nIf the controller does not take action on the request of the data subject, the controller shall inform the data subject\nwithout delay and at the latest within one month of receipt of the request of the reasons for not taking action and on\nthe possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.\n5.\nInformation provided under Articles 13 and 14 and any communication and any actions taken under Articles 15\nto 22 and 34 shall be provided free of charge. Where requests from a data subject are manifestly unfounded or\nexcessive, in particular because of their repetitive character, the controller may either:\n(a) charge a reasonable fee taking into account the administrative costs of providing the information or communication\nor taking the action requested; or\n(b) refuse to act on the request.\nThe controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.\n6.\nWithout prejudice to Article 11, where the controller has reasonable doubts concerning the identity of the natural\nperson making the request referred to in Articles 15 to 21, the controller may request the provision of additional\ninformation necessary to confirm the identity of the data subject.\n7.\nThe information to be provided to data subjects pursuant to Articles 13 and 14 may be provided in combination\nwith standardised icons in order to give in an easily visible, intelligible and clearly legible manner a meaningful overview\nof the intended processing. Where the icons are presented electronically they shall be machine-readable.\n8.\nThe Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of\ndetermining the information to be presented by the icons and the procedures for providing standardised icons."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "2", "title": "Information and access to personal data"}, "article_number": 13, "article_title": "Information to be provided where personal data are collected from the data subject", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 2 – Information and access to personal data\nArticle 13 – Information to be provided where personal data are collected from the data subject\n\n1.\nWhere personal data relating to a data subject are collected from the data subject, the controller shall, at the time\nwhen personal data are obtained, provide the data subject with all of the following information:\n(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;\n(b) the contact details of the data protection officer, where applicable;\n(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;\n4.5.2016\nEN\n(d) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a\nthird party;\n(e) the recipients or categories of recipients of the personal data, if any;\n(f) where applicable, the fact that the controller intends to transfer personal data to a third country or international\norganisation and the existence or absence of an adequacy decision by the Commission, or in the case of transfers\nreferred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or suitable\nsafeguards and the means by which to obtain a copy of them or where they have been made available.\n2.\nIn addition to the information referred to in paragraph 1, the controller shall, at the time when personal data are\nobtained, provide the data subject with the following further information necessary to ensure fair and transparent\nprocessing:\n(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that\nperiod;\n(b) the existence of the right to request from the controller access to and rectification or erasure of personal data or\nrestriction of processing concerning the data subject or to object to processing as well as the right to data\nportability;\n(c) where the processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to\nwithdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;\n(d) the right to lodge a complaint with a supervisory authority;\n(e) whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter\ninto a contract, as well as whether the data subject is obliged to provide the personal data and of the possible\nconsequences of failure to provide such data;\n(f) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in\nthose cases, meaningful information about the logic involved, as well as the significance and the envisaged\nconsequences of such processing for the data subject.\n3.\nWhere the controller intends to further process the personal data for a purpose other than that for which the\npersonal data were collected, the controller shall provide the data subject prior to that further processing with\ninformation on that other purpose and with any relevant further information as referred to in paragraph 2.\n4.\nParagraphs 1, 2 and 3 shall not apply where and insofar as the data subject already has the information."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "2", "title": "Information and access to personal data"}, "article_number": 14, "article_title": "Information to be provided where personal data have not been obtained from the data subject", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 2 – Information and access to personal data\nArticle 14 – Information to be provided where personal data have not been obtained from the data subject\n\n1.\nWhere personal data have not been obtained from the data subject, the controller shall provide the data subject\nwith the following information:\n(a) the identity and the contact details of the controller and, where applicable, of the controller's representative;\n(b) the contact details of the data protection officer, where applicable;\n(c) the purposes of the processing for which the personal data are intended as well as the legal basis for the processing;\n(d) the categories of personal data concerned;\n(e) the recipients or categories of recipients of the personal data, if any;\n4.5.2016\nEN\n(f) where applicable, that the controller intends to transfer personal data to a recipient in a third country or internat­\nional organisation and the existence or absence of an adequacy decision by the Commission, or in the case of\ntransfers referred to in Article 46 or 47, or the second subparagraph of Article 49(1), reference to the appropriate or\nsuitable safeguards and the means to obtain a copy of them or where they have been made available.\n2.\nIn addition to the information referred to in paragraph 1, the controller shall provide the data subject with the\nfollowing information necessary to ensure fair and transparent processing in respect of the data subject:\n(a) the period for which the personal data will be stored, or if that is not possible, the criteria used to determine that\nperiod;\n(b) where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a\nthird party;\n(c) the existence of the right to request from the controller access to and rectification or erasure of personal data or\nrestriction of processing concerning the data subject and to object to processing as well as the right to data\nportability;\n(d) where processing is based on point (a) of Article 6(1) or point (a) of Article 9(2), the existence of the right to\nwithdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;\n(e) the right to lodge a complaint with a supervisory authority;\n(f) from which source the personal data originate, and if applicable, whether it came from publicly accessible sources;\n(g) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in\nthose cases, meaningful information about the logic involved, as well as the significance and the envisaged\nconsequences of such processing for the data subject.\n3.\nThe controller shall provide the information referred to in paragraphs 1 and 2:\n(a) within a reasonable period after obtaining the personal data, but at the latest within one month, having regard to\nthe specific circumstances in which the personal data are processed;\n(b) if the personal data are to be used for communication with the data subject, at the latest at the time of the first\ncommunication to that data subject; or\n(c) if a disclosure to another recipient is envisaged, at the latest when the personal data are first disclosed.\n4.\nWhere the controller intends to further process the personal data for a purpose other than that for which the\npersonal data were obtained, the controller shall provide the data subject prior to that further processing with\ninformation on that other purpose and with any relevant further information as referred to in paragraph 2.\n5.\nParagraphs 1 to 4 shall not apply where and insofar as:\n(a) the data subject already has the information;\n(b) the provision of such information proves impossible or would involve a disproportionate effort, in particular for\nprocessing for archiving purposes in the public interest, scientific or historical research purposes or statistical\npurposes, subject to the conditions and safeguards referred to in Article 89(1) or in so far as the obligation referred\nto in paragraph 1 of this Article is likely to render impossible or seriously impair the achievement of the objectives\nof that processing. In such cases the controller shall take appropriate measures to protect the data subject's rights\nand freedoms and legitimate interests, including making the information publicly available;\n(c) obtaining or disclosure is expressly laid down by Union or Member State law to which the controller is subject and\nwhich provides appropriate measures to protect the data subject's legitimate interests; or\n(d) where the personal data must remain confidential subject to an obligation of professional secrecy regulated by Union\nor Member State law, including a statutory obligation of secrecy.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "2", "title": "Information and access to personal data"}, "article_number": 15, "article_title": "Right of access by the data subject", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 2 – Information and access to personal data\nArticle 15 – Right of access by the data subject\n\n1.\nThe data subject shall have the right to obtain from the controller confirmation as to whether or not personal data\nconcerning him or her are being processed, and, where that is the case, access to the personal data and the following\ninformation:\n(a) the purposes of the processing;\n(b) the categories of personal data concerned;\n(c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular\nrecipients in third countries or international organisations;\n(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used\nto determine that period;\n(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of\nprocessing of personal data concerning the data subject or to object to such processing;\n(f) the right to lodge a complaint with a supervisory authority;\n(g) where the personal data are not collected from the data subject, any available information as to their source;\n(h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in\nthose cases, meaningful information about the logic involved, as well as the significance and the envisaged\nconsequences of such processing for the data subject.\n2.\nWhere personal data are transferred to a third country or to an international organisation, the data subject shall\nhave the right to be informed of the appropriate safeguards pursuant to Article 46 relating to the transfer.\n3.\nThe controller shall provide a copy of the personal data undergoing processing. For any further copies requested\nby the data subject, the controller may charge a reasonable fee based on administrative costs. Where the data subject\nmakes the request by electronic means, and unless otherwise requested by the data subject, the information shall be\nprovided in a commonly used electronic form.\n4.\nThe right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "3", "title": "Rectification and erasure"}, "article_number": 16, "article_title": "Right to rectification", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 3 – Rectification and erasure\nArticle 16 – Right to rectification\n\nThe data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate\npersonal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the\nright to have incomplete personal data completed, including by means of providing a supplementary statement."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "3", "title": "Rectification and erasure"}, "article_number": 17, "article_title": "Right to erasure (‘right to be forgotten’)", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 3 – Rectification and erasure\nArticle 17 – Right to erasure (‘right to be forgotten’)\n\n1.\nThe data subject shall have the right to obtain from the controller the erasure of personal data concerning him or\nher without undue delay and the controller shall have the obligation to erase personal data without undue delay where\none of the following grounds applies:\n(a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise\nprocessed;\n4.5.2016\nEN\n(b) the data subject withdraws consent on which the processing is based according to point (a) of Article 6(1), or\npoint (a) of Article 9(2), and where there is no other legal ground for the processing;\n(c) the data subject objects to the processing pursuant to Article 21(1) and there are no overriding legitimate grounds\nfor the processing, or the data subject objects to the processing pursuant to Article 21(2);\n(d) the personal data have been unlawfully processed;\n(e) the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which\nthe controller is subject;\n(f) the personal data have been collected in relation to the offer of information society services referred to in\nArticle 8(1).\n2.\nWhere the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the\npersonal data, the controller, taking account of available technology and the cost of implementation, shall take\nreasonable steps, including technical measures, to inform controllers which are processing the personal data that the\ndata subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.\n3.\nParagraphs 1 and 2 shall not apply to the extent that processing is necessary:\n(a) for exercising the right of freedom of expression and information;\n(b) for compliance with a legal obligation which requires processing by Union or Member State law to which the\ncontroller is subject or for the performance of a task carried out in the public interest or in the exercise of official\nauthority vested in the controller;\n(c) for reasons of public interest in the area of public health in accordance with points (h) and (i) of Article 9(2) as well\nas Article 9(3);\n(d) for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in\naccordance with Article 89(1) in so far as the right referred to in paragraph 1 is likely to render impossible or\nseriously impair the achievement of the objectives of that processing; or\n(e) for the establishment, exercise or defence of legal claims."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "3", "title": "Rectification and erasure"}, "article_number": 18, "article_title": "Right to restriction of processing", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 3 – Rectification and erasure\nArticle 18 – Right to restriction of processing\n\n1.\nThe data subject shall have the right to obtain from the controller restriction of processing where one of the\nfollowing applies:\n(a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the\naccuracy of the personal data;\n(b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction\nof their use instead;\n(c) the controller no longer needs the personal data for the purposes of the processing, but they are required by the\ndata subject for the establishment, exercise or defence of legal claims;\n(d) the data subject has objected to processing pursuant to Article 21(1) pending the verification whether the legitimate\ngrounds of the controller override those of the data subject.\n2.\nWhere processing has been restricted under paragraph 1, such personal data shall, with the exception of storage,\nonly be processed with the data subject's consent or for the establishment, exercise or defence of legal claims or for the\nprotection of the rights of another natural or legal person or for reasons of important public interest of the Union or of\na Member State.\n4.5.2016\nEN\n3.\nA data subject who has obtained restriction of processing pursuant to paragraph 1 shall be informed by the\ncontroller before the restriction of processing is lifted."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "3", "title": "Rectification and erasure"}, "article_number": 19, "article_title": "Notification obligation regarding rectification or erasure of personal data or restriction of", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 3 – Rectification and erasure\nArticle 19 – Notification obligation regarding rectification or erasure of personal data or restriction of\n\nprocessing\nThe controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in\naccordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been\ndisclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject\nabout those recipients if the data subject requests it."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "3", "title": "Rectification and erasure"}, "article_number": 20, "article_title": "Right to data portability", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 3 – Rectification and erasure\nArticle 20 – Right to data portability\n\n1.\nThe data subject shall have the right to receive the personal data concerning him or her, which he or she has\nprovided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit\nthose data to another controller without hindrance from the controller to which the personal data have been provided,\nwhere:\n(a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) or on a contract\npursuant to point (b) of Article 6(1); and\n(b) the processing is carried out by automated means.\n2.\nIn exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to\nhave the personal data transmitted directly from one controller to another, where technically feasible.\n3.\nThe exercise of the right referred to in paragraph 1 of this Article shall be without prejudice to Article 17. That\nright shall not apply to processing necessary for the performance of a task carried out in the public interest or in the\nexercise of official authority vested in the controller.\n4.\nThe right referred to in paragraph 1 shall not adversely affect the rights and freedoms of others."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "4", "title": "Right to object and automated individual decision-making"}, "article_number": 21, "article_title": "Right to object", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 4 – Right to object and automated individual decision-making\nArticle 21 – Right to object\n\n1.\nThe data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to\nprocessing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling\nbased on those provisions. The controller shall no longer process the personal data unless the controller demonstrates\ncompelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or\nfor the establishment, exercise or defence of legal claims.\n2.\nWhere personal data are processed for direct marketing purposes, the data subject shall have the right to object at\nany time to processing of personal data concerning him or her for such marketing, which includes profiling to the\nextent that it is related to such direct marketing.\n3.\nWhere the data subject objects to processing for direct marketing purposes, the personal data shall no longer be\nprocessed for such purposes.\n4.5.2016\nEN\n4.\nAt the latest at the time of the first communication with the data subject, the right referred to in paragraphs 1 and\n2 shall be explicitly brought to the attention of the data subject and shall be presented clearly and separately from any\nother information.\n5.\nIn the context of the use of information society services, and notwithstanding Directive 2002/58/EC, the data\nsubject may exercise his or her right to object by automated means using technical specifications.\n6.\nWhere personal data are processed for scientific or historical research purposes or statistical purposes pursuant to\nArticle 89(1), the data subject, on grounds relating to his or her particular situation, shall have the right to object to\nprocessing of personal data concerning him or her, unless the processing is necessary for the performance of a task\ncarried out for reasons of public interest."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "4", "title": "Right to object and automated individual decision-making"}, "article_number": 22, "article_title": "Automated individual decision-making, including profiling", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 4 – Right to object and automated individual decision-making\nArticle 22 – Automated individual decision-making, including profiling\n\n1.\nThe data subject shall have the right not to be subject to a decision based solely on automated processing,\nincluding profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.\n2.\nParagraph 1 shall not apply if the decision:\n(a) is necessary for entering into, or performance of, a contract between the data subject and a data controller;\n(b) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable\nmeasures to safeguard the data subject's rights and freedoms and legitimate interests; or\n(c) is based on the data subject's explicit consent.\n3.\nIn the cases referred to in points (a) and (c) of paragraph 2, the data controller shall implement suitable measures\nto safeguard the data subject's rights and freedoms and legitimate interests, at least the right to obtain human\nintervention on the part of the controller, to express his or her point of view and to contest the decision.\n4.\nDecisions referred to in paragraph 2 shall not be based on special categories of personal data referred to in\nArticle 9(1), unless point (a) or (g) of Article 9(2) applies and suitable measures to safeguard the data subject's rights and\nfreedoms and legitimate interests are in place."}
{"source": "GDPR", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": {"id": "5", "title": "Restrictions"}, "article_number": 23, "article_title": "Restrictions", "content": "Source: GDPR\nChapter III – Rights of the data subject\nSection 5 – Restrictions\nArticle 23 – Restrictions\n\n1.\nUnion or Member State law to which the data controller or processor is subject may restrict by way of a legislative\nmeasure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 in\nso far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a\nrestriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in\na democratic society to safeguard:\n(a) national security;\n(b) defence;\n(c) public security;\n4.5.2016\nEN\n(d) the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties,\nincluding the safeguarding against and the prevention of threats to public security;\n(e) other important objectives of general public interest of the Union or of a Member State, in particular an important\neconomic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a\nmatters, public health and social security;\n(f) the protection of judicial independence and judicial proceedings;\n(g) the prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;\n(h) a monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in\nthe cases referred to in points (a) to (e) and (g);\n(i) the protection of the data subject or the rights and freedoms of others;\n(j) the enforcement of civil law claims.\n2.\nIn particular, any legislative measure referred to in paragraph 1 shall contain specific provisions at least, where\nrelevant, as to:\n(a) the purposes of the processing or categories of processing;\n(b) the categories of personal data;\n(c) the scope of the restrictions introduced;\n(d) the safeguards to prevent abuse or unlawful access or transfer;\n(e) the specification of the controller or categories of controllers;\n(f) the storage periods and the applicable safeguards taking into account the nature, scope and purposes of the\nprocessing or categories of processing;\n(g) the risks to the rights and freedoms of data subjects; and\n(h) the right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the\nrestriction."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 24, "article_title": "Responsibility of the controller", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 24 – Responsibility of the controller\n\n1.\nTaking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood\nand severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and\norganisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this\nRegulation. Those measures shall be reviewed and updated where necessary.\n2.\nWhere proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the\nimplementation of appropriate data protection policies by the controller.\n3.\nAdherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as\nreferred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the\ncontroller.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 25, "article_title": "Data protection by design and by default", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 25 – Data protection by design and by default\n\n1.\nTaking into account the state of the art, the cost of implementation and the nature, scope, context and purposes of\nprocessing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the\nprocessing, the controller shall, both at the time of the determination of the means for processing and at the time of the\nprocessing itself, implement appropriate technical and organisational measures, such as pseudonymisation, which are\ndesigned to implement data-protection principles, such as data minimisation, in an effective manner and to integrate the\nnecessary safeguards into the processing in order to meet the requirements of this Regulation and protect the rights of\ndata subjects.\n2.\nThe controller shall implement appropriate technical and organisational measures for ensuring that, by default,\nonly personal data which are necessary for each specific purpose of the processing are processed. That obligation applies\nto the amount of personal data collected, the extent of their processing, the period of their storage and their accessibility.\nIn particular, such measures shall ensure that by default personal data are not made accessible without the individual's\nintervention to an indefinite number of natural persons.\n3.\nAn approved certification mechanism pursuant to Article 42 may be used as an element to demonstrate\ncompliance with the requirements set out in paragraphs 1 and 2 of this Article."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 26, "article_title": "Joint controllers", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 26 – Joint controllers\n\n1.\nWhere two or more controllers jointly determine the purposes and means of processing, they shall be joint\ncontrollers. They shall in a transparent manner determine their respective responsibilities for compliance with the\nobligations under this Regulation, in particular as regards the exercising of the rights of the data subject and their\nrespective duties to provide the information referred to in Articles 13 and 14, by means of an arrangement between\nthem unless, and in so far as, the respective responsibilities of the controllers are determined by Union or Member State\nlaw to which the controllers are subject. The arrangement may designate a contact point for data subjects.\n2.\nThe arrangement referred to in paragraph 1 shall duly reflect the respective roles and relationships of the joint\ncontrollers vis-à-vis the data subjects. The essence of the arrangement shall be made available to the data subject.\n3.\nIrrespective of the terms of the arrangement referred to in paragraph 1, the data subject may exercise his or her\nrights under this Regulation in respect of and against each of the controllers."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 27, "article_title": "Representatives of controllers or processors not established in the Union", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 27 – Representatives of controllers or processors not established in the Union\n\n1.\nWhere Article 3(2) applies, the controller or the processor shall designate in writing a representative in the Union.\n2.\nThe obligation laid down in paragraph 1 of this Article shall not apply to:\n(a) processing which is occasional, does not include, on a large scale, processing of special categories of data as referred\nto in Article 9(1) or processing of personal data relating to criminal convictions and offences referred to in Article\n10, and is unlikely to result in a risk to the rights and freedoms of natural persons, taking into account the nature,\ncontext, scope and purposes of the processing; or\n(b) a public authority or body.\n4.5.2016\nEN\n3.\nThe representative shall be established in one of the Member States where the data subjects, whose personal data\nare processed in relation to the offering of goods or services to them, or whose behaviour is monitored, are.\n4.\nThe representative shall be mandated by the controller or processor to be addressed in addition to or instead of\nthe controller or the processor by, in particular, supervisory authorities and data subjects, on all issues related to\nprocessing, for the purposes of ensuring compliance with this Regulation.\n5.\nThe designation of a representative by the controller or processor shall be without prejudice to legal actions which\ncould be initiated against the controller or the processor themselves."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 28, "article_title": "Processor", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 28 – Processor\n\n1.\nWhere processing is to be carried out on behalf of a controller, the controller shall use only processors providing\nsufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing\nwill meet the requirements of this Regulation and ensure the protection of the rights of the data subject.\n2.\nThe processor shall not engage another processor without prior specific or general written authorisation of the\ncontroller. In the case of general written authorisation, the processor shall inform the controller of any intended changes\nconcerning the addition or replacement of other processors, thereby giving the controller the opportunity to object to\nsuch changes.\n3.\nProcessing by a processor shall be governed by a contract or other legal act under Union or Member State law,\nthat is binding on the processor with regard to the controller and that sets out the subject-matter and duration of the\nprocessing, the nature and purpose of the processing, the type of personal data and categories of data subjects and the\nobligations and rights of the controller. That contract or other legal act shall stipulate, in particular, that the processor:\n(a) processes the personal data only on documented instructions from the controller, including with regard to transfers\nof personal data to a third country or an international organisation, unless required to do so by Union or\nMember State law to which the processor is subject; in such a case, the processor shall inform the controller of that\nlegal requirement before processing, unless that law prohibits such information on important grounds of public\ninterest;\n(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are\nunder an appropriate statutory obligation of confidentiality;\n(c) takes all measures required pursuant to Article 32;\n(d) respects the conditions referred to in paragraphs 2 and 4 for engaging another processor;\n(e) taking into account the nature of the processing, assists the controller by appropriate technical and organisational\nmeasures, insofar as this is possible, for the fulfilment of the controller's obligation to respond to requests for\nexercising the data subject's rights laid down in Chapter III;\n(f) assists the controller in ensuring compliance with the obligations pursuant to Articles 32 to 36 taking into account\nthe nature of processing and the information available to the processor;\n(g) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision\nof services relating to processing, and deletes existing copies unless Union or Member State law requires storage of\nthe personal data;\n(h) makes available to the controller all information necessary to demonstrate compliance with the obligations laid\ndown in this Article and allow for and contribute to audits, including inspections, conducted by the controller or\nanother auditor mandated by the controller.\n4.5.2016\nEN\nWith regard to point (h) of the first subparagraph, the processor shall immediately inform the controller if, in its\nopinion, an instruction infringes this Regulation or other Union or Member State data protection provisions.\n4.\nWhere a processor engages another processor for carrying out specific processing activities on behalf of the\ncontroller, the same data protection obligations as set out in the contract or other legal act between the controller and\nthe processor as referred to in paragraph 3 shall be imposed on that other processor by way of a contract or other legal\nact under Union or Member State law, in particular providing sufficient guarantees to implement appropriate technical\nand organisational measures in such a manner that the processing will meet the requirements of this Regulation. Where\nthat other processor fails to fulfil its data protection obligations, the initial processor shall remain fully liable to the\ncontroller for the performance of that other processor's obligations.\n5.\nAdherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification\nmechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as\nreferred to in paragraphs 1 and 4 of this Article.\n6.\nWithout prejudice to an individual contract between the controller and the processor, the contract or the other\nlegal act referred to in paragraphs 3 and 4 of this Article may be based, in whole or in part, on standard contractual\nclauses referred to in paragraphs 7 and 8 of this Article, including when they are part of a certification granted to the\ncontroller or processor pursuant to Articles 42 and 43.\n7.\nThe Commission may lay down standard contractual clauses for the matters referred to in paragraph 3 and 4 of\nthis Article and in accordance with the examination procedure referred to in Article 93(2).\n8.\nA supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4\nof this Article and in accordance with the consistency mechanism referred to in Article 63.\n9.\nThe contract or the other legal act referred to in paragraphs 3 and 4 shall be in writing, including in electronic\nform.\n10.\nWithout prejudice to Articles 82, 83 and 84, if a processor infringes this Regulation by determining the purposes\nand means of processing, the processor shall be considered to be a controller in respect of that processing."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 29, "article_title": "Processing under the authority of the controller or processor", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 29 – Processing under the authority of the controller or processor\n\nThe processor and any person acting under the authority of the controller or of the processor, who has access to\npersonal data, shall not process those data except on instructions from the controller, unless required to do so by Union\nor Member State law."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 30, "article_title": "Records of processing activities", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 30 – Records of processing activities\n\n1.\nEach controller and, where applicable, the controller's representative, shall maintain a record of processing\nactivities under its responsibility. That record shall contain all of the following information:\n(a) the name and contact details of the controller and, where applicable, the joint controller, the controller's representa­\ntive and the data protection officer;\n(b) the purposes of the processing;\n(c) a description of the categories of data subjects and of the categories of personal data;\n4.5.2016\nEN\n(d) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third\ncountries or international organisations;\n(e) where applicable, transfers of personal data to a third country or an international organisation, including the identifi­\ncation of that third country or international organisation and, in the case of transfers referred to in the second\nsubparagraph of Article 49(1), the documentation of suitable safeguards;\n(f) where possible, the envisaged time limits for erasure of the different categories of data;\n(g) where possible, a general description of the technical and organisational security measures referred to in\nArticle 32(1).\n2.\nEach processor and, where applicable, the processor's representative shall maintain a record of all categories of\nprocessing activities carried out on behalf of a controller, containing:\n(a) the name and contact details of the processor or processors and of each controller on behalf of which the processor\nis acting, and, where applicable, of the controller's or the processor's representative, and the data protection officer;\n(b) the categories of processing carried out on behalf of each controller;\n(c) where applicable, transfers of personal data to a third country or an international organisation, including the identifi­\ncation of that third country or international organisation and, in the case of transfers referred to in the second\nsubparagraph of Article 49(1), the documentation of suitable safeguards;\n(d) where possible, a general description of the technical and organisational security measures referred to in\nArticle 32(1).\n3.\nThe records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.\n4.\nThe controller or the processor and, where applicable, the controller's or the processor's representative, shall make\nthe record available to the supervisory authority on request.\n5.\nThe obligations referred to in paragraphs 1 and 2 shall not apply to an enterprise or an organisation employing\nfewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of\ndata subjects, the processing is not occasional, or the processing includes special categories of data as referred to in\nArticle 9(1) or personal data relating to criminal convictions and offences referred to in Article 10."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 31, "article_title": "Cooperation with the supervisory authority", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 31 – Cooperation with the supervisory authority\n\nThe controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the\nsupervisory authority in the performance of its tasks."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "2", "title": "Security of personal data"}, "article_number": 32, "article_title": "Security of processing", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 2 – Security of personal data\nArticle 32 – Security of processing\n\n1.\nTaking into account the state of the art, the costs of implementation and the nature, scope, context and purposes\nof processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, the\ncontroller and the processor shall implement appropriate technical and organisational measures to ensure a level of\nsecurity appropriate to the risk, including inter alia as appropriate:\n(a) the pseudonymisation and encryption of personal data;\n4.5.2016\nEN\n(b) the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and\nservices;\n(c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or\ntechnical incident;\n(d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for\nensuring the security of the processing.\n2.\nIn assessing the appropriate level of security account shall be taken in particular of the risks that are presented by\nprocessing, in particular from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to\npersonal data transmitted, stored or otherwise processed.\n3.\nAdherence to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as\nreferred to in Article 42 may be used as an element by which to demonstrate compliance with the requirements set out\nin paragraph 1 of this Article.\n4.\nThe controller and processor shall take steps to ensure that any natural person acting under the authority of the\ncontroller or the processor who has access to personal data does not process them except on instructions from the\ncontroller, unless he or she is required to do so by Union or Member State law."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "2", "title": "Security of personal data"}, "article_number": 33, "article_title": "Notification of a personal data breach to the supervisory authority", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 2 – Security of personal data\nArticle 33 – Notification of a personal data breach to the supervisory authority\n\n1.\nIn the case of a personal data breach, the controller shall without undue delay and, where feasible, not later than\n72 hours after having become aware of it, notify the personal data breach to the supervisory authority competent in\naccordance with Article 55, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of\nnatural persons. Where the notification to the supervisory authority is not made within 72 hours, it shall be\naccompanied by reasons for the delay.\n2.\nThe processor shall notify the controller without undue delay after becoming aware of a personal data breach.\n3.\nThe notification referred to in paragraph 1 shall at least:\n(a) describe the nature of the personal data breach including where possible, the categories and approximate number of\ndata subjects concerned and the categories and approximate number of personal data records concerned;\n(b) communicate the name and contact details of the data protection officer or other contact point where more\ninformation can be obtained;\n(c) describe the likely consequences of the personal data breach;\n(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach,\nincluding, where appropriate, measures to mitigate its possible adverse effects.\n4.\nWhere, and in so far as, it is not possible to provide the information at the same time, the information may be\nprovided in phases without undue further delay.\n5.\nThe controller shall document any personal data breaches, comprising the facts relating to the personal data\nbreach, its effects and the remedial action taken. That documentation shall enable the supervisory authority to verify\ncompliance with this Article."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "2", "title": "Security of personal data"}, "article_number": 34, "article_title": "Communication of a personal data breach to the data subject", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 2 – Security of personal data\nArticle 34 – Communication of a personal data breach to the data subject\n\n1.\nWhen the personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the\ncontroller shall communicate the personal data breach to the data subject without undue delay.\n4.5.2016\nEN\n2.\nThe communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain\nlanguage the nature of the personal data breach and contain at least the information and measures referred to in\npoints (b), (c) and (d) of Article 33(3).\n3.\nThe communication to the data subject referred to in paragraph 1 shall not be required if any of the following\nconditions are met:\n(a) the controller has implemented appropriate technical and organisational protection measures, and those measures\nwere applied to the personal data affected by the personal data breach, in particular those that render the personal\ndata unintelligible to any person who is not authorised to access it, such as encryption;\n(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data\nsubjects referred to in paragraph 1 is no longer likely to materialise;\n(c) it would involve disproportionate effort. In such a case, there shall instead be a public communication or similar\nmeasure whereby the data subjects are informed in an equally effective manner.\n4.\nIf the controller has not already communicated the personal data breach to the data subject, the supervisory\nauthority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so\nor may decide that any of the conditions referred to in paragraph 3 are met."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "3", "title": "Data protection impact assessment and prior consultation"}, "article_number": 35, "article_title": "Data protection impact assessment", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 3 – Data protection impact assessment and prior consultation\nArticle 35 – Data protection impact assessment\n\n1.\nWhere a type of processing in particular using new technologies, and taking into account the nature, scope,\ncontext and purposes of the processing, is likely to result in a high risk to the rights and freedoms of natural persons,\nthe controller shall, prior to the processing, carry out an assessment of the impact of the envisaged processing\noperations on the protection of personal data. A single assessment may address a set of similar processing operations\nthat present similar high risks.\n2.\nThe controller shall seek the advice of the data protection officer, where designated, when carrying out a data\nprotection impact assessment.\n3.\nA data protection impact assessment referred to in paragraph 1 shall in particular be required in the case of:\n(a) a systematic and extensive evaluation of personal aspects relating to natural persons which is based on automated\nprocessing, including profiling, and on which decisions are based that produce legal effects concerning the natural\nperson or similarly significantly affect the natural person;\n(b) processing on a large scale of special categories of data referred to in Article 9(1), or of personal data relating to\ncriminal convictions and offences referred to in Article 10; or\n(c) a systematic monitoring of a publicly accessible area on a large scale.\n4.\nThe supervisory authority shall establish and make public a list of the kind of processing operations which are\nsubject to the requirement for a data protection impact assessment pursuant to paragraph 1. The supervisory authority\nshall communicate those lists to the Board referred to in Article 68.\n5.\nThe supervisory authority may also establish and make public a list of the kind of processing operations for which\nno data protection impact assessment is required. The supervisory authority shall communicate those lists to the Board.\n6.\nPrior to the adoption of the lists referred to in paragraphs 4 and 5, the competent supervisory authority shall\napply the consistency mechanism referred to in Article 63 where such lists involve processing activities which are\nrelated to the offering of goods or services to data subjects or to the monitoring of their behaviour in several\nMember States, or may substantially affect the free movement of personal data within the Union.\n4.5.2016\nEN\n7.\nThe assessment shall contain at least:\n(a) a systematic description of the envisaged processing operations and the purposes of the processing, including, where\napplicable, the legitimate interest pursued by the controller;\n(b) an assessment of the necessity and proportionality of the processing operations in relation to the purposes;\n(c) an assessment of the risks to the rights and freedoms of data subjects referred to in paragraph 1; and\n(d) the measures envisaged to address the risks, including safeguards, security measures and mechanisms to ensure the\nprotection of personal data and to demonstrate compliance with this Regulation taking into account the rights and\nlegitimate interests of data subjects and other persons concerned.\n8.\nCompliance with approved codes of conduct referred to in Article 40 by the relevant controllers or processors\nshall be taken into due account in assessing the impact of the processing operations performed by such controllers or\nprocessors, in particular for the purposes of a data protection impact assessment.\n9.\nWhere appropriate, the controller shall seek the views of data subjects or their representatives on the intended\nprocessing, without prejudice to the protection of commercial or public interests or the security of processing\noperations.\n10.\nWhere processing pursuant to point (c) or (e) of Article 6(1) has a legal basis in Union law or in the law of the\nMember State to which the controller is subject, that law regulates the specific processing operation or set of operations\nin question, and a data protection impact assessment has already been carried out as part of a general impact assessment\nin the context of the adoption of that legal basis, paragraphs 1 to 7 shall not apply unless Member States deem it to be\nnecessary to carry out such an assessment prior to processing activities.\n11.\nWhere necessary, the controller shall carry out a review to assess if processing is performed in accordance with\nthe data protection impact assessment at least when there is a change of the risk represented by processing operations."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "3", "title": "Data protection impact assessment and prior consultation"}, "article_number": 36, "article_title": "Prior consultation", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 3 – Data protection impact assessment and prior consultation\nArticle 36 – Prior consultation\n\n1.\nThe controller shall consult the supervisory authority prior to processing where a data protection impact\nassessment under Article 35 indicates that the processing would result in a high risk in the absence of measures taken\nby the controller to mitigate the risk.\n2.\nWhere the supervisory authority is of the opinion that the intended processing referred to in paragraph 1 would\ninfringe this Regulation, in particular where the controller has insufficiently identified or mitigated the risk, the\nsupervisory authority shall, within period of up to eight weeks of receipt of the request for consultation, provide written\nadvice to the controller and, where applicable to the processor, and may use any of its powers referred to in Article 58.\nThat period may be extended by six weeks, taking into account the complexity of the intended processing. The\nsupervisory authority shall inform the controller and, where applicable, the processor, of any such extension within one\nmonth of receipt of the request for consultation together with the reasons for the delay. Those periods may be\nsuspended until the supervisory authority has obtained information it has requested for the purposes of the\nconsultation.\n3.\nWhen consulting the supervisory authority pursuant to paragraph 1, the controller shall provide the supervisory\nauthority with:\n(a) where applicable, the respective responsibilities of the controller, joint controllers and processors involved in the\nprocessing, in particular for processing within a group of undertakings;\n(b) the purposes and means of the intended processing;\n(c) the measures and safeguards provided to protect the rights and freedoms of data subjects pursuant to this\nRegulation;\n(d) where applicable, the contact details of the data protection officer;\n4.5.2016\nEN\n(e) the data protection impact assessment provided for in Article 35; and\n(f) any other information requested by the supervisory authority.\n4.\nMember States shall consult the supervisory authority during the preparation of a proposal for a legislative\nmeasure to be adopted by a national parliament, or of a regulatory measure based on such a legislative measure, which\nrelates to processing.\n5.\nNotwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior author­\nisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out\nby the controller in the public interest, including processing in relation to social protection and public health."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "4", "title": "Data protection off icer"}, "article_number": 37, "article_title": "Designation of the data protection officer", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 4 – Data protection off icer\nArticle 37 – Designation of the data protection officer\n\n1.\nThe controller and the processor shall designate a data protection officer in any case where:\n(a) the processing is carried out by a public authority or body, except for courts acting in their judicial capacity;\n(b) the core activities of the controller or the processor consist of processing operations which, by virtue of their\nnature, their scope and/or their purposes, require regular and systematic monitoring of data subjects on a large scale;\nor\n(c) the core activities of the controller or the processor consist of processing on a large scale of special categories of\ndata pursuant to Article 9 and personal data relating to criminal convictions and offences referred to in Article 10.\n2.\nA group of undertakings may appoint a single data protection officer provided that a data protection officer is\neasily accessible from each establishment.\n3.\nWhere the controller or the processor is a public authority or body, a single data protection officer may be\ndesignated for several such authorities or bodies, taking account of their organisational structure and size.\n4.\nIn cases other than those referred to in paragraph 1, the controller or processor or associations and other bodies\nrepresenting categories of controllers or processors may or, where required by Union or Member State law shall,\ndesignate a data protection officer. The data protection officer may act for such associations and other bodies\nrepresenting controllers or processors.\n5.\nThe data protection officer shall be designated on the basis of professional qualities and, in particular, expert\nknowledge of data protection law and practices and the ability to fulfil the tasks referred to in Article 39.\n6.\nThe data protection officer may be a staff member of the controller or processor, or fulfil the tasks on the basis of\na service contract.\n7.\nThe controller or the processor shall publish the contact details of the data protection officer and communicate\nthem to the supervisory authority."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "4", "title": "Data protection off icer"}, "article_number": 38, "article_title": "Position of the data protection officer", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 4 – Data protection off icer\nArticle 38 – Position of the data protection officer\n\n1.\nThe controller and the processor shall ensure that the data protection officer is involved, properly and in a timely\nmanner, in all issues which relate to the protection of personal data.\n4.5.2016\nEN\n2.\nThe controller and processor shall support the data protection officer in performing the tasks referred to in\nArticle 39 by providing resources necessary to carry out those tasks and access to personal data and processing\noperations, and to maintain his or her expert knowledge.\n3.\nThe controller and processor shall ensure that the data protection officer does not receive any instructions\nregarding the exercise of those tasks. He or she shall not be dismissed or penalised by the controller or the processor for\nperforming his tasks. The data protection officer shall directly report to the highest management level of the controller\nor the processor.\n4.\nData subjects may contact the data protection officer with regard to all issues related to processing of their\npersonal data and to the exercise of their rights under this Regulation.\n5.\nThe data protection officer shall be bound by secrecy or confidentiality concerning the performance of his or her\ntasks, in accordance with Union or Member State law.\n6.\nThe data protection officer may fulfil other tasks and duties. The controller or processor shall ensure that any such\ntasks and duties do not result in a conflict of interests."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "4", "title": "Data protection off icer"}, "article_number": 39, "article_title": "Tasks of the data protection officer", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 4 – Data protection off icer\nArticle 39 – Tasks of the data protection officer\n\n1.\nThe data protection officer shall have at least the following tasks:\n(a) to inform and advise the controller or the processor and the employees who carry out processing of their\nobligations pursuant to this Regulation and to other Union or Member State data protection provisions;\n(b) to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with\nthe policies of the controller or processor in relation to the protection of personal data, including the assignment of\nresponsibilities, awareness-raising and training of staff involved in processing operations, and the related audits;\n(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance\npursuant to Article 35;\n(d) to cooperate with the supervisory authority;\n(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior\nconsultation referred to in Article 36, and to consult, where appropriate, with regard to any other matter.\n2.\nThe data protection officer shall in the performance of his or her tasks have due regard to the risk associated with\nprocessing operations, taking into account the nature, scope, context and purposes of processing."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "5", "title": "Codes of conduct and certification"}, "article_number": 40, "article_title": "Codes of conduct", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 5 – Codes of conduct and certification\nArticle 40 – Codes of conduct\n\n1.\nThe Member States, the supervisory authorities, the Board and the Commission shall encourage the drawing up of\ncodes of conduct intended to contribute to the proper application of this Regulation, taking account of the specific\nfeatures of the various processing sectors and the specific needs of micro, small and medium-sized enterprises.\n2.\nAssociations and other bodies representing categories of controllers or processors may prepare codes of conduct,\nor amend or extend such codes, for the purpose of specifying the application of this Regulation, such as with regard to:\n(a) fair and transparent processing;\n4.5.2016\nEN\n(b) the legitimate interests pursued by controllers in specific contexts;\n(c) the collection of personal data;\n(d) the pseudonymisation of personal data;\n(e) the information provided to the public and to data subjects;\n(f) the exercise of the rights of data subjects;\n(g) the information provided to, and the protection of, children, and the manner in which the consent of the holders of\nparental responsibility over children is to be obtained;\n(h) the measures and procedures referred to in Articles 24 and 25 and the measures to ensure security of processing\nreferred to in Article 32;\n(i) the notification of personal data breaches to supervisory authorities and the communication of such personal data\nbreaches to data subjects;\n(j) the transfer of personal data to third countries or international organisations; or\n(k) out-of-court proceedings and other dispute resolution procedures for resolving disputes between controllers and data\nsubjects with regard to processing, without prejudice to the rights of data subjects pursuant to Articles 77 and 79.\n3.\nIn addition to adherence by controllers or processors subject to this Regulation, codes of conduct approved\npursuant to paragraph 5 of this Article and having general validity pursuant to paragraph 9 of this Article may also be\nadhered to by controllers or processors that are not subject to this Regulation pursuant to Article 3 in order to provide\nappropriate safeguards within the framework of personal data transfers to third countries or international organisations\nunder the terms referred to in point (e) of Article 46(2). Such controllers or processors shall make binding and\nenforceable commitments, via contractual or other legally binding instruments, to apply those appropriate safeguards\nincluding with regard to the rights of data subjects.\n4.\nA code of conduct referred to in paragraph 2 of this Article shall contain mechanisms which enable the body\nreferred to in Article 41(1) to carry out the mandatory monitoring of compliance with its provisions by the controllers\nor processors which undertake to apply it, without prejudice to the tasks and powers of supervisory authorities\ncompetent pursuant to Article 55 or 56.\n5.\nAssociations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct\nor to amend or extend an existing code shall submit the draft code, amendment or extension to the supervisory\nauthority which is competent pursuant to Article 55. The supervisory authority shall provide an opinion on whether the\ndraft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or\nextension if it finds that it provides sufficient appropriate safeguards.\n6.\nWhere the draft code, or amendment or extension is approved in accordance with paragraph 5, and where the\ncode of conduct concerned does not relate to processing activities in several Member States, the supervisory authority\nshall register and publish the code.\n7.\nWhere a draft code of conduct relates to processing activities in several Member States, the supervisory authority\nwhich is competent pursuant to Article 55 shall, before approving the draft code, amendment or extension, submit it in\nthe procedure referred to in Article 63 to the Board which shall provide an opinion on whether the draft code,\namendment or extension complies with this Regulation or, in the situation referred to in paragraph 3 of this Article,\nprovides appropriate safeguards.\n8.\nWhere the opinion referred to in paragraph 7 confirms that the draft code, amendment or extension complies\nwith this Regulation, or, in the situation referred to in paragraph 3, provides appropriate safeguards, the Board shall\nsubmit its opinion to the Commission.\n9.\nThe Commission may, by way of implementing acts, decide that the approved code of conduct, amendment or\nextension submitted to it pursuant to paragraph 8 of this Article have general validity within the Union. Those\nimplementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2).\n4.5.2016\nEN\n10.\nThe Commission shall ensure appropriate publicity for the approved codes which have been decided as having\ngeneral validity in accordance with paragraph 9.\n11.\nThe Board shall collate all approved codes of conduct, amendments and extensions in a register and shall make\nthem publicly available by way of appropriate means."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "5", "title": "Codes of conduct and certification"}, "article_number": 41, "article_title": "Monitoring of approved codes of conduct", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 5 – Codes of conduct and certification\nArticle 41 – Monitoring of approved codes of conduct\n\n1.\nWithout prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the\nmonitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an\nappropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the\ncompetent supervisory authority.\n2.\nA body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that\nbody has:\n(a) demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the\ncompetent supervisory authority;\n(b) established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the\ncode, to monitor their compliance with its provisions and to periodically review its operation;\n(c) established procedures and structures to handle complaints about infringements of the code or the manner in which\nthe code has been, or is being, implemented by a controller or processor, and to make those procedures and\nstructures transparent to data subjects and the public; and\n(d) demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a\nconflict of interests.\n3.\nThe competent supervisory authority shall submit the draft criteria for accreditation of a body as referred to in\nparagraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.\n4.\nWithout prejudice to the tasks and powers of the competent supervisory authority and the provisions of\nChapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take\nappropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion\nof the controller or processor concerned from the code. It shall inform the competent supervisory authority of such\nactions and the reasons for taking them.\n5.\nThe competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the\nconditions for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.\n6.\nThis Article shall not apply to processing carried out by public authorities and bodies."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "5", "title": "Codes of conduct and certification"}, "article_number": 42, "article_title": "Certification", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 5 – Codes of conduct and certification\nArticle 42 – Certification\n\n1.\nThe Member States, the supervisory authorities, the Board and the Commission shall encourage, in particular at\nUnion level, the establishment of data protection certification mechanisms and of data protection seals and marks, for\nthe purpose of demonstrating compliance with this Regulation of processing operations by controllers and processors.\nThe specific needs of micro, small and medium-sized enterprises shall be taken into account.\n4.5.2016\nEN\n2.\nIn addition to adherence by controllers or processors subject to this Regulation, data protection certification\nmechanisms, seals or marks approved pursuant to paragraph 5 of this Article may be established for the purpose of\ndemonstrating the existence of appropriate safeguards provided by controllers or processors that are not subject to this\nRegulation pursuant to Article 3 within the framework of personal data transfers to third countries or international\norganisations under the terms referred to in point (f) of Article 46(2). Such controllers or processors shall make binding\nand enforceable commitments, via contractual or other legally binding instruments, to apply those appropriate\nsafeguards, including with regard to the rights of data subjects.\n3.\nThe certification shall be voluntary and available via a process that is transparent.\n4.\nA certification pursuant to this Article does not reduce the responsibility of the controller or the processor for\ncompliance with this Regulation and is without prejudice to the tasks and powers of the supervisory authorities which\nare competent pursuant to Article 55 or 56.\n5.\nA certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the\ncompetent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to\nArticle 58(3) or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a\ncommon certification, the European Data Protection Seal.\n6.\nThe controller or processor which submits its processing to the certification mechanism shall provide the certifi­\ncation body referred to in Article 43, or where applicable, the competent supervisory authority, with all information\nand access to its processing activities which are necessary to conduct the certification procedure.\n7.\nCertification shall be issued to a controller or processor for a maximum period of three years and may be\nrenewed, under the same conditions, provided that the relevant requirements continue to be met. Certification shall be\nwithdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority\nwhere the requirements for the certification are not or are no longer met.\n8.\nThe Board shall collate all certification mechanisms and data protection seals and marks in a register and shall\nmake them publicly available by any appropriate means."}
{"source": "GDPR", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "5", "title": "Codes of conduct and certification"}, "article_number": 43, "article_title": "Certification bodies", "content": "Source: GDPR\nChapter IV – Controller and processor\nSection 5 – Codes of conduct and certification\nArticle 43 – Certification bodies\n\n1.\nWithout prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58,\ncertification bodies which have an appropriate level of expertise in relation to data protection shall, after informing the\nsupervisory authority in order to allow it to exercise its powers pursuant to point (h) of Article 58(2) where necessary,\nissue and renew certification. Member States shall ensure that those certification bodies are accredited by one or both of\nthe following:\n(a) the supervisory authority which is competent pursuant to Article 55 or 56;\n(b) the national accreditation body named in accordance with Regulation (EC) No 765/2008 of the European Parliament\nand of the Council (1) in accordance with EN-ISO/IEC 17065/2012 and with the additional requirements established\nby the supervisory authority which is competent pursuant to Article 55 or 56.\n2.\nCertification bodies referred to in paragraph 1 shall be accredited in accordance with that paragraph only where\nthey have:\n(a) demonstrated their independence and expertise in relation to the subject-matter of the certification to the\nsatisfaction of the competent supervisory authority;\n4.5.2016\nEN\n(1) Regulation (EC) No 765/2008 of the European Parliament and of the Council of 9 July 2008 setting out the requirements for accredi­\ntation and market surveillance relating to the marketing of products and repealing Regulation (EEC) No 339/93 (OJ L 218, 13.8.2008,\np. 30).\n(b) undertaken to respect the criteria referred to in Article 42(5) and approved by the supervisory authority which is\ncompetent pursuant to Article 55 or 56 or by the Board pursuant to Article 63;\n(c) established procedures for the issuing, periodic review and withdrawal of data protection certification, seals and\nmarks;\n(d) established procedures and structures to handle complaints about infringements of the certification or the manner in\nwhich the certification has been, or is being, implemented by the controller or processor, and to make those\nprocedures and structures transparent to data subjects and the public; and\n(e) demonstrated, to the satisfaction of the competent supervisory authority, that their tasks and duties do not result in\na conflict of interests.\n3.\nThe accreditation of certification bodies as referred to in paragraphs 1 and 2 of this Article shall take place on the\nbasis of criteria approved by the supervisory authority which is competent pursuant to Article 55 or 56 or by the Board\npursuant to Article 63. In the case of accreditation pursuant to point (b) of paragraph 1 of this Article, those\nrequirements shall complement those envisaged in Regulation (EC) No 765/2008 and the technical rules that describe\nthe methods and procedures of the certification bodies.\n4.\nThe certification bodies referred to in paragraph 1 shall be responsible for the proper assessment leading to the\ncertification or the withdrawal of such certification without prejudice to the responsibility of the controller or processor\nfor compliance with this Regulation. The accreditation shall be issued for a maximum period of five years and may be\nrenewed on the same conditions provided that the certification body meets the requirements set out in this Article.\n5.\nThe certification bodies referred to in paragraph 1 shall provide the competent supervisory authorities with the\nreasons for granting or withdrawing the requested certification.\n6.\nThe requirements referred to in paragraph 3 of this Article and the criteria referred to in Article 42(5) shall be\nmade public by the supervisory authority in an easily accessible form. The supervisory authorities shall also transmit\nthose requirements and criteria to the Board. The Board shall collate all certification mechanisms and data protection\nseals in a register and shall make them publicly available by any appropriate means.\n7.\nWithout prejudice to Chapter VIII, the competent supervisory authority or the national accreditation body shall\nrevoke an accreditation of a certification body pursuant to paragraph 1 of this Article where the conditions for the\naccreditation are not, or are no longer, met or where actions taken by a certification body infringe this Regulation.\n8.\nThe Commission shall be empowered to adopt delegated acts in accordance with Article 92 for the purpose of\nspecifying the requirements to be taken into account for the data protection certification mechanisms referred to in\nArticle 42(1).\n9.\nThe Commission may adopt implementing acts laying down technical standards for certification mechanisms and\ndata protection seals and marks, and mechanisms to promote and recognise those certification mechanisms, seals and\nmarks. Those implementing acts shall be adopted in accordance with the examination procedure referred to in\nArticle 93(2)."}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 44, "article_title": "General principle for transfers", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 44 – General principle for transfers\n\nAny transfer of personal data which are undergoing processing or are intended for processing after transfer to a third\ncountry or to an international organisation shall take place only if, subject to the other provisions of this Regulation, the\nconditions laid down in this Chapter are complied with by the controller and processor, including for onward transfers\nof personal data from the third country or an international organisation to another third country or to another internat­\nional organisation. All provisions in this Chapter shall be applied in order to ensure that the level of protection of\nnatural persons guaranteed by this Regulation is not undermined.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 45, "article_title": "Transfers on the basis of an adequacy decision", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 45 – Transfers on the basis of an adequacy decision\n\n1.\nA transfer of personal data to a third country or an international organisation may take place where the\nCommission has decided that the third country, a territory or one or more specified sectors within that third country, or\nthe international organisation in question ensures an adequate level of protection. Such a transfer shall not require any\nspecific authorisation.\n2.\nWhen assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the\nfollowing elements:\n(a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral,\nincluding concerning public security, defence, national security and criminal law and the access of public authorities\nto personal data, as well as the implementation of such legislation, data protection rules, professional rules and\nsecurity measures, including rules for the onward transfer of personal data to another third country or international\norganisation which are complied with in that country or international organisation, case-law, as well as effective and\nenforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal\ndata are being transferred;\n(b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to\nwhich an international organisation is subject, with responsibility for ensuring and enforcing compliance with the\ndata protection rules, including adequate enforcement powers, for assisting and advising the data subjects in\nexercising their rights and for cooperation with the supervisory authorities of the Member States; and\n(c) the international commitments the third country or international organisation concerned has entered into, or other\nobligations arising from legally binding conventions or instruments as well as from its participation in multilateral\nor regional systems, in particular in relation to the protection of personal data.\n3.\nThe Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing\nact, that a third country, a territory or one or more specified sectors within a third country, or an international\norganisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The\nimplementing act shall provide for a mechanism for a periodic review, at least every four years, which shall take into\naccount all relevant developments in the third country or international organisation. The implementing act shall specify\nits territorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to\nin point (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination\nprocedure referred to in Article 93(2).\n4.\nThe Commission shall, on an ongoing basis, monitor developments in third countries and international organ­\nisations that could affect the functioning of decisions adopted pursuant to paragraph 3 of this Article and decisions\nadopted on the basis of Article 25(6) of Directive 95/46/EC.\n5.\nThe Commission shall, where available information reveals, in particular following the review referred to in\nparagraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or\nan international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of\nthis Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by\nmeans of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with\nthe examination procedure referred to in Article 93(2).\nOn duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts\nin accordance with the procedure referred to in Article 93(3).\n6.\nThe Commission shall enter into consultations with the third country or international organisation with a view to\nremedying the situation giving rise to the decision made pursuant to paragraph 5.\n7.\nA decision pursuant to paragraph 5 of this Article is without prejudice to transfers of personal data to the third\ncountry, a territory or one or more specified sectors within that third country, or the international organisation in\nquestion pursuant to Articles 46 to 49.\n8.\ncountries, territories and specified sectors within a third country and international organisations for which it has decided\nthat an adequate level of protection is or is no longer ensured.\n4.5.2016\nEN\n9.\nDecisions adopted by the Commission on the basis of Article 25(6) of Directive 95/46/EC shall remain in force\nuntil amended, replaced or repealed by a Commission Decision adopted in accordance with paragraph 3 or 5 of this\nArticle."}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 46, "article_title": "Transfers subject to appropriate safeguards", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 46 – Transfers subject to appropriate safeguards\n\n1.\nIn the absence of a decision pursuant to Article 45(3), a controller or processor may transfer personal data to a\nthird country or an international organisation only if the controller or processor has provided appropriate safeguards,\nand on condition that enforceable data subject rights and effective legal remedies for data subjects are available.\n2.\nThe appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authoris­\nation from a supervisory authority, by:\n(a) a legally binding and enforceable instrument between public authorities or bodies;\n(b) binding corporate rules in accordance with Article 47;\n(c) standard data protection clauses adopted by the Commission in accordance with the examination procedure referred\nto in Article 93(2);\n(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to\nthe examination procedure referred to in Article 93(2);\n(e) an approved code of conduct pursuant to Article 40 together with binding and enforceable commitments of the\ncontroller or processor in the third country to apply the appropriate safeguards, including as regards data subjects'\nrights; or\n(f) an approved certification mechanism pursuant to Article 42 together with binding and enforceable commitments of\nthe controller or processor in the third country to apply the appropriate safeguards, including as regards data\nsubjects' rights.\n3.\nSubject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in\nparagraph 1 may also be provided for, in particular, by:\n(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal\ndata in the third country or international organisation; or\n(b) provisions to be inserted into administrative arrangements between public authorities or bodies which include\nenforceable and effective data subject rights.\n4.\nThe supervisory authority shall apply the consistency mechanism referred to in Article 63 in the cases referred to\nin paragraph 3 of this Article.\n5.\nAuthorisations by a Member State or supervisory authority on the basis of Article 26(2) of Directive 95/46/EC\nshall remain valid until amended, replaced or repealed, if necessary, by that supervisory authority. Decisions adopted by\nthe Commission on the basis of Article 26(4) of Directive 95/46/EC shall remain in force until amended, replaced or\nrepealed, if necessary, by a Commission Decision adopted in accordance with paragraph 2 of this Article."}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 47, "article_title": "Binding corporate rules", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 47 – Binding corporate rules\n\n1.\nThe competent supervisory authority shall approve binding corporate rules in accordance with the consistency\nmechanism set out in Article 63, provided that they:\n(a) are legally binding and apply to and are enforced by every member concerned of the group of undertakings, or\ngroup of enterprises engaged in a joint economic activity, including their employees;\n4.5.2016\nEN\n(b) expressly confer enforceable rights on data subjects with regard to the processing of their personal data; and\n(c) fulfil the requirements laid down in paragraph 2.\n2.\nThe binding corporate rules referred to in paragraph 1 shall specify at least:\n(a) the structure and contact details of the group of undertakings, or group of enterprises engaged in a joint economic\nactivity and of each of its members;\n(b) the data transfers or set of transfers, including the categories of personal data, the type of processing and its\npurposes, the type of data subjects affected and the identification of the third country or countries in question;\n(c) their legally binding nature, both internally and externally;\n(d) the application of the general data protection principles, in particular purpose limitation, data minimisation, limited\nstorage periods, data quality, data protection by design and by default, legal basis for processing, processing of\nspecial categories of personal data, measures to ensure data security, and the requirements in respect of onward\ntransfers to bodies not bound by the binding corporate rules;\n(e) the rights of data subjects in regard to processing and the means to exercise those rights, including the right not to\nbe subject to decisions based solely on automated processing, including profiling in accordance with Article 22, the\nright to lodge a complaint with the competent supervisory authority and before the competent courts of the\nMember States in accordance with Article 79, and to obtain redress and, where appropriate, compensation for a\nbreach of the binding corporate rules;\n(f) the acceptance by the controller or processor established on the territory of a Member State of liability for any\nbreaches of the binding corporate rules by any member concerned not established in the Union; the controller or\nthe processor shall be exempt from that liability, in whole or in part, only if it proves that that member is not\nresponsible for the event giving rise to the damage;\n(g) how the information on the binding corporate rules, in particular on the provisions referred to in points (d), (e)\nand (f) of this paragraph is provided to the data subjects in addition to Articles 13 and 14;\n(h) the tasks of any data protection officer designated in accordance with Article 37 or any other person or entity in\ncharge of the monitoring compliance with the binding corporate rules within the group of undertakings, or group\nof enterprises engaged in a joint economic activity, as well as monitoring training and complaint-handling;\n(i) the complaint procedures;\n(j) the mechanisms within the group of undertakings, or group of enterprises engaged in a joint economic activity for\nensuring the verification of compliance with the binding corporate rules. Such mechanisms shall include data\nprotection audits and methods for ensuring corrective actions to protect the rights of the data subject. Results of\nsuch verification should be communicated to the person or entity referred to in point (h) and to the board of the\ncontrolling undertaking of a group of undertakings, or of the group of enterprises engaged in a joint economic\nactivity, and should be available upon request to the competent supervisory authority;\n(k) the mechanisms for reporting and recording changes to the rules and reporting those changes to the supervisory\nauthority;\n(l) the cooperation mechanism with the supervisory authority to ensure compliance by any member of the group of\nundertakings, or group of enterprises engaged in a joint economic activity, in particular by making available to the\nsupervisory authority the results of verifications of the measures referred to in point (j);\n(m) the mechanisms for reporting to the competent supervisory authority any legal requirements to which a member of\nthe group of undertakings, or group of enterprises engaged in a joint economic activity is subject in a third country\nwhich are likely to have a substantial adverse effect on the guarantees provided by the binding corporate rules; and\n(n) the appropriate data protection training to personnel having permanent or regular access to personal data.\n4.5.2016\nEN\n3.\nThe Commission may specify the format and procedures for the exchange of information between controllers,\nprocessors and supervisory authorities for binding corporate rules within the meaning of this Article. Those\nimplementing acts shall be adopted in accordance with the examination procedure set out in Article 93(2)."}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 48, "article_title": "Transfers or disclosures not authorised by Union law", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 48 – Transfers or disclosures not authorised by Union law\n\nAny judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a\ncontroller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if\nbased on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third\ncountry and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter."}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 49, "article_title": "Derogations for specific situations", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 49 – Derogations for specific situations\n\n1.\nIn the absence of an adequacy decision pursuant to Article 45(3), or of appropriate safeguards pursuant to\nArticle 46, including binding corporate rules, a transfer or a set of transfers of personal data to a third country or an in­\nternational organisation shall take place only on one of the following conditions:\n(a) the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of\nsuch transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards;\n(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the\nimplementation of pre-contractual measures taken at the data subject's request;\n(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject\nbetween the controller and another natural or legal person;\n(d) the transfer is necessary for important reasons of public interest;\n(e) the transfer is necessary for the establishment, exercise or defence of legal claims;\n(f) the transfer is necessary in order to protect the vital interests of the data subject or of other persons, where the data\nsubject is physically or legally incapable of giving consent;\n(g) the transfer is made from a register which according to Union or Member State law is intended to provide\ninformation to the public and which is open to consultation either by the public in general or by any person who\ncan demonstrate a legitimate interest, but only to the extent that the conditions laid down by Union or\nMember State law for consultation are fulfilled in the particular case.\nWhere a transfer could not be based on a provision in Article 45 or 46, including the provisions on binding corporate\nrules, and none of the derogations for a specific situation referred to in the first subparagraph of this paragraph is\napplicable, a transfer to a third country or an international organisation may take place only if the transfer is not\nrepetitive, concerns only a limited number of data subjects, is necessary for the purposes of compelling legitimate\ninterests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject,\nand the controller has assessed all the circumstances surrounding the data transfer and has on the basis of that\nassessment provided suitable safeguards with regard to the protection of personal data. The controller shall inform the\nsupervisory authority of the transfer. The controller shall, in addition to providing the information referred to in\nArticles 13 and 14, inform the data subject of the transfer and on the compelling legitimate interests pursued.\n2.\nA transfer pursuant to point (g) of the first subparagraph of paragraph 1 shall not involve the entirety of the\npersonal data or entire categories of the personal data contained in the register. Where the register is intended for\nconsultation by persons having a legitimate interest, the transfer shall be made only at the request of those persons or if\nthey are to be the recipients.\n4.5.2016\nEN\n3.\nPoints (a), (b) and (c) of the first subparagraph of paragraph 1 and the second subparagraph thereof shall not apply\nto activities carried out by public authorities in the exercise of their public powers.\n4.\nThe public interest referred to in point (d) of the first subparagraph of paragraph 1 shall be recognised in Union\nlaw or in the law of the Member State to which the controller is subject.\n5.\nIn the absence of an adequacy decision, Union or Member State law may, for important reasons of public interest,\nexpressly set limits to the transfer of specific categories of personal data to a third country or an international\norganisation. Member States shall notify such provisions to the Commission.\n6.\nThe controller or processor shall document the assessment as well as the suitable safeguards referred to in the\nsecond subparagraph of paragraph 1 of this Article in the records referred to in Article 30."}
{"source": "GDPR", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 50, "article_title": "International cooperation for the protection of personal data", "content": "Source: GDPR\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 50 – International cooperation for the protection of personal data\n\nIn relation to third countries and international organisations, the Commission and supervisory authorities shall take\nappropriate steps to:\n(a) develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection\nof personal data;\n(b) provide international mutual assistance in the enforcement of legislation for the protection of personal data,\nincluding through notification, complaint referral, investigative assistance and information exchange, subject to\nappropriate safeguards for the protection of personal data and other fundamental rights and freedoms;\n(c) engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the\nenforcement of legislation for the protection of personal data;\n(d) promote the exchange and documentation of personal data protection legislation and practice, including on jurisdic­\ntional conflicts with third countries."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 51, "article_title": "Supervisory authority", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 51 – Supervisory authority\n\n1.\nEach Member State shall provide for one or more independent public authorities to be responsible for monitoring\nthe application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation\nto processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).\n2.\nEach supervisory authority shall contribute to the consistent application of this Regulation throughout the Union.\nFor that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with\nChapter VII.\n3.\nWhere more than one supervisory authority is established in a Member State, that Member State shall designate\nthe supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure\ncompliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.\n4.\nEach Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this\nChapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 52, "article_title": "Independence", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 52 – Independence\n\n1.\nEach supervisory authority shall act with complete independence in performing its tasks and exercising its powers\nin accordance with this Regulation.\n2.\nThe member or members of each supervisory authority shall, in the performance of their tasks and exercise of\ntheir powers in accordance with this Regulation, remain free from external influence, whether direct or indirect, and\nshall neither seek nor take instructions from anybody.\n3.\nMember or members of each supervisory authority shall refrain from any action incompatible with their duties\nand shall not, during their term of office, engage in any incompatible occupation, whether gainful or not.\n4.\nEach Member State shall ensure that each supervisory authority is provided with the human, technical and\nfinancial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its\npowers, including those to be carried out in the context of mutual assistance, cooperation and participation in the\nBoard.\n5.\nEach Member State shall ensure that each supervisory authority chooses and has its own staff which shall be\nsubject to the exclusive direction of the member or members of the supervisory authority concerned.\n6.\nEach Member State shall ensure that each supervisory authority is subject to financial control which does not\naffect its independence and that it has separate, public annual budgets, which may be part of the overall state or national\nbudget."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 53, "article_title": "General conditions for the members of the supervisory authority", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 53 – General conditions for the members of the supervisory authority\n\n1.\nMember States shall provide for each member of their supervisory authorities to be appointed by means of a\ntransparent procedure by:\n— their parliament;\n— their government;\n— their head of State; or\n— an independent body entrusted with the appointment under Member State law.\n2.\nEach member shall have the qualifications, experience and skills, in particular in the area of the protection of\npersonal data, required to perform its duties and exercise its powers.\n3.\nThe duties of a member shall end in the event of the expiry of the term of office, resignation or compulsory\nretirement, in accordance with the law of the Member State concerned.\n4.\nA member shall be dismissed only in cases of serious misconduct or if the member no longer fulfils the conditions\nrequired for the performance of the duties."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 54, "article_title": "Rules on the establishment of the supervisory authority", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 54 – Rules on the establishment of the supervisory authority\n\n1.\nEach Member State shall provide by law for all of the following:\n(a) the establishment of each supervisory authority;\n4.5.2016\nEN\n(b) the qualifications and eligibility conditions required to be appointed as member of each supervisory authority;\n(c) the rules and procedures for the appointment of the member or members of each supervisory authority;\n(d) the duration of the term of the member or members of each supervisory authority of no less than four years, except\nfor the first appointment after 24 May 2016, part of which may take place for a shorter period where that is\nnecessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;\n(e) whether and, if so, for how many terms the member or members of each supervisory authority is eligible for\nreappointment;\n(f) the conditions governing the obligations of the member or members and staff of each supervisory authority,\nprohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and\nrules governing the cessation of employment.\n2.\nThe member or members and the staff of each supervisory authority shall, in accordance with Union or Member\nState law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any\nconfidential information which has come to their knowledge in the course of the performance of their tasks or exercise\nof their powers. During their term of office, that duty of professional secrecy shall in particular apply to reporting by\nnatural persons of infringements of this Regulation."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 55, "article_title": "Competence", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 55 – Competence\n\n1.\nEach supervisory authority shall be competent for the performance of the tasks assigned to and the exercise of the\npowers conferred on it in accordance with this Regulation on the territory of its own Member State.\n2.\nWhere processing is carried out by public authorities or private bodies acting on the basis of point (c) or (e) of\nArticle 6(1), the supervisory authority of the Member State concerned shall be competent. In such cases Article 56 does\nnot apply.\n3.\nSupervisory authorities shall not be competent to supervise processing operations of courts acting in their judicial\ncapacity."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 56, "article_title": "Competence of the lead supervisory authority", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 56 – Competence of the lead supervisory authority\n\n1.\nWithout prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment\nof the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing\ncarried out by that controller or processor in accordance with the procedure provided in Article 60.\n2.\nBy derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with\nit or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State\nor substantially affects data subjects only in its Member State.\n3.\nIn the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory\nauthority without delay on that matter. Within a period of three weeks after being informed the lead supervisory\nauthority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60,\ntaking into account whether or not there is an establishment of the controller or processor in the Member State of\nwhich the supervisory authority informed it.\n4.5.2016\nEN\n4.\nWhere the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply.\nThe supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a\ndraft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft\ndecision referred to in Article 60(3).\n5.\nWhere the lead supervisory authority decides not to handle the case, the supervisory authority which informed the\nlead supervisory authority shall handle it according to Articles 61 and 62.\n6.\nThe lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border\nprocessing carried out by that controller or processor."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 57, "article_title": "Tasks", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 57 – Tasks\n\n1.\nWithout prejudice to other tasks set out under this Regulation, each supervisory authority shall on its territory:\n(a) monitor and enforce the application of this Regulation;\n(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing.\nActivities addressed specifically to children shall receive specific attention;\n(c) advise, in accordance with Member State law, the national parliament, the government, and other institutions and\nbodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms\nwith regard to processing;\n(d) promote the awareness of controllers and processors of their obligations under this Regulation;\n(e) upon request, provide information to any data subject concerning the exercise of their rights under this Regulation\nand, if appropriate, cooperate with the supervisory authorities in other Member States to that end;\n(f) handle complaints lodged by a data subject, or by a body, organisation or association in accordance with Article 80,\nand investigate, to the extent appropriate, the subject matter of the complaint and inform the complainant of the\nprogress and the outcome of the investigation within a reasonable period, in particular if further investigation or\ncoordination with another supervisory authority is necessary;\n(g) cooperate with, including sharing information and provide mutual assistance to, other supervisory authorities with\na view to ensuring the consistency of application and enforcement of this Regulation;\n(h) conduct investigations on the application of this Regulation, including on the basis of information received from\nanother supervisory authority or other public authority;\n(i) monitor relevant developments, insofar as they have an impact on the protection of personal data, in particular the\ndevelopment of information and communication technologies and commercial practices;\n(j) adopt standard contractual clauses referred to in Article 28(8) and in point (d) of Article 46(2);\n(k) establish and maintain a list in relation to the requirement for data protection impact assessment pursuant to\nArticle 35(4);\n(l) give advice on the processing operations referred to in Article 36(2);\n(m) encourage the drawing up of codes of conduct pursuant to Article 40(1) and provide an opinion and approve such\ncodes of conduct which provide sufficient safeguards, pursuant to Article 40(5);\n(n) encourage the establishment of data protection certification mechanisms and of data protection seals and marks\npursuant to Article 42(1), and approve the criteria of certification pursuant to Article 42(5);\n(o) where applicable, carry out a periodic review of certifications issued in accordance with Article 42(7);\n4.5.2016\nEN\n(p) draft and publish the criteria for accreditation of a body for monitoring codes of conduct pursuant to Article 41\nand of a certification body pursuant to Article 43;\n(q) conduct the accreditation of a body for monitoring codes of conduct pursuant to Article 41 and of a certification\nbody pursuant to Article 43;\n(r) authorise contractual clauses and provisions referred to in Article 46(3);\n(s) approve binding corporate rules pursuant to Article 47;\n(t) contribute to the activities of the Board;\n(u) keep internal records of infringements of this Regulation and of measures taken in accordance with Article 58(2);\nand\n(v) fulfil any other tasks related to the protection of personal data.\n2.\nEach supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by\nmeasures such as a complaint submission form which can also be completed electronically, without excluding other\nmeans of communication.\n3.\nThe performance of the tasks of each supervisory authority shall be free of charge for the data subject and, where\napplicable, for the data protection officer.\n4.\nWhere requests are manifestly unfounded or excessive, in particular because of their repetitive character, the\nsupervisory authority may charge a reasonable fee based on administrative costs, or refuse to act on the request. The\nsupervisory authority shall bear the burden of demonstrating the manifestly unfounded or excessive character of the\nrequest."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 58, "article_title": "Powers", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 58 – Powers\n\n1.\nEach supervisory authority shall have all of the following investigative powers:\n(a) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to\nprovide any information it requires for the performance of its tasks;\n(b) to carry out investigations in the form of data protection audits;\n(c) to carry out a review on certifications issued pursuant to Article 42(7);\n(d) to notify the controller or the processor of an alleged infringement of this Regulation;\n(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the\nperformance of its tasks;\n(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment\nand means, in accordance with Union or Member State procedural law.\n2.\nEach supervisory authority shall have all of the following corrective powers:\n(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of\nthis Regulation;\n(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this\nRegulation;\n(c) to order the controller or the processor to comply with the data subject's requests to exercise his or her rights\npursuant to this Regulation;\n4.5.2016\nEN\n(d) to order the controller or processor to bring processing operations into compliance with the provisions of this\nRegulation, where appropriate, in a specified manner and within a specified period;\n(e) to order the controller to communicate a personal data breach to the data subject;\n(f) to impose a temporary or definitive limitation including a ban on processing;\n(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18\nand the notification of such actions to recipients to whom the personal data have been disclosed pursuant to\nArticle 17(2) and Article 19;\n(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to\nArticles 42 and 43, or to order the certification body not to issue certification if the requirements for the certifi­\ncation are not or are no longer met;\n(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this\nparagraph, depending on the circumstances of each individual case;\n(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.\n3.\nEach supervisory authority shall have all of the following authorisation and advisory powers:\n(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;\n(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or,\nin accordance with Member State law, to other institutions and bodies as well as to the public on any issue related\nto the protection of personal data;\n(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;\n(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);\n(e) to accredit certification bodies pursuant to Article 43;\n(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);\n(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);\n(h) to authorise contractual clauses referred to in point (a) of Article 46(3);\n(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);\n(j) to approve binding corporate rules pursuant to Article 47.\n4.\nThe exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to\nappropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in\naccordance with the Charter.\n5.\nEach Member State shall provide by law that its supervisory authority shall have the power to bring infringements\nof this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise\nin legal proceedings, in order to enforce the provisions of this Regulation.\n6.\nEach Member State may provide by law that its supervisory authority shall have additional powers to those\nreferred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of\nChapter VII."}
{"source": "GDPR", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 59, "article_title": "Activity reports", "content": "Source: GDPR\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 59 – Activity reports\n\nEach supervisory authority shall draw up an annual report on its activities, which may include a list of types of\ninfringement notified and types of measures taken in accordance with Article 58(2). Those reports shall be transmitted\nto the national parliament, the government and other authorities as designated by Member State law. They shall be made\navailable to the public, to the Commission and to the Board.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "1", "title": "Cooperation"}, "article_number": 60, "article_title": "Cooperation between the lead supervisory authority and the other supervisory authorities", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 1 – Cooperation\nArticle 60 – Cooperation between the lead supervisory authority and the other supervisory authorities\n\nconcerned\n1.\nThe lead supervisory authority shall cooperate with the other supervisory authorities concerned in accordance\nwith this Article in an endeavour to reach consensus. The lead supervisory authority and the supervisory authorities\nconcerned shall exchange all relevant information with each other.\n2.\nThe lead supervisory authority may request at any time other supervisory authorities concerned to provide mutual\nassistance pursuant to Article 61 and may conduct joint operations pursuant to Article 62, in particular for carrying out\ninvestigations or for monitoring the implementation of a measure concerning a controller or processor established in\nanother Member State.\n3.\nThe lead supervisory authority shall, without delay, communicate the relevant information on the matter to the\nother supervisory authorities concerned. It shall without delay submit a draft decision to the other supervisory\nauthorities concerned for their opinion and take due account of their views.\n4.\nWhere any of the other supervisory authorities concerned within a period of four weeks after having been\nconsulted in accordance with paragraph 3 of this Article, expresses a relevant and reasoned objection to the draft\ndecision, the lead supervisory authority shall, if it does not follow the relevant and reasoned objection or is of the\nopinion that the objection is not relevant or reasoned, submit the matter to the consistency mechanism referred to in\nArticle 63.\n5.\nWhere the lead supervisory authority intends to follow the relevant and reasoned objection made, it shall submit\nto the other supervisory authorities concerned a revised draft decision for their opinion. That revised draft decision shall\nbe subject to the procedure referred to in paragraph 4 within a period of two weeks.\n6.\nWhere none of the other supervisory authorities concerned has objected to the draft decision submitted by the\nlead supervisory authority within the period referred to in paragraphs 4 and 5, the lead supervisory authority and the\nsupervisory authorities concerned shall be deemed to be in agreement with that draft decision and shall be bound by it.\n7.\nThe lead supervisory authority shall adopt and notify the decision to the main establishment or single\nestablishment of the controller or processor, as the case may be and inform the other supervisory authorities concerned\nand the Board of the decision in question, including a summary of the relevant facts and grounds. The supervisory\nauthority with which a complaint has been lodged shall inform the complainant on the decision.\n8.\nBy derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority with which\nthe complaint was lodged shall adopt the decision and notify it to the complainant and shall inform the controller\nthereof.\n9.\nWhere the lead supervisory authority and the supervisory authorities concerned agree to dismiss or reject parts of\na complaint and to act on other parts of that complaint, a separate decision shall be adopted for each of those parts of\nthe matter. The lead supervisory authority shall adopt the decision for the part concerning actions in relation to the\ncontroller, shall notify it to the main establishment or single establishment of the controller or processor on the territory\nof its Member State and shall inform the complainant thereof, while the supervisory authority of the complainant shall\nadopt the decision for the part concerning dismissal or rejection of that complaint, and shall notify it to that\ncomplainant and shall inform the controller or processor thereof.\n10.\nAfter being notified of the decision of the lead supervisory authority pursuant to paragraphs 7 and 9, the\ncontroller or processor shall take the necessary measures to ensure compliance with the decision as regards processing\nactivities in the context of all its establishments in the Union. The controller or processor shall notify the measures\ntaken for complying with the decision to the lead supervisory authority, which shall inform the other supervisory\nauthorities concerned.\n4.5.2016\nEN\n11.\nWhere, in exceptional circumstances, a supervisory authority concerned has reasons to consider that there is an\nurgent need to act in order to protect the interests of data subjects, the urgency procedure referred to in Article 66 shall\napply.\n12.\nThe lead supervisory authority and the other supervisory authorities concerned shall supply the information\nrequired under this Article to each other by electronic means, using a standardised format."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "1", "title": "Cooperation"}, "article_number": 61, "article_title": "Mutual assistance", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 1 – Cooperation\nArticle 61 – Mutual assistance\n\n1.\nSupervisory authorities shall provide each other with relevant information and mutual assistance in order to\nimplement and apply this Regulation in a consistent manner, and shall put in place measures for effective cooperation\nwith one another. Mutual assistance shall cover, in particular, information requests and supervisory measures, such as\nrequests to carry out prior authorisations and consultations, inspections and investigations.\n2.\nEach supervisory authority shall take all appropriate measures required to reply to a request of another supervisory\nauthority without undue delay and no later than one month after receiving the request. Such measures may include, in\nparticular, the transmission of relevant information on the conduct of an investigation.\n3.\nRequests for assistance shall contain all the necessary information, including the purpose of and reasons for the\nrequest. Information exchanged shall be used only for the purpose for which it was requested.\n4.\nThe requested supervisory authority shall not refuse to comply with the request unless:\n(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or\n(b) compliance with the request would infringe this Regulation or Union or Member State law to which the supervisory\nauthority receiving the request is subject.\n5.\nThe requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case\nmay be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority\nshall provide reasons for any refusal to comply with a request pursuant to paragraph 4.\n6.\nRequested supervisory authorities shall, as a rule, supply the information requested by other supervisory\nauthorities by electronic means, using a standardised format.\n7.\nRequested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for\nmutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising\nfrom the provision of mutual assistance in exceptional circumstances.\n8.\nWhere a supervisory authority does not provide the information referred to in paragraph 5 of this Article within\none month of receiving the request of another supervisory authority, the requesting supervisory authority may adopt a\nprovisional measure on the territory of its Member State in accordance with Article 55(1). In that case, the urgent need\nto act under Article 66(1) shall be presumed to be met and require an urgent binding decision from the Board pursuant\nto Article 66(2).\n9.\nThe Commission may, by means of implementing acts, specify the format and procedures for mutual assistance\nreferred to in this Article and the arrangements for the exchange of information by electronic means between\nsupervisory authorities, and between supervisory authorities and the Board, in particular the standardised format\nreferred to in paragraph 6 of this Article. Those implementing acts shall be adopted in accordance with the examination\nprocedure referred to in Article 93(2)."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "1", "title": "Cooperation"}, "article_number": 62, "article_title": "Joint operations of supervisory authorities", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 1 – Cooperation\nArticle 62 – Joint operations of supervisory authorities\n\n1.\nThe supervisory authorities shall, where appropriate, conduct joint operations including joint investigations and\njoint enforcement measures in which members or staff of the supervisory authorities of other Member States are\ninvolved.\n4.5.2016\nEN\n2.\nWhere the controller or processor has establishments in several Member States or where a significant number of\ndata subjects in more than one Member State are likely to be substantially affected by processing operations, a\nsupervisory authority of each of those Member States shall have the right to participate in joint operations. The\nsupervisory authority which is competent pursuant to Article 56(1) or (4) shall invite the supervisory authority of each\nof those Member States to take part in the joint operations and shall respond without delay to the request of a\nsupervisory authority to participate.\n3.\nA supervisory authority may, in accordance with Member State law, and with the seconding supervisory\nauthority's authorisation, confer powers, including investigative powers on the seconding supervisory authority's\nmembers or staff involved in joint operations or, in so far as the law of the Member State of the host supervisory\nauthority permits, allow the seconding supervisory authority's members or staff to exercise their investigative powers in\naccordance with the law of the Member State of the seconding supervisory authority. Such investigative powers may be\nexercised only under the guidance and in the presence of members or staff of the host supervisory authority. The\nseconding supervisory authority's members or staff shall be subject to the Member State law of the host supervisory\nauthority.\n4.\nWhere, in accordance with paragraph 1, staff of a seconding supervisory authority operate in another Member\nState, the Member State of the host supervisory authority shall assume responsibility for their actions, including liability,\nfor any damage caused by them during their operations, in accordance with the law of the Member State in whose\nterritory they are operating.\n5.\nThe Member State in whose territory the damage was caused shall make good such damage under the conditions\napplicable to damage caused by its own staff. The Member State of the seconding supervisory authority whose staff has\ncaused damage to any person in the territory of another Member State shall reimburse that other Member State in full\nany sums it has paid to the persons entitled on their behalf.\n6.\nWithout prejudice to the exercise of its rights vis-à-vis third parties and with the exception of paragraph 5, each\nMember State shall refrain, in the case provided for in paragraph 1, from requesting reimbursement from another\nMember State in relation to damage referred to in paragraph 4.\n7.\nWhere a joint operation is intended and a supervisory authority does not, within one month, comply with the\nobligation laid down in the second sentence of paragraph 2 of this Article, the other supervisory authorities may adopt\na provisional measure on the territory of its Member State in accordance with Article 55. In that case, the urgent need\nto act under Article 66(1) shall be presumed to be met and require an opinion or an urgent binding decision from the\nBoard pursuant to Article 66(2)."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "2", "title": "Consistency"}, "article_number": 63, "article_title": "Consistency mechanism", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 2 – Consistency\nArticle 63 – Consistency mechanism\n\nIn order to contribute to the consistent application of this Regulation throughout the Union, the supervisory authorities\nshall cooperate with each other and, where relevant, with the Commission, through the consistency mechanism as set\nout in this Section."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "2", "title": "Consistency"}, "article_number": 64, "article_title": "Opinion of the Board", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 2 – Consistency\nArticle 64 – Opinion of the Board\n\n1.\nThe Board shall issue an opinion where a competent supervisory authority intends to adopt any of the measures\nbelow. To that end, the competent supervisory authority shall communicate the draft decision to the Board, when it:\n(a) aims to adopt a list of the processing operations subject to the requirement for a data protection impact assessment\npursuant to Article 35(4);\n(b) concerns a matter pursuant to Article 40(7) whether a draft code of conduct or an amendment or extension to a\ncode of conduct complies with this Regulation;\n4.5.2016\nEN\n(c) aims to approve the criteria for accreditation of a body pursuant to Article 41(3) or a certification body pursuant to\nArticle 43(3);\n(d) aims to determine standard data protection clauses referred to in point (d) of Article 46(2) and in Article 28(8);\n(e) aims to authorise contractual clauses referred to in point (a) of Article 46(3); or\n(f) aims to approve binding corporate rules within the meaning of Article 47.\n2.\nAny supervisory authority, the Chair of the Board or the Commission may request that any matter of general\napplication or producing effects in more than one Member State be examined by the Board with a view to obtaining an\nopinion, in particular where a competent supervisory authority does not comply with the obligations for mutual\nassistance in accordance with Article 61 or for joint operations in accordance with Article 62.\n3.\nIn the cases referred to in paragraphs 1 and 2, the Board shall issue an opinion on the matter submitted to it\nprovided that it has not already issued an opinion on the same matter. That opinion shall be adopted within eight weeks\nby simple majority of the members of the Board. That period may be extended by a further six weeks, taking into\naccount the complexity of the subject matter. Regarding the draft decision referred to in paragraph 1 circulated to the\nmembers of the Board in accordance with paragraph 5, a member which has not objected within a reasonable period\nindicated by the Chair, shall be deemed to be in agreement with the draft decision.\n4.\nSupervisory authorities and the Commission shall, without undue delay, communicate by electronic means to the\nBoard, using a standardised format any relevant information, including as the case may be a summary of the facts, the\ndraft decision, the grounds which make the enactment of such measure necessary, and the views of other supervisory\nauthorities concerned.\n5.\nThe Chair of the Board shall, without undue, delay inform by electronic means:\n(a) the members of the Board and the Commission of any relevant information which has been communicated to it\nusing a standardised format. The secretariat of the Board shall, where necessary, provide translations of relevant\ninformation; and\n(b) the supervisory authority referred to, as the case may be, in paragraphs 1 and 2, and the Commission of the opinion\nand make it public.\n6.\nThe competent supervisory authority shall not adopt its draft decision referred to in paragraph 1 within the period\nreferred to in paragraph 3.\n7.\nThe supervisory authority referred to in paragraph 1 shall take utmost account of the opinion of the Board and\nshall, within two weeks after receiving the opinion, communicate to the Chair of the Board by electronic means whether\nit will maintain or amend its draft decision and, if any, the amended draft decision, using a standardised format.\n8.\nWhere the supervisory authority concerned informs the Chair of the Board within the period referred to in\nparagraph 7 of this Article that it does not intend to follow the opinion of the Board, in whole or in part, providing the\nrelevant grounds, Article 65(1) shall apply."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "2", "title": "Consistency"}, "article_number": 65, "article_title": "Dispute resolution by the Board", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 2 – Consistency\nArticle 65 – Dispute resolution by the Board\n\n1.\nIn order to ensure the correct and consistent application of this Regulation in individual cases, the Board shall\nadopt a binding decision in the following cases:\n(a) where, in a case referred to in Article 60(4), a supervisory authority concerned has raised a relevant and reasoned\nobjection to a draft decision of the lead authority or the lead authority has rejected such an objection as being not\nrelevant or reasoned. The binding decision shall concern all the matters which are the subject of the relevant and\nreasoned objection, in particular whether there is an infringement of this Regulation;\n4.5.2016\nEN\n(b) where there are conflicting views on which of the supervisory authorities concerned is competent for the main\nestablishment;\n(c) where a competent supervisory authority does not request the opinion of the Board in the cases referred to in\nArticle 64(1), or does not follow the opinion of the Board issued under Article 64. In that case, any supervisory\nauthority concerned or the Commission may communicate the matter to the Board.\n2.\nThe decision referred to in paragraph 1 shall be adopted within one month from the referral of the subject-matter\nby a two-thirds majority of the members of the Board. That period may be extended by a further month on account of\nthe complexity of the subject-matter. The decision referred to in paragraph 1 shall be reasoned and addressed to the lead\nsupervisory authority and all the supervisory authorities concerned and binding on them.\n3.\nWhere the Board has been unable to adopt a decision within the periods referred to in paragraph 2, it shall adopt\nits decision within two weeks following the expiration of the second month referred to in paragraph 2 by a simple\nmajority of the members of the Board. Where the members of the Board are split, the decision shall by adopted by the\nvote of its Chair.\n4.\nThe supervisory authorities concerned shall not adopt a decision on the subject matter submitted to the Board\nunder paragraph 1 during the periods referred to in paragraphs 2 and 3.\n5.\nThe Chair of the Board shall notify, without undue delay, the decision referred to in paragraph 1 to the supervisory\nauthorities concerned. It shall inform the Commission thereof. The decision shall be published on the website of the\nBoard without delay after the supervisory authority has notified the final decision referred to in paragraph 6.\n6.\nThe lead supervisory authority or, as the case may be, the supervisory authority with which the complaint has\nbeen lodged shall adopt its final decision on the basis of the decision referred to in paragraph 1 of this Article, without\nundue delay and at the latest by one month after the Board has notified its decision. The lead supervisory authority or,\nas the case may be, the supervisory authority with which the complaint has been lodged, shall inform the Board of the\ndate when its final decision is notified respectively to the controller or the processor and to the data subject. The final\ndecision of the supervisory authorities concerned shall be adopted under the terms of Article 60(7), (8) and (9). The\nfinal decision shall refer to the decision referred to in paragraph 1 of this Article and shall specify that the decision\nreferred to in that paragraph will be published on the website of the Board in accordance with paragraph 5 of this\nArticle. The final decision shall attach the decision referred to in paragraph 1 of this Article."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "2", "title": "Consistency"}, "article_number": 66, "article_title": "Urgency procedure", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 2 – Consistency\nArticle 66 – Urgency procedure\n\n1.\nIn exceptional circumstances, where a supervisory authority concerned considers that there is an urgent need to\nact in order to protect the rights and freedoms of data subjects, it may, by way of derogation from the consistency\nmechanism referred to in Articles 63, 64 and 65 or the procedure referred to in Article 60, immediately adopt\nprovisional measures intended to produce legal effects on its own territory with a specified period of validity which shall\nnot exceed three months. The supervisory authority shall, without delay, communicate those measures and the reasons\nfor adopting them to the other supervisory authorities concerned, to the Board and to the Commission.\n2.\nWhere a supervisory authority has taken a measure pursuant to paragraph 1 and considers that final measures\nneed urgently be adopted, it may request an urgent opinion or an urgent binding decision from the Board, giving\nreasons for requesting such opinion or decision.\n3.\nAny supervisory authority may request an urgent opinion or an urgent binding decision, as the case may be, from\nthe Board where a competent supervisory authority has not taken an appropriate measure in a situation where there is\nan urgent need to act, in order to protect the rights and freedoms of data subjects, giving reasons for requesting such\nopinion or decision, including for the urgent need to act.\n4.\nBy derogation from Article 64(3) and Article 65(2), an urgent opinion or an urgent binding decision referred to in\nparagraphs 2 and 3 of this Article shall be adopted within two weeks by simple majority of the members of the Board.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "2", "title": "Consistency"}, "article_number": 67, "article_title": "Exchange of information", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 2 – Consistency\nArticle 67 – Exchange of information\n\nThe Commission may adopt implementing acts of general scope in order to specify the arrangements for the exchange\nof information by electronic means between supervisory authorities, and between supervisory authorities and the Board,\nin particular the standardised format referred to in Article 64.\nThose implementing acts shall be adopted in accordance with the examination procedure referred to in Article 93(2)."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 68, "article_title": "European Data Protection Board", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 68 – European Data Protection Board\n\n1.\nThe European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal\npersonality.\n2.\nThe Board shall be represented by its Chair.\n3.\nThe Board shall be composed of the head of one supervisory authority of each Member State and of the European\nData Protection Supervisor, or their respective representatives.\n4.\nWhere in a Member State more than one supervisory authority is responsible for monitoring the application of\nthe provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member\nState's law.\n5.\nThe Commission shall have the right to participate in the activities and meetings of the Board without voting\nright. The Commission shall designate a representative. The Chair of the Board shall communicate to the Commission\nthe activities of the Board.\n6.\nIn the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on\ndecisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which\ncorrespond in substance to those of this Regulation."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 69, "article_title": "Independence", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 69 – Independence\n\n1.\nThe Board shall act independently when performing its tasks or exercising its powers pursuant to Articles 70\nand 71.\n2.\nWithout prejudice to requests by the Commission referred to in point (b) of Article 70(1) and in Article 70(2), the\nBoard shall, in the performance of its tasks or the exercise of its powers, neither seek nor take instructions from\nanybody."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 70, "article_title": "Tasks of the Board", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 70 – Tasks of the Board\n\n1.\nThe Board shall ensure the consistent application of this Regulation. To that end, the Board shall, on its own\ninitiative or, where relevant, at the request of the Commission, in particular:\n(a) monitor and ensure the correct application of this Regulation in the cases provided for in Articles 64 and 65\nwithout prejudice to the tasks of national supervisory authorities;\n4.5.2016\nEN\n(b) advise the Commission on any issue related to the protection of personal data in the Union, including on any\nproposed amendment of this Regulation;\n(c) advise the Commission on the format and procedures for the exchange of information between controllers,\nprocessors and supervisory authorities for binding corporate rules;\n(d) issue guidelines, recommendations, and best practices on procedures for erasing links, copies or replications of\npersonal data from publicly available communication services as referred to in Article 17(2);\n(e) examine, on its own initiative, on request of one of its members or on request of the Commission, any question\ncovering the application of this Regulation and issue guidelines, recommendations and best practices in order to\nencourage consistent application of this Regulation;\n(f) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for further\nspecifying the criteria and conditions for decisions based on profiling pursuant to Article 22(2);\n(g) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing\nthe personal data breaches and determining the undue delay referred to in Article 33(1) and (2) and for the\nparticular circumstances in which a controller or a processor is required to notify the personal data breach;\n(h) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph as to the\ncircumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of the\nnatural persons referred to in Article 34(1).\n(i) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose\nof further specifying the criteria and requirements for personal data transfers based on binding corporate rules\nadhered to by controllers and binding corporate rules adhered to by processors and on further necessary\nrequirements to ensure the protection of personal data of the data subjects concerned referred to in Article 47;\n(j) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for the purpose\nof further specifying the criteria and requirements for the personal data transfers on the basis of Article 49(1);\n(k) draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 58(1),\n(2) and (3) and the setting of administrative fines pursuant to Article 83;\n(l) review the practical application of the guidelines, recommendations and best practices referred to in points (e)\nand (f);\n(m) issue guidelines, recommendations and best practices in accordance with point (e) of this paragraph for establishing\ncommon procedures for reporting by natural persons of infringements of this Regulation pursuant to Article 54(2);\n(n) encourage the drawing-up of codes of conduct and the establishment of data protection certification mechanisms\nand data protection seals and marks pursuant to Articles 40 and 42;\n(o) carry out the accreditation of certification bodies and its periodic review pursuant to Article 43 and maintain a\npublic register of accredited bodies pursuant to Article 43(6) and of the accredited controllers or processors\nestablished in third countries pursuant to Article 42(7);\n(p) specify the requirements referred to in Article 43(3) with a view to the accreditation of certification bodies under\nArticle 42;\n(q) provide the Commission with an opinion on the certification requirements referred to in Article 43(8);\n(r) provide the Commission with an opinion on the icons referred to in Article 12(7);\n(s) provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third\ncountry or international organisation, including for the assessment whether a third country, a territory or one or\nmore specified sectors within that third country, or an international organisation no longer ensures an adequate\nlevel of protection. To that end, the Commission shall provide the Board with all necessary documentation,\nincluding correspondence with the government of the third country, with regard to that third country, territory or\nspecified sector, or with the international organisation.\n4.5.2016\nEN\n(t) issue opinions on draft decisions of supervisory authorities pursuant to the consistency mechanism referred to in\nArticle 64(1), on matters submitted pursuant to Article 64(2) and to issue binding decisions pursuant to Article 65,\nincluding in cases referred to in Article 66;\n(u) promote the cooperation and the effective bilateral and multilateral exchange of information and best practices\nbetween the supervisory authorities;\n(v) promote common training programmes and facilitate personnel exchanges between the supervisory authorities and,\nwhere appropriate, with the supervisory authorities of third countries or with international organisations;\n(w) promote the exchange of knowledge and documentation on data protection legislation and practice with data\nprotection supervisory authorities worldwide.\n(x) issue opinions on codes of conduct drawn up at Union level pursuant to Article 40(9); and\n(y) maintain a publicly accessible electronic register of decisions taken by supervisory authorities and courts on issues\nhandled in the consistency mechanism.\n2.\nWhere the Commission requests advice from the Board, it may indicate a time limit, taking into account the\nurgency of the matter.\n3.\nThe Board shall forward its opinions, guidelines, recommendations, and best practices to the Commission and to\nthe committee referred to in Article 93 and make them public.\n4.\nThe Board shall, where appropriate, consult interested parties and give them the opportunity to comment within a\nreasonable period. The Board shall, without prejudice to Article 76, make the results of the consultation procedure\npublicly available."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 71, "article_title": "Reports", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 71 – Reports\n\n1.\nThe Board shall draw up an annual report regarding the protection of natural persons with regard to processing in\nthe Union and, where relevant, in third countries and international organisations. The report shall be made public and\nbe transmitted to the European Parliament, to the Council and to the Commission.\n2.\nThe annual report shall include a review of the practical application of the guidelines, recommendations and best\npractices referred to in point (l) of Article 70(1) as well as of the binding decisions referred to in Article 65."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 72, "article_title": "Procedure", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 72 – Procedure\n\n1.\nThe Board shall take decisions by a simple majority of its members, unless otherwise provided for in this\nRegulation.\n2.\nThe Board shall adopt its own rules of procedure by a two-thirds majority of its members and organise its own\noperational arrangements."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 73, "article_title": "Chair", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 73 – Chair\n\n1.\nThe Board shall elect a chair and two deputy chairs from amongst its members by simple majority.\n2.\nThe term of office of the Chair and of the deputy chairs shall be five years and be renewable once.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 74, "article_title": "Tasks of the Chair", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 74 – Tasks of the Chair\n\n1.\nThe Chair shall have the following tasks:\n(a) to convene the meetings of the Board and prepare its agenda;\n(b) to notify decisions adopted by the Board pursuant to Article 65 to the lead supervisory authority and the\nsupervisory authorities concerned;\n(c) to ensure the timely performance of the tasks of the Board, in particular in relation to the consistency mechanism\nreferred to in Article 63.\n2.\nThe Board shall lay down the allocation of tasks between the Chair and the deputy chairs in its rules of procedure."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 75, "article_title": "Secretariat", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 75 – Secretariat\n\n1.\nThe Board shall have a secretariat, which shall be provided by the European Data Protection Supervisor.\n2.\nThe secretariat shall perform its tasks exclusively under the instructions of the Chair of the Board.\n3.\nThe staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by\nthis Regulation shall be subject to separate reporting lines from the staff involved in carrying out tasks conferred on the\nEuropean Data Protection Supervisor.\n4.\nWhere appropriate, the Board and the European Data Protection Supervisor shall establish and publish a\nMemorandum of Understanding implementing this Article, determining the terms of their cooperation, and applicable\nto the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this\nRegulation.\n5.\nThe secretariat shall provide analytical, administrative and logistical support to the Board.\n6.\nThe secretariat shall be responsible in particular for:\n(a) the day-to-day business of the Board;\n(b) communication between the members of the Board, its Chair and the Commission;\n(c) communication with other institutions and the public;\n(d) the use of electronic means for the internal and external communication;\n(e) the translation of relevant information;\n(f) the preparation and follow-up of the meetings of the Board;\n(g) the preparation, drafting and publication of opinions, decisions on the settlement of disputes between supervisory\nauthorities and other texts adopted by the Board."}
{"source": "GDPR", "chapter": {"id": "VII", "title": "Cooperation and consistency"}, "section": {"id": "3", "title": "European data protection board"}, "article_number": 76, "article_title": "Confidentiality", "content": "Source: GDPR\nChapter VII – Cooperation and consistency\nSection 3 – European data protection board\nArticle 76 – Confidentiality\n\n1.\nThe discussions of the Board shall be confidential where the Board deems it necessary, as provided for in its rules\nof procedure.\n4.5.2016\nEN\n2.\nAccess to documents submitted to members of the Board, experts and representatives of third parties shall be\ngoverned by Regulation (EC) No 1049/2001 of the European Parliament and of the Council (1)."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 77, "article_title": "Right to lodge a complaint with a supervisory authority", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 77 – Right to lodge a complaint with a supervisory authority\n\n1.\nWithout prejudice to any other administrative or judicial remedy, every data subject shall have the right to lodge a\ncomplaint with a supervisory authority, in particular in the Member State of his or her habitual residence, place of work\nor place of the alleged infringement if the data subject considers that the processing of personal data relating to him or\nher infringes this Regulation.\n2.\nThe supervisory authority with which the complaint has been lodged shall inform the complainant on the progress\nand the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 78, "article_title": "Right to an effective judicial remedy against a supervisory authority", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 78 – Right to an effective judicial remedy against a supervisory authority\n\n1.\nWithout prejudice to any other administrative or non-judicial remedy, each natural or legal person shall have the\nright to an effective judicial remedy against a legally binding decision of a supervisory authority concerning them.\n2.\nWithout prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to a an\neffective judicial remedy where the supervisory authority which is competent pursuant to Articles 55 and 56 does not\nhandle a complaint or does not inform the data subject within three months on the progress or outcome of the\ncomplaint lodged pursuant to Article 77.\n3.\nProceedings against a supervisory authority shall be brought before the courts of the Member State where the\nsupervisory authority is established.\n4.\nWhere proceedings are brought against a decision of a supervisory authority which was preceded by an opinion or\na decision of the Board in the consistency mechanism, the supervisory authority shall forward that opinion or decision\nto the court."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 79, "article_title": "Right to an effective judicial remedy against a controller or processor", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 79 – Right to an effective judicial remedy against a controller or processor\n\n1.\nWithout prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint\nwith a supervisory authority pursuant to Article 77, each data subject shall have the right to an effective judicial remedy\nwhere he or she considers that his or her rights under this Regulation have been infringed as a result of the processing\nof his or her personal data in non-compliance with this Regulation.\n2.\nProceedings against a controller or a processor shall be brought before the courts of the Member State where the\ncontroller or processor has an establishment. Alternatively, such proceedings may be brought before the courts of the\nMember State where the data subject has his or her habitual residence, unless the controller or processor is a public\nauthority of a Member State acting in the exercise of its public powers.\n4.5.2016\nEN\n(1) Regulation (EC) No 1049/2001 of the European Parliament and of the Council of 30 May 2001 regarding public access to European\nParliament, Council and Commission documents (OJ L 145, 31.5.2001, p. 43)."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 80, "article_title": "Representation of data subjects", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 80 – Representation of data subjects\n\n1.\nThe data subject shall have the right to mandate a not-for-profit body, organisation or association which has been\nproperly constituted in accordance with the law of a Member State, has statutory objectives which are in the public\ninterest, and is active in the field of the protection of data subjects' rights and freedoms with regard to the protection of\ntheir personal data to lodge the complaint on his or her behalf, to exercise the rights referred to in Articles 77, 78 and\n79 on his or her behalf, and to exercise the right to receive compensation referred to in Article 82 on his or her behalf\nwhere provided for by Member State law.\n2.\nMember States may provide that any body, organisation or association referred to in paragraph 1 of this Article, in­\ndependently of a data subject's mandate, has the right to lodge, in that Member State, a complaint with the supervisory\nauthority which is competent pursuant to Article 77 and to exercise the rights referred to in Articles 78 and 79 if it\nconsiders that the rights of a data subject under this Regulation have been infringed as a result of the processing."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 81, "article_title": "Suspension of proceedings", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 81 – Suspension of proceedings\n\n1.\nWhere a competent court of a Member State has information on proceedings, concerning the same subject matter\nas regards processing by the same controller or processor, that are pending in a court in another Member State, it shall\ncontact that court in the other Member State to confirm the existence of such proceedings.\n2.\nWhere proceedings concerning the same subject matter as regards processing of the same controller or processor\nare pending in a court in another Member State, any competent court other than the court first seized may suspend its\nproceedings.\n3.\nWhere those proceedings are pending at first instance, any court other than the court first seized may also, on the\napplication of one of the parties, decline jurisdiction if the court first seized has jurisdiction over the actions in question\nand its law permits the consolidation thereof."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 82, "article_title": "Right to compensation and liability", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 82 – Right to compensation and liability\n\n1.\nAny person who has suffered material or non-material damage as a result of an infringement of this Regulation\nshall have the right to receive compensation from the controller or processor for the damage suffered.\n2.\nAny controller involved in processing shall be liable for the damage caused by processing which infringes this\nRegulation. A processor shall be liable for the damage caused by processing only where it has not complied with\nobligations of this Regulation specifically directed to processors or where it has acted outside or contrary to lawful\ninstructions of the controller.\n3.\nA controller or processor shall be exempt from liability under paragraph 2 if it proves that it is not in any way\nresponsible for the event giving rise to the damage.\n4.\nWhere more than one controller or processor, or both a controller and a processor, are involved in the same\nprocessing and where they are, under paragraphs 2 and 3, responsible for any damage caused by processing, each\ncontroller or processor shall be held liable for the entire damage in order to ensure effective compensation of the data\nsubject.\n5.\nWhere a controller or processor has, in accordance with paragraph 4, paid full compensation for the damage\nsuffered, that controller or processor shall be entitled to claim back from the other controllers or processors involved in\nthe same processing that part of the compensation corresponding to their part of responsibility for the damage, in\naccordance with the conditions set out in paragraph 2.\n4.5.2016\nEN\n6.\nCourt proceedings for exercising the right to receive compensation shall be brought before the courts competent\nunder the law of the Member State referred to in Article 79(2)."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 83, "article_title": "General conditions for imposing administrative fines", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 83 – General conditions for imposing administrative fines\n\n1.\nEach supervisory authority shall ensure that the imposition of administrative fines pursuant to this Article in\nrespect of infringements of this Regulation referred to in paragraphs 4, 5 and 6 shall in each individual case be effective,\nproportionate and dissuasive.\n2.\nAdministrative fines shall, depending on the circumstances of each individual case, be imposed in addition to, or\ninstead of, measures referred to in points (a) to (h) and (j) of Article 58(2). When deciding whether to impose an\nadministrative fine and deciding on the amount of the administrative fine in each individual case due regard shall be\ngiven to the following:\n(a) the nature, gravity and duration of the infringement taking into account the nature scope or purpose of the\nprocessing concerned as well as the number of data subjects affected and the level of damage suffered by them;\n(b) the intentional or negligent character of the infringement;\n(c) any action taken by the controller or processor to mitigate the damage suffered by data subjects;\n(d) the degree of responsibility of the controller or processor taking into account technical and organisational measures\nimplemented by them pursuant to Articles 25 and 32;\n(e) any relevant previous infringements by the controller or processor;\n(f) the degree of cooperation with the supervisory authority, in order to remedy the infringement and mitigate the\npossible adverse effects of the infringement;\n(g) the categories of personal data affected by the infringement;\n(h) the manner in which the infringement became known to the supervisory authority, in particular whether, and if so\nto what extent, the controller or processor notified the infringement;\n(i) where measures referred to in Article 58(2) have previously been ordered against the controller or processor\nconcerned with regard to the same subject-matter, compliance with those measures;\n(j) adherence to approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to\nArticle 42; and\n(k) any other aggravating or mitigating factor applicable to the circumstances of the case, such as financial benefits\ngained, or losses avoided, directly or indirectly, from the infringement.\n3.\nIf a controller or processor intentionally or negligently, for the same or linked processing operations, infringes\nseveral provisions of this Regulation, the total amount of the administrative fine shall not exceed the amount specified\nfor the gravest infringement.\n4.\nInfringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines\nup to 10 000 000 EUR, or in the case of an undertaking, up to 2 % of the total worldwide annual turnover of the\npreceding financial year, whichever is higher:\n(a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43;\n(b) the obligations of the certification body pursuant to Articles 42 and 43;\n(c) the obligations of the monitoring body pursuant to Article 41(4).\n4.5.2016\nEN\n5.\nInfringements of the following provisions shall, in accordance with paragraph 2, be subject to administrative fines\nup to 20 000 000 EUR, or in the case of an undertaking, up to 4 % of the total worldwide annual turnover of the\npreceding financial year, whichever is higher:\n(a) the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9;\n(b) the data subjects' rights pursuant to Articles 12 to 22;\n(c) the transfers of personal data to a recipient in a third country or an international organisation pursuant to\nArticles 44 to 49;\n(d) any obligations pursuant to Member State law adopted under Chapter IX;\n(e) non-compliance with an order or a temporary or definitive limitation on processing or the suspension of data flows\nby the supervisory authority pursuant to Article 58(2) or failure to provide access in violation of Article 58(1).\n6.\nNon-compliance with an order by the supervisory authority as referred to in Article 58(2) shall, in accordance\nwith paragraph 2 of this Article, be subject to administrative fines up to 20 000 000 EUR, or in the case of an\nundertaking, up to 4 % of the total worldwide annual turnover of the preceding financial year, whichever is higher.\n7.\nWithout prejudice to the corrective powers of supervisory authorities pursuant to Article 58(2), each\nMember State may lay down the rules on whether and to what extent administrative fines may be imposed on public\nauthorities and bodies established in that Member State.\n8.\nThe exercise by the supervisory authority of its powers under this Article shall be subject to appropriate\nprocedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due\nprocess.\n9.\nWhere the legal system of the Member State does not provide for administrative fines, this Article may be applied\nin such a manner that the fine is initiated by the competent supervisory authority and imposed by competent national\ncourts, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines\nimposed by supervisory authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive.\nThose Member States shall notify to the Commission the provisions of their laws which they adopt pursuant to this\nparagraph by 25 May 2018 and, without delay, any subsequent amendment law or amendment affecting them."}
{"source": "GDPR", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 84, "article_title": "Penalties", "content": "Source: GDPR\nChapter VIII – Remedies, liability and penalties\nArticle 84 – Penalties\n\n1.\nMember States shall lay down the rules on other penalties applicable to infringements of this Regulation in\nparticular for infringements which are not subject to administrative fines pursuant to Article 83, and shall take all\nmeasures necessary to ensure that they are implemented. Such penalties shall be effective, proportionate and dissuasive.\n2.\nEach Member State shall notify to the Commission the provisions of its law which it adopts pursuant to\nparagraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 85, "article_title": "Processing and freedom of expression and information", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 85 – Processing and freedom of expression and information\n\n1.\nMember States shall by law reconcile the right to the protection of personal data pursuant to this Regulation with\nthe right to freedom of expression and information, including processing for journalistic purposes and the purposes of\nacademic, artistic or literary expression.\n4.5.2016\nEN\n2.\nFor processing carried out for journalistic purposes or the purpose of academic artistic or literary expression,\nMember States shall provide for exemptions or derogations from Chapter II (principles), Chapter III (rights of the data\nsubject), Chapter IV (controller and processor), Chapter V (transfer of personal data to third countries or international\norganisations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and consistency) and\nChapter IX (specific data processing situations) if they are necessary to reconcile the right to the protection of personal\ndata with the freedom of expression and information.\n3.\nEach Member State shall notify to the Commission the provisions of its law which it has adopted pursuant to\nparagraph 2 and, without delay, any subsequent amendment law or amendment affecting them."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 86, "article_title": "Processing and public access to official documents", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 86 – Processing and public access to official documents\n\nPersonal data in official documents held by a public authority or a public body or a private body for the performance of\na task carried out in the public interest may be disclosed by the authority or body in accordance with Union or Member\nState law to which the public authority or body is subject in order to reconcile public access to official documents with\nthe right to the protection of personal data pursuant to this Regulation."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 87, "article_title": "Processing of the national identification number", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 87 – Processing of the national identification number\n\nMember States may further determine the specific conditions for the processing of a national identification number or\nany other identifier of general application. In that case the national identification number or any other identifier of\ngeneral application shall be used only under appropriate safeguards for the rights and freedoms of the data subject\npursuant to this Regulation."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 88, "article_title": "Processing in the context of employment", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 88 – Processing in the context of employment\n\n1.\nMember States may, by law or by collective agreements, provide for more specific rules to ensure the protection of\nthe rights and freedoms in respect of the processing of employees' personal data in the employment context, in\nparticular for the purposes of the recruitment, the performance of the contract of employment, including discharge of\nobligations laid down by law or by collective agreements, management, planning and organisation of work, equality and\ndiversity in the workplace, health and safety at work, protection of employer's or customer's property and for the\npurposes of the exercise and enjoyment, on an individual or collective basis, of rights and benefits related to\nemployment, and for the purpose of the termination of the employment relationship.\n2.\nThose rules shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate\ninterests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data\nwithin a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems\nat the work place.\n3.\nEach Member State shall notify to the Commission those provisions of its law which it adopts pursuant to\nparagraph 1, by 25 May 2018 and, without delay, any subsequent amendment affecting them."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 89, "article_title": "Safeguards and derogations relating to processing for archiving purposes in the public interest,", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 89 – Safeguards and derogations relating to processing for archiving purposes in the public interest,\n\nscientific or historical research purposes or statistical purposes\n1.\nProcessing for archiving purposes in the public interest, scientific or historical research purposes or statistical\npurposes, shall be subject to appropriate safeguards, in accordance with this Regulation, for the rights and freedoms of\nthe data subject. Those safeguards shall ensure that technical and organisational measures are in place in particular in\n4.5.2016\nEN\norder to ensure respect for the principle of data minimisation. Those measures may include pseudonymisation provided\nthat those purposes can be fulfilled in that manner. Where those purposes can be fulfilled by further processing which\ndoes not permit or no longer permits the identification of data subjects, those purposes shall be fulfilled in that manner.\n2.\nWhere personal data are processed for scientific or historical research purposes or statistical purposes, Union or\nMember State law may provide for derogations from the rights referred to in Articles 15, 16, 18 and 21 subject to the\nconditions and safeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render\nimpossible or seriously impair the achievement of the specific purposes, and such derogations are necessary for the\nfulfilment of those purposes.\n3.\nWhere personal data are processed for archiving purposes in the public interest, Union or Member State law may\nprovide for derogations from the rights referred to in Articles 15, 16, 18, 19, 20 and 21 subject to the conditions and\nsafeguards referred to in paragraph 1 of this Article in so far as such rights are likely to render impossible or seriously\nimpair the achievement of the specific purposes, and such derogations are necessary for the fulfilment of those\npurposes.\n4.\nWhere processing referred to in paragraphs 2 and 3 serves at the same time another purpose, the derogations shall\napply only to processing for the purposes referred to in those paragraphs."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 90, "article_title": "Obligations of secrecy", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 90 – Obligations of secrecy\n\n1.\nMember States may adopt specific rules to set out the powers of the supervisory authorities laid down in points (e)\nand (f) of Article 58(1) in relation to controllers or processors that are subject, under Union or Member State law or\nrules established by national competent bodies, to an obligation of professional secrecy or other equivalent obligations\nof secrecy where this is necessary and proportionate to reconcile the right of the protection of personal data with the\nobligation of secrecy. Those rules shall apply only with regard to personal data which the controller or processor has\nreceived as a result of or has obtained in an activity covered by that obligation of secrecy.\n2.\nEach Member State shall notify to the Commission the rules adopted pursuant to paragraph 1, by 25 May 2018\nand, without delay, any subsequent amendment affecting them."}
{"source": "GDPR", "chapter": {"id": "IX", "title": "Provisions relating to specific processing situations"}, "section": null, "article_number": 91, "article_title": "Existing data protection rules of churches and religious associations", "content": "Source: GDPR\nChapter IX – Provisions relating to specific processing situations\nArticle 91 – Existing data protection rules of churches and religious associations\n\n1.\nWhere in a Member State, churches and religious associations or communities apply, at the time of entry into\nforce of this Regulation, comprehensive rules relating to the protection of natural persons with regard to processing,\nsuch rules may continue to apply, provided that they are brought into line with this Regulation.\n2.\nChurches and religious associations which apply comprehensive rules in accordance with paragraph 1 of this\nArticle shall be subject to the supervision of an independent supervisory authority, which may be specific, provided that\nit fulfils the conditions laid down in Chapter VI of this Regulation."}
{"source": "GDPR", "chapter": {"id": "X", "title": "Delegated acts and implementing acts"}, "section": null, "article_number": 92, "article_title": "Exercise of the delegation", "content": "Source: GDPR\nChapter X – Delegated acts and implementing acts\nArticle 92 – Exercise of the delegation\n\n1.\nThe power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this\nArticle.\n4.5.2016\nEN\n2.\nThe delegation of power referred to in Article 12(8) and Article 43(8) shall be conferred on the Commission for\nan indeterminate period of time from 24 May 2016.\n3.\nThe delegation of power referred to in Article 12(8) and Article 43(8) may be revoked at any time by the\nEuropean Parliament or by the Council. A decision of revocation shall put an end to the delegation of power specified in\na later date specified therein. It shall not affect the validity of any delegated acts already in force.\n4.\nAs soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and\nto the Council.\n5.\nA delegated act adopted pursuant to Article 12(8) and Article 43(8) shall enter into force only if no objection has\nbeen expressed by either the European Parliament or the Council within a period of three months of notification of that\nact to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the\nCouncil have both informed the Commission that they will not object. That period shall be extended by three months at\nthe initiative of the European Parliament or of the Council."}
{"source": "GDPR", "chapter": {"id": "X", "title": "Delegated acts and implementing acts"}, "section": null, "article_number": 93, "article_title": "Committee procedure", "content": "Source: GDPR\nChapter X – Delegated acts and implementing acts\nArticle 93 – Committee procedure\n\n1.\nThe Commission shall be assisted by a committee. That committee shall be a committee within the meaning of\nRegulation (EU) No 182/2011.\n2.\nWhere reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.\n3.\nWhere reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with\nArticle 5 thereof, shall apply."}
{"source": "GDPR", "chapter": {"id": "XI", "title": "Final provisions"}, "section": null, "article_number": 94, "article_title": "Repeal of Directive 95/46/EC", "content": "Source: GDPR\nChapter XI – Final provisions\nArticle 94 – Repeal of Directive 95/46/EC\n\n1.\nDirective 95/46/EC is repealed with effect from 25 May 2018.\n2.\nReferences to the repealed Directive shall be construed as references to this Regulation. References to the Working\nParty on the Protection of Individuals with regard to the Processing of Personal Data established by Article 29 of\nDirective 95/46/EC shall be construed as references to the European Data Protection Board established by this\nRegulation."}
{"source": "GDPR", "chapter": {"id": "XI", "title": "Final provisions"}, "section": null, "article_number": 95, "article_title": "Relationship with Directive 2002/58/EC", "content": "Source: GDPR\nChapter XI – Final provisions\nArticle 95 – Relationship with Directive 2002/58/EC\n\nThis Regulation shall not impose additional obligations on natural or legal persons in relation to processing in\nconnection with the provision of publicly available electronic communications services in public communication\nnetworks in the Union in relation to matters for which they are subject to specific obligations with the same objective\nset out in Directive 2002/58/EC.\n4.5.2016\nEN"}
{"source": "GDPR", "chapter": {"id": "XI", "title": "Final provisions"}, "section": null, "article_number": 96, "article_title": "Relationship with previously concluded Agreements", "content": "Source: GDPR\nChapter XI – Final provisions\nArticle 96 – Relationship with previously concluded Agreements\n\nInternational agreements involving the transfer of personal data to third countries or international organisations which\nwere concluded by Member States prior to 24 May 2016, and which comply with Union law as applicable prior to that\ndate, shall remain in force until amended, replaced or revoked."}
{"source": "GDPR", "chapter": {"id": "XI", "title": "Final provisions"}, "section": null, "article_number": 97, "article_title": "Commission reports", "content": "Source: GDPR\nChapter XI – Final provisions\nArticle 97 – Commission reports\n\n1.\nBy 25 May 2020 and every four years thereafter, the Commission shall submit a report on the evaluation and\nreview of this Regulation to the European Parliament and to the Council. The reports shall be made public.\n2.\nIn the context of the evaluations and reviews referred to in paragraph 1, the Commission shall examine, in\nparticular, the application and functioning of:\n(a) Chapter V on the transfer of personal data to third countries or international organisations with particular regard to\ndecisions adopted pursuant to Article 45(3) of this Regulation and decisions adopted on the basis of Article 25(6) of\nDirective 95/46/EC;\n(b) Chapter VII on cooperation and consistency.\n3.\nFor the purpose of paragraph 1, the Commission may request information from Member States and supervisory\nauthorities.\n4.\nIn carrying out the evaluations and reviews referred to in paragraphs 1 and 2, the Commission shall take into\naccount the positions and findings of the European Parliament, of the Council, and of other relevant bodies or sources.\n5.\nThe Commission shall, if necessary, submit appropriate proposals to amend this Regulation, in particular taking\ninto account of developments in information technology and in the light of the state of progress in the information\nsociety."}
{"source": "GDPR", "chapter": {"id": "XI", "title": "Final provisions"}, "section": null, "article_number": 98, "article_title": "Review of other Union legal acts on data protection", "content": "Source: GDPR\nChapter XI – Final provisions\nArticle 98 – Review of other Union legal acts on data protection\n\nThe Commission shall, if appropriate, submit legislative proposals with a view to amending other Union legal acts on\nthe protection of personal data, in order to ensure uniform and consistent protection of natural persons with regard to\nprocessing. This shall in particular concern the rules relating to the protection of natural persons with regard to\nprocessing by Union institutions, bodies, offices and agencies and on the free movement of such data."}
{"source": "GDPR", "chapter": {"id": "XI", "title": "Final provisions"}, "section": null, "article_number": 99, "article_title": "Entry into force and application", "content": "Source: GDPR\nChapter XI – Final provisions\nArticle 99 – Entry into force and application\n\n1.\nthe European Union.\n2.\nIt shall apply from 25 May 2018.\n4.5.2016\nEN\nThis Regulation shall be binding in its entirety and directly applicable in all Member States.\nDone at Brussels, 27 April 2016.\nFor the European Parliament\nThe President\nM. SCHULZ\nFor the Council\nThe President\nJ.A. HENNIS-PLASSCHAERT\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 1, "article_title": "Subject-matter and objectives", "content": "Source: LED\nChapter I – General provisions\nArticle 1 – Subject-matter and objectives\n\n1.\nThis Directive lays down the rules relating to the protection of natural persons with regard to the processing of\npersonal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of\ncriminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats\nto public security.\n2.\nIn accordance with this Directive, Member States shall:\n(a) protect the fundamental rights and freedoms of natural persons and in particular their right to the protection of\npersonal data; and\n(b) ensure that the exchange of personal data by competent authorities within the Union, where such exchange is\nrequired by Union or Member State law, is neither restricted nor prohibited for reasons connected with the\nprotection of natural persons with regard to the processing of personal data.\n4.5.2016\nEN\n(1) OJ L 53, 27.2.2008, p. 52.\n(2) OJ L 160, 18.6.2011, p. 21.\n(3) OJ C 192, 30.6.2012, p. 7.\n3.\nThis Directive shall not preclude Member States from providing higher safeguards than those established in this\nDirective for the protection of the rights and freedoms of the data subject with regard to the processing of personal data\nby competent authorities."}
{"source": "LED", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 2, "article_title": "Scope", "content": "Source: LED\nChapter I – General provisions\nArticle 2 – Scope\n\n1.\nThis Directive applies to the processing of personal data by competent authorities for the purposes set out in\nArticle 1(1).\n2.\nThis Directive applies to the processing of personal data wholly or partly by automated means, and to the\nprocessing other than by automated means of personal data which form part of a filing system or are intended to form\npart of a filing system.\n3.\nThis Directive does not apply to the processing of personal data:\n(a) in the course of an activity which falls outside the scope of Union law;\n(b) by the Union institutions, bodies, offices and agencies."}
{"source": "LED", "chapter": {"id": "I", "title": "General provisions"}, "section": null, "article_number": 3, "article_title": "Definitions", "content": "Source: LED\nChapter I – General provisions\nArticle 3 – Definitions\n\nFor the purposes of this Directive:\n(1) ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an\nidentifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an\nidentifier such as a name, an identification number, location data, an online identifier or to one or more factors\nspecific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;\n(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal\ndata, whether or not by automated means, such as collection, recording, organisation, structuring, storage,\nadaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making\navailable, alignment or combination, restriction, erasure or destruction;\n(3) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in\nthe future;\n(4) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to\nevaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning\nthat natural person's performance at work, economic situation, health, personal preferences, interests, reliability,\nbehaviour, location or movements;\n(5) ‘pseudonymisation’ means the processing of personal data in such a manner that the personal data can no longer\nbe attributed to a specific data subject without the use of additional information, provided that such additional\ninformation is kept separately and is subject to technical and organisational measures to ensure that the personal\ndata are not attributed to an identified or identifiable natural person;\n(6) ‘filing system’ means any structured set of personal data which are accessible according to specific criteria, whether\ncentralised, decentralised or dispersed on a functional or geographical basis;\n(7) ‘competent authority’ means:\n(a) any public authority competent for the prevention, investigation, detection or prosecution of criminal offences\nor the execution of criminal penalties, including the safeguarding against and the prevention of threats to\npublic security; or\n(b) any other body or entity entrusted by Member State law to exercise public authority and public powers for the\npurposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of\ncriminal penalties, including the safeguarding against and the prevention of threats to public security;\n4.5.2016\nEN\n(8) ‘controller’ means the competent authority which, alone or jointly with others, determines the purposes and means\nof the processing of personal data; where the purposes and means of such processing are determined by Union or\nMember State law, the controller or the specific criteria for its nomination may be provided for by Union or\nMember State law;\n(9) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data\non behalf of the controller;\n(10) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are\ndisclosed, whether a third party or not. However, public authorities which may receive personal data in the\nframework of a particular inquiry in accordance with Member State law shall not be regarded as recipients; the\nprocessing of those data by those public authorities shall be in compliance with the applicable data protection\nrules according to the purposes of the processing;\n(11) ‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration,\nunauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;\n(12) ‘genetic data’ means personal data, relating to the inherited or acquired genetic characteristics of a natural person\nwhich give unique information about the physiology or the health of that natural person and which result, in\nparticular, from an analysis of a biological sample from the natural person in question;\n(13) ‘biometric data’ means personal data resulting from specific technical processing relating to the physical, physio­\nlogical or behavioural characteristics of a natural person, which allow or confirm the unique identification of that\nnatural person, such as facial images or dactyloscopic data;\n(14) ‘data concerning health’ means personal data related to the physical or mental health of a natural person, including\nthe provision of health care services, which reveal information about his or her health status;\n(15) ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to\nArticle 41;\n(16) ‘international organisation’ means an organisation and its subordinate bodies governed by public international law,\nor any other body which is set up by, or on the basis of, an agreement between two or more countries."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 4, "article_title": "Principles relating to processing of personal data", "content": "Source: LED\nChapter II – Principles\nArticle 4 – Principles relating to processing of personal data\n\n1.\nMember States shall provide for personal data to be:\n(a) processed lawfully and fairly;\n(b) collected for specified, explicit and legitimate purposes and not processed in a manner that is incompatible with\nthose purposes;\n(c) adequate, relevant and not excessive in relation to the purposes for which they are processed;\n(d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that\nare inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;\n(e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for\nwhich they are processed;\n(f) processed in a manner that ensures appropriate security of the personal data, including protection against\nunauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical\nor organisational measures.\n4.5.2016\nEN\n2.\nProcessing by the same or another controller for any of the purposes set out in Article 1(1) other than that for\nwhich the personal data are collected shall be permitted in so far as:\n(a) the controller is authorised to process such personal data for such a purpose in accordance with Union or Member\nState law; and\n(b) processing is necessary and proportionate to that other purpose in accordance with Union or Member State law.\n3.\nProcessing by the same or another controller may include archiving in the public interest, scientific, statistical or\nhistorical use, for the purposes set out in Article 1(1), subject to appropriate safeguards for the rights and freedoms of\ndata subjects.\n4.\nThe controller shall be responsible for, and be able to demonstrate compliance with, paragraphs 1, 2 and 3."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 5, "article_title": "Time-limits for storage and review", "content": "Source: LED\nChapter II – Principles\nArticle 5 – Time-limits for storage and review\n\nMember States shall provide for appropriate time limits to be established for the erasure of personal data or for a\nperiodic review of the need for the storage of personal data. Procedural measures shall ensure that those time limits are\nobserved."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 6, "article_title": "Distinction between different categories of data subject", "content": "Source: LED\nChapter II – Principles\nArticle 6 – Distinction between different categories of data subject\n\nMember States shall provide for the controller, where applicable and as far as possible, to make a clear distinction\nbetween personal data of different categories of data subjects, such as:\n(a) persons with regard to whom there are serious grounds for believing that they have committed or are about to\ncommit a criminal offence;\n(b) persons convicted of a criminal offence;\n(c) victims of a criminal offence or persons with regard to whom certain facts give rise to reasons for believing that he\nor she could be the victim of a criminal offence; and\n(d) other parties to a criminal offence, such as persons who might be called on to testify in investigations in connection\nwith criminal offences or subsequent criminal proceedings, persons who can provide information on criminal\noffences, or contacts or associates of one of the persons referred to in points (a) and (b)."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 7, "article_title": "Distinction between personal data and verification of quality of personal data", "content": "Source: LED\nChapter II – Principles\nArticle 7 – Distinction between personal data and verification of quality of personal data\n\n1.\nMember States shall provide for personal data based on facts to be distinguished, as far as possible, from personal\ndata based on personal assessments.\n2.\nMember States shall provide for the competent authorities to take all reasonable steps to ensure that personal data\nwhich are inaccurate, incomplete or no longer up to date are not transmitted or made available. To that end, each\ncompetent authority shall, as far as practicable, verify the quality of personal data before they are transmitted or made\navailable. As far as possible, in all transmissions of personal data, necessary information enabling the receiving\ncompetent authority to assess the degree of accuracy, completeness and reliability of personal data, and the extent to\nwhich they are up to date shall be added.\n3.\nIf it emerges that incorrect personal data have been transmitted or personal data have been unlawfully transmitted,\nthe recipient shall be notified without delay. In such a case, the personal data shall be rectified or erased or processing\nshall be restricted in accordance with Article 16.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 8, "article_title": "Lawfulness of processing", "content": "Source: LED\nChapter II – Principles\nArticle 8 – Lawfulness of processing\n\n1.\nMember States shall provide for processing to be lawful only if and to the extent that processing is necessary for\nthe performance of a task carried out by a competent authority for the purposes set out in Article 1(1) and that it is\nbased on Union or Member State law.\n2.\nMember State law regulating processing within the scope of this Directive shall specify at least the objectives of\nprocessing, the personal data to be processed and the purposes of the processing."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 9, "article_title": "Specific processing conditions", "content": "Source: LED\nChapter II – Principles\nArticle 9 – Specific processing conditions\n\n1.\nPersonal data collected by competent authorities for the purposes set out in Article 1(1) shall not be processed for\npurposes other than those set out in Article 1(1) unless such processing is authorised by Union or Member State law.\nWhere personal data are processed for such other purposes, Regulation (EU) 2016/679 shall apply unless the processing\nis carried out in an activity which falls outside the scope of Union law.\n2.\nWhere competent authorities are entrusted by Member State law with the performance of tasks other than those\nperformed for the purposes set out in Article 1(1), Regulation (EU) 2016/679 shall apply to processing for such\npurposes, including for archiving purposes in the public interest, scientific or historical research purposes or statistical\npurposes, unless the processing is carried out in an activity which falls outside the scope of Union law.\n3.\nMember States shall, where Union or Member State law applicable to the transmitting competent authority\nprovides specific conditions for processing, provide for the transmitting competent authority to inform the recipient of\nsuch personal data of those conditions and the requirement to comply with them.\n4.\nMember States shall provide for the transmitting competent authority not to apply conditions pursuant to\nparagraph 3 to recipients in other Member States or to agencies, offices and bodies established pursuant to Chapters 4\nand 5 of Title V of the TFEU other than those applicable to similar transmissions of data within the Member State of the\ntransmitting competent authority."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 10, "article_title": "Processing of special categories of personal data", "content": "Source: LED\nChapter II – Principles\nArticle 10 – Processing of special categories of personal data\n\nProcessing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade\nunion membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural\nperson, data concerning health or data concerning a natural person's sex life or sexual orientation shall be allowed only\nwhere strictly necessary, subject to appropriate safeguards for the rights and freedoms of the data subject, and only:\n(a) where authorised by Union or Member State law;\n(b) to protect the vital interests of the data subject or of another natural person; or\n(c) where such processing relates to data which are manifestly made public by the data subject."}
{"source": "LED", "chapter": {"id": "II", "title": "Principles"}, "section": null, "article_number": 11, "article_title": "Automated individual decision-making", "content": "Source: LED\nChapter II – Principles\nArticle 11 – Automated individual decision-making\n\n1.\nMember States shall provide for a decision based solely on automated processing, including profiling, which\nproduces an adverse legal effect concerning the data subject or significantly affects him or her, to be prohibited unless\nauthorised by Union or Member State law to which the controller is subject and which provides appropriate safeguards\nfor the rights and freedoms of the data subject, at least the right to obtain human intervention on the part of the\ncontroller.\n4.5.2016\nEN\n2.\nDecisions referred to in paragraph 1 of this Article shall not be based on special categories of personal data\nreferred to in Article 10, unless suitable measures to safeguard the data subject's rights and freedoms and legitimate\ninterests are in place.\n3.\nProfiling that results in discrimination against natural persons on the basis of special categories of personal data\nreferred to in Article 10 shall be prohibited, in accordance with Union law."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 12, "article_title": "Communication and modalities for exercising the rights of the data subject", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 12 – Communication and modalities for exercising the rights of the data subject\n\n1.\nMember States shall provide for the controller to take reasonable steps to provide any information referred to in\nArticle 13 and make any communication with regard to Articles 11, 14 to 18 and 31 relating to processing to the data\nsubject in a concise, intelligible and easily accessible form, using clear and plain language. The information shall be\nprovided by any appropriate means, including by electronic means. As a general rule, the controller shall provide the\ninformation in the same form as the request.\n2.\nMember States shall provide for the controller to facilitate the exercise of the rights of the data subject under\nArticles 11 and 14 to 18.\n3.\nMember States shall provide for the controller to inform the data subject in writing about the follow up to his or\nher request without undue delay.\n4.\nMember States shall provide for the information provided under Article 13 and any communication made or\naction taken pursuant to Articles 11, 14 to 18 and 31 to be provided free of charge. Where requests from a data subject\nare manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:\n(a) charge a reasonable fee, taking into account the administrative costs of providing the information or communication\nor taking the action requested; or\n(b) refuse to act on the request.\nThe controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.\n5.\nWhere the controller has reasonable doubts concerning the identity of the natural person making a request\nreferred to in Article 14 or 16, the controller may request the provision of additional information necessary to confirm\nthe identity of the data subject."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 13, "article_title": "Information to be made available or given to the data subject", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 13 – Information to be made available or given to the data subject\n\n1.\nMember States shall provide for the controller to make available to the data subject at least the following\ninformation:\n(a) the identity and the contact details of the controller;\n(b) the contact details of the data protection officer, where applicable;\n(c) the purposes of the processing for which the personal data are intended;\n(d) the right to lodge a complaint with a supervisory authority and the contact details of the supervisory authority;\n(e) the existence of the right to request from the controller access to and rectification or erasure of personal data and\nrestriction of processing of the personal data concerning the data subject.\n2.\nIn addition to the information referred to in paragraph 1, Member States shall provide by law for the controller to\ngive to the data subject, in specific cases, the following further information to enable the exercise of his or her rights:\n(a) the legal basis for the processing;\n(b) the period for which the personal data will be stored, or, where that is not possible, the criteria used to determine\nthat period;\n4.5.2016\nEN\n(c) where applicable, the categories of recipients of the personal data, including in third countries or international\norganisations;\n(d) where necessary, further information, in particular where the personal data are collected without the knowledge of\nthe data subject.\n3.\nMember States may adopt legislative measures delaying, restricting or omitting the provision of the information to\nthe data subject pursuant to paragraph 2 to the extent that, and for as long as, such a measure constitutes a necessary\nand proportionate measure in a democratic society with due regard for the fundamental rights and the legitimate\ninterests of the natural person concerned, in order to:\n(a) avoid obstructing official or legal inquiries, investigations or procedures;\n(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of\ncriminal penalties;\n(c) protect public security;\n(d) protect national security;\n(e) protect the rights and freedoms of others.\n4.\nMember States may adopt legislative measures in order to determine categories of processing which may wholly or\npartly fall under any of the points listed in paragraph 3."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 14, "article_title": "Right of access by the data subject", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 14 – Right of access by the data subject\n\nSubject to Article 15, Member States shall provide for the right of the data subject to obtain from the controller\nconfirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case,\naccess to the personal data and the following information:\n(a) the purposes of and legal basis for the processing;\n(b) the categories of personal data concerned;\n(c) the recipients or categories of recipients to whom the personal data have been disclosed, in particular recipients in\nthird countries or international organisations;\n(d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used\nto determine that period;\n(e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of\nprocessing of personal data concerning the data subject;\n(f) the right to lodge a complaint with the supervisory authority and the contact details of the supervisory authority;\n(g) communication of the personal data undergoing processing and of any available information as to their origin."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 15, "article_title": "Limitations to the right of access", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 15 – Limitations to the right of access\n\n1.\nMember States may adopt legislative measures restricting, wholly or partly, the data subject's right of access to the\nextent that, and for as long as such a partial or complete restriction constitutes a necessary and proportionate measure\nin a democratic society with due regard for the fundamental rights and legitimate interests of the natural person\nconcerned, in order to:\n(a) avoid obstructing official or legal inquiries, investigations or procedures;\n(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of\ncriminal penalties;\n(c) protect public security;\n4.5.2016\nEN\n(d) protect national security;\n(e) protect the rights and freedoms of others.\n2.\nMember States may adopt legislative measures in order to determine categories of processing which may wholly or\npartly fall under points (a) to (e) of paragraph 1.\n3.\nIn the cases referred to in paragraphs 1 and 2, Member States shall provide for the controller to inform the data\nsubject, without undue delay, in writing of any refusal or restriction of access and of the reasons for the refusal or the\nrestriction. Such information may be omitted where the provision thereof would undermine a purpose under\nparagraph 1. Member States shall provide for the controller to inform the data subject of the possibility of lodging a\ncomplaint with a supervisory authority or seeking a judicial remedy.\n4.\nMember States shall provide for the controller to document the factual or legal reasons on which the decision is\nbased. That information shall be made available to the supervisory authorities."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 16, "article_title": "Right to rectification or erasure of personal data and restriction of processing", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 16 – Right to rectification or erasure of personal data and restriction of processing\n\n1.\nMember States shall provide for the right of the data subject to obtain from the controller without undue delay the\nrectification of inaccurate personal data relating to him or her. Taking into account the purposes of the processing,\nMember States shall provide for the data subject to have the right to have incomplete personal data completed, including\nby means of providing a supplementary statement.\n2.\nMember States shall require the controller to erase personal data without undue delay and provide for the right of\nthe data subject to obtain from the controller the erasure of personal data concerning him or her without undue delay\nwhere processing infringes the provisions adopted pursuant to Article 4, 8 or 10, or where personal data must be erased\nin order to comply with a legal obligation to which the controller is subject.\n3.\nInstead of erasure, the controller shall restrict processing where:\n(a) the accuracy of the personal data is contested by the data subject and their accuracy or inaccuracy cannot be\nascertained; or\n(b) the personal data must be maintained for the purposes of evidence.\nWhere processing is restricted pursuant to point (a) of the first subparagraph, the controller shall inform the data subject\nbefore lifting the restriction of processing.\n4.\nMember States shall provide for the controller to inform the data subject in writing of any refusal of rectification\nor erasure of personal data or restriction of processing and of the reasons for the refusal. Member States may adopt\nlegislative measures restricting, wholly or partly, the obligation to provide such information to the extent that such a\nrestriction constitutes a necessary and proportionate measure in a democratic society with due regard for the\nfundamental rights and legitimate interests of the natural person concerned in order to:\n(a) avoid obstructing official or legal inquiries, investigations or procedures;\n(b) avoid prejudicing the prevention, detection, investigation or prosecution of criminal offences or the execution of\ncriminal penalties;\n(c) protect public security;\n(d) protect national security;\n(e) protect the rights and freedoms of others.\nMember States shall provide for the controller to inform the data subject of the possibility of lodging a complaint with a\nsupervisory authority or seeking a judicial remedy.\n4.5.2016\nEN\n5.\nMember States shall provide for the controller to communicate the rectification of inaccurate personal data to the\ncompetent authority from which the inaccurate personal data originate.\n6.\nMember States shall, where personal data has been rectified or erased or processing has been restricted pursuant to\nparagraphs 1, 2 and 3, provide for the controller to notify the recipients and that the recipients shall rectify or erase the\npersonal data or restrict processing of the personal data under their responsibility."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 17, "article_title": "Exercise of rights by the data subject and verification by the supervisory authority", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 17 – Exercise of rights by the data subject and verification by the supervisory authority\n\n1.\nIn the cases referred to in Article 13(3), Article 15(3) and Article 16(4) Member States shall adopt measures\nproviding that the rights of the data subject may also be exercised through the competent supervisory authority.\n2.\nMember States shall provide for the controller to inform the data subject of the possibility of exercising his or her\nrights through the supervisory authority pursuant to paragraph 1.\n3.\nWhere the right referred to in paragraph 1 is exercised, the supervisory authority shall inform the data subject at\nleast that all necessary verifications or a review by the supervisory authority have taken place. The supervisory authority\nshall also inform the data subject of his or her right to seek a judicial remedy."}
{"source": "LED", "chapter": {"id": "III", "title": "Rights of the data subject"}, "section": null, "article_number": 18, "article_title": "Rights of the data subject in criminal investigations and proceedings", "content": "Source: LED\nChapter III – Rights of the data subject\nArticle 18 – Rights of the data subject in criminal investigations and proceedings\n\nMember States may provide for the exercise of the rights referred to in Articles 13, 14 and 16 to be carried out in\naccordance with Member State law where the personal data are contained in a judicial decision or record or case file\nprocessed in the course of criminal investigations and proceedings."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 19, "article_title": "Obligations of the controller", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 19 – Obligations of the controller\n\n1.\nMember States shall provide for the controller, taking into account the nature, scope, context and purposes of\nprocessing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, to\nimplement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is\nperformed in accordance with this Directive. Those measures shall be reviewed and updated where necessary.\n2.\nWhere proportionate in relation to the processing activities, the measures referred to in paragraph 1 shall include\nthe implementation of appropriate data protection policies by the controller."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 20, "article_title": "Data protection by design and by default", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 20 – Data protection by design and by default\n\n1.\nMember States shall provide for the controller, taking into account the state of the art, the cost of implementation\nand the nature, scope, context and purposes of processing, as well as the risks of varying likelihood and severity for\nrights and freedoms of natural persons posed by the processing, both at the time of the determination of the means for\nprocessing and at the time of the processing itself, to implement appropriate technical and organisational measures, such\nas pseudonymisation, which are designed to implement data protection principles, such as data minimisation, in an\neffective manner and to integrate the necessary safeguards into the processing, in order to meet the requirements of this\nDirective and protect the rights of data subjects.\n4.5.2016\nEN\n2.\nMember States shall provide for the controller to implement appropriate technical and organisational measures\nensuring that, by default, only personal data which are necessary for each specific purpose of the processing are\nprocessed. That obligation applies to the amount of personal data collected, the extent of their processing, the period of\ntheir storage and their accessibility. In particular, such measures shall ensure that by default personal data are not made\naccessible without the individual's intervention to an indefinite number of natural persons."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 21, "article_title": "Joint controllers", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 21 – Joint controllers\n\n1.\nMember States shall, where two or more controllers jointly determine the purposes and means of processing,\nprovide for them to be joint controllers. They shall, in a transparent manner, determine their respective responsibilities\nfor compliance with this Directive, in particular as regards the exercise of the rights of the data subject and their\nrespective duties to provide the information referred to in Article 13, by means of an arrangement between them unless,\nand in so far as, the respective responsibilities of the controllers are determined by Union or Member State law to which\nthe controllers are subject. The arrangement shall designate the contact point for data subjects. Member States may\ndesignate which of the joint controllers can act as a single contact point for data subjects to exercise their rights.\n2.\nIrrespective of the terms of the arrangement referred to in paragraph 1, Member States may provide for the data\nsubject to exercise his or her rights under the provisions adopted pursuant to this Directive in respect of and against\neach of the controllers."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 22, "article_title": "Processor", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 22 – Processor\n\n1.\nMember States shall, where processing is to be carried out on behalf of a controller, provide for the controller to\nuse only processors providing sufficient guarantees to implement appropriate technical and organisational measures in\nsuch a manner that the processing will meet the requirements of this Directive and ensure the protection of the rights of\nthe data subject.\n2.\nMember States shall provide for the processor not to engage another processor without prior specific or general\nwritten authorisation by the controller. In the case of general written authorisation, the processor shall inform the\ncontroller of any intended changes concerning the addition or replacement of other processors, thereby giving the\ncontroller the opportunity to object to such changes.\n3.\nMember States shall provide for the processing by a processor to be governed by a contract or other legal act\nunder Union or Member State law, that is binding on the processor with regard to the controller and that sets out the\nsubject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and\ncategories of data subjects and the obligations and rights of the controller. That contract or other legal act shall stipulate,\nin particular, that the processor:\n(a) acts only on instructions from the controller;\n(b) ensures that persons authorised to process the personal data have committed themselves to confidentiality or are\nunder an appropriate statutory obligation of confidentiality;\n(c) assists the controller by any appropriate means to ensure compliance with the provisions on the data subject's\nrights;\n(d) at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision\nof data processing services, and deletes existing copies unless Union or Member State law requires storage of the\npersonal data;\n4.5.2016\nEN\n(e) makes available to the controller all information necessary to demonstrate compliance with this Article;\n(f) complies with the conditions referred to in paragraphs 2 and 3 for engaging another processor.\n4.\nThe contract or the other legal act referred to in paragraph 3 shall be in writing, including in an electronic form.\n5.\nIf a processor determines, in infringement of this Directive, the purposes and means of processing, that processor\nshall be considered to be a controller in respect of that processing."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 23, "article_title": "Processing under the authority of the controller or processor", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 23 – Processing under the authority of the controller or processor\n\nMember States shall provide for the processor and any person acting under the authority of the controller or of the\nprocessor, who has access to personal data, not to process those data except on instructions from the controller, unless\nrequired to do so by Union or Member State law."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 24, "article_title": "Records of processing activities", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 24 – Records of processing activities\n\n1.\nMember States shall provide for controllers to maintain a record of all categories of processing activities under\ntheir responsibility. That record shall contain all of the following information:\n(a) the name and contact details of the controller and, where applicable, the joint controller and the data protection\nofficer;\n(b) the purposes of the processing;\n(c) the categories of recipients to whom the personal data have been or will be disclosed including recipients in third\ncountries or international organisations;\n(d) a description of the categories of data subject and of the categories of personal data;\n(e) where applicable, the use of profiling;\n(f) where applicable, the categories of transfers of personal data to a third country or an international organisation;\n(g) an indication of the legal basis for the processing operation, including transfers, for which the personal data are\nintended;\n(h) where possible, the envisaged time limits for erasure of the different categories of personal data;\n(i) where possible, a general description of the technical and organisational security measures referred to in\nArticle 29(1).\n2.\nMember States shall provide for each processor to maintain a record of all categories of processing activities\ncarried out on behalf of a controller, containing:\n(a) the name and contact details of the processor or processors, of each controller on behalf of which the processor is\nacting and, where applicable, the data protection officer;\n(b) the categories of processing carried out on behalf of each controller;\n(c) where applicable, transfers of personal data to a third country or an international organisation where explicitly\ninstructed to do so by the controller, including the identification of that third country or international organisation;\n(d) where possible, a general description of the technical and organisational security measures referred to in\nArticle 29(1).\n4.5.2016\nEN\n3.\nThe records referred to in paragraphs 1 and 2 shall be in writing, including in electronic form.\nThe controller and the processor shall make those records available to the supervisory authority on request."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 25, "article_title": "Logging", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 25 – Logging\n\n1.\nMember States shall provide for logs to be kept for at least the following processing operations in automated\nprocessing systems: collection, alteration, consultation, disclosure including transfers, combination and erasure. The logs\nof consultation and disclosure shall make it possible to establish the justification, date and time of such operations and,\nas far as possible, the identification of the person who consulted or disclosed personal data, and the identity of the\nrecipients of such personal data.\n2.\nThe logs shall be used solely for verification of the lawfulness of processing, self-monitoring, ensuring the integrity\nand security of the personal data, and for criminal proceedings.\n3.\nThe controller and the processor shall make the logs available to the supervisory authority on request."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 26, "article_title": "Cooperation with the supervisory authority", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 26 – Cooperation with the supervisory authority\n\nMember States shall provide for the controller and the processor to cooperate, on request, with the supervisory\nauthority in the performance of its tasks on request."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 27, "article_title": "Data protection impact assessment", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 27 – Data protection impact assessment\n\n1.\nWhere a type of processing, in particular, using new technologies, and taking into account the nature, scope,\ncontext and purposes of the processing is likely to result in a high risk to the rights and freedoms of natural persons,\nMember States shall provide for the controller to carry out, prior to the processing, an assessment of the impact of the\nenvisaged processing operations on the protection of personal data.\n2.\nThe assessment referred to in paragraph 1 shall contain at least a general description of the envisaged processing\noperations, an assessment of the risks to the rights and freedoms of data subjects, the measures envisaged to address\nthose risks, safeguards, security measures and mechanisms to ensure the protection of personal data and to demonstrate\ncompliance with this Directive, taking into account the rights and legitimate interests of the data subjects and other\npersons concerned."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "1", "title": "General obligations"}, "article_number": 28, "article_title": "Prior consultation of the supervisory authority", "content": "Source: LED\nChapter IV – Controller and processor\nSection 1 – General obligations\nArticle 28 – Prior consultation of the supervisory authority\n\n1.\nMember States shall provide for the controller or processor to consult the supervisory authority prior to\nprocessing which will form part of a new filing system to be created, where:\n(a) a data protection impact assessment as provided for in Article 27 indicates that the processing would result in a\nhigh risk in the absence of measures taken by the controller to mitigate the risk; or\n(b) the type of processing, in particular, where using new technologies, mechanisms or procedures, involves a high risk\nto the rights and freedoms of data subjects.\n2.\nMember States shall provide for the supervisory authority to be consulted during the preparation of a proposal for\na legislative measure to be adopted by a national parliament or of a regulatory measure based on such a legislative\nmeasure, which relates to processing.\n3.\nMember States shall provide that the supervisory authority may establish a list of the processing operations which\nare subject to prior consultation pursuant to paragraph 1.\n4.5.2016\nEN\n4.\nMember States shall provide for the controller to provide the supervisory authority with the data protection\nimpact assessment pursuant to Article 27 and, on request, with any other information to allow the supervisory\nauthority to make an assessment of the compliance of the processing and in particular of the risks for the protection of\npersonal data of the data subject and of the related safeguards.\n5.\nMember States shall, where the supervisory authority is of the opinion that the intended processing referred to in\nparagraph 1 of this Article would infringe the provisions adopted pursuant to this Directive, in particular where the\ncontroller has insufficiently identified or mitigated the risk, provide for the supervisory authority to provide, within a\nperiod of up to six weeks of receipt of the request for consultation, written advice to the controller and, where\napplicable, to the processor, and may use any of its powers referred to in Article 47. That period may be extended by a\nmonth, taking into account the complexity of the intended processing. The supervisory authority shall inform the\ncontroller and, where applicable, the processor of any such extension within one month of receipt of the request for\nconsultation, together with the reasons for the delay."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "2", "title": "Security of personal data"}, "article_number": 29, "article_title": "Security of processing", "content": "Source: LED\nChapter IV – Controller and processor\nSection 2 – Security of personal data\nArticle 29 – Security of processing\n\n1.\nMember States shall provide for the controller and the processor, taking into account the state of the art, the costs\nof implementation and the nature, scope, context and purposes of the processing as well as the risk of varying\nlikelihood and severity for the rights and freedoms of natural persons, to implement appropriate technical and organis­\national measures to ensure a level of security appropriate to the risk, in particular as regards the processing of special\ncategories of personal data referred to in Article 10.\n2.\nIn respect of automated processing, each Member State shall provide for the controller or processor, following an\nevaluation of the risks, to implement measures designed to:\n(a) deny unauthorised persons access to processing equipment used for processing (‘equipment access control’);\n(b) prevent the unauthorised reading, copying, modification or removal of data media (‘data media control’);\n(c) prevent the unauthorised input of personal data and the unauthorised inspection, modification or deletion of stored\npersonal data (‘storage control’);\n(d) prevent the use of automated processing systems by unauthorised persons using data communication equipment\n(‘user control’);\n(e) ensure that persons authorised to use an automated processing system have access only to the personal data covered\nby their access authorisation (‘data access control’);\n(f) ensure that it is possible to verify and establish the bodies to which personal data have been or may be transmitted\nor made available using data communication equipment (‘communication control’);\n(g) ensure that it is subsequently possible to verify and establish which personal data have been input into automated\nprocessing systems and when and by whom the personal data were input (‘input control’);\n(h) prevent the unauthorised reading, copying, modification or deletion of personal data during transfers of personal\ndata or during transportation of data media (‘transport control’);\n(i) ensure that installed systems may, in the case of interruption, be restored (‘recovery’);\n(j) ensure that the functions of the system perform, that the appearance of faults in the functions is reported\n(‘reliability’) and that stored personal data cannot be corrupted by means of a malfunctioning of the system\n(‘integrity’).\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "2", "title": "Security of personal data"}, "article_number": 30, "article_title": "Notification of a personal data breach to the supervisory authority", "content": "Source: LED\nChapter IV – Controller and processor\nSection 2 – Security of personal data\nArticle 30 – Notification of a personal data breach to the supervisory authority\n\n1.\nMember States shall, in the case of a personal data breach, provide for the controller to notify without undue delay\nand, where feasible, not later than 72 hours after having become aware of it, the personal data breach to the supervisory\nauthority, unless the personal data breach is unlikely to result in a risk to the rights and freedoms of natural persons.\nWhere the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for\nthe delay.\n2.\nThe processor shall notify the controller without undue delay after becoming aware of a personal data breach.\n3.\nThe notification referred to in paragraph 1 shall at least:\n(a) describe the nature of the personal data breach including, where possible, the categories and approximate number of\ndata subjects concerned and the categories and approximate number of personal data records concerned;\n(b) communicate the name and contact details of the data protection officer or other contact point where more\ninformation can be obtained;\n(c) describe the likely consequences of the personal data breach;\n(d) describe the measures taken or proposed to be taken by the controller to address the personal data breach,\nincluding, where appropriate, measures to mitigate its possible adverse effects.\n4.\nWhere, and in so far as, it is not possible to provide the information at the same time, the information may be\nprovided in phases without undue further delay.\n5.\nMember States shall provide for the controller to document any personal data breaches referred to in paragraph 1,\ncomprising the facts relating to the personal data breach, its effects and the remedial action taken. That documentation\nshall enable the supervisory authority to verify compliance with this Article.\n6.\nMember States shall, where the personal data breach involves personal data that have been transmitted by or to the\ncontroller of another Member State, provide for the information referred to in paragraph 3 to be communicated to the\ncontroller of that Member State without undue delay."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "2", "title": "Security of personal data"}, "article_number": 31, "article_title": "Communication of a personal data breach to the data subject", "content": "Source: LED\nChapter IV – Controller and processor\nSection 2 – Security of personal data\nArticle 31 – Communication of a personal data breach to the data subject\n\n1.\nMember States shall, where the personal data breach is likely to result in a high risk to the rights and freedoms of\nnatural persons, provide for the controller to communicate the personal data breach to the data subject without undue\ndelay.\n2.\nThe communication to the data subject referred to in paragraph 1 of this Article shall describe in clear and plain\nlanguage the nature of the personal data breach and shall contain at least the information and measures referred to in\npoints (b), (c) and (d) of Article 30(3).\n3.\nThe communication to the data subject referred to in paragraph 1 shall not be required if any of the following\nconditions are met:\n(a) the controller has implemented appropriate technological and organisational protection measures, and those\nmeasures were applied to the personal data affected by the personal data breach, in particular those that render the\npersonal data unintelligible to any person who is not authorised to access it, such as encryption;\n(b) the controller has taken subsequent measures which ensure that the high risk to the rights and freedoms of data\nsubjects referred to in paragraph 1 is no longer likely to materialise;\n(c) it would involve a disproportionate effort. In such a case, there shall instead be a public communication or a similar\nmeasure whereby the data subjects are informed in an equally effective manner.\n4.5.2016\nEN\n4.\nIf the controller has not already communicated the personal data breach to the data subject, the supervisory\nauthority, having considered the likelihood of the personal data breach resulting in a high risk, may require it to do so,\nor may decide that any of the conditions referred to in paragraph 3 are met.\n5.\nThe communication to the data subject referred to in paragraph 1 of this Article may be delayed, restricted or\nomitted subject to the conditions and on the grounds referred to in Article 13(3)."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "3", "title": "Data protection off icer"}, "article_number": 32, "article_title": "Designation of the data protection officer", "content": "Source: LED\nChapter IV – Controller and processor\nSection 3 – Data protection off icer\nArticle 32 – Designation of the data protection officer\n\n1.\nMember States shall provide for the controller to designate a data protection officer. Member States may exempt\ncourts and other independent judicial authorities when acting in their judicial capacity from that obligation.\n2.\nThe data protection officer shall be designated on the basis of his or her professional qualities and, in particular,\nhis or her expert knowledge of data protection law and practice and ability to fulfil the tasks referred to in Article 34.\n3.\nA single data protection officer may be designated for several competent authorities, taking account of their\norganisational structure and size.\n4.\nMember States shall provide for the controller to publish the contact details of the data protection officer and\ncommunicate them to the supervisory authority."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "3", "title": "Data protection off icer"}, "article_number": 33, "article_title": "Position of the data protection officer", "content": "Source: LED\nChapter IV – Controller and processor\nSection 3 – Data protection off icer\nArticle 33 – Position of the data protection officer\n\n1.\nMember States shall provide for the controller to ensure that the data protection officer is involved, properly and\nin a timely manner, in all issues which relate to the protection of personal data.\n2.\nThe controller shall support the data protection officer in performing the tasks referred to in Article 34 by\nproviding resources necessary to carry out those tasks and access to personal data and processing operations, and to\nmaintain his or her expert knowledge."}
{"source": "LED", "chapter": {"id": "IV", "title": "Controller and processor"}, "section": {"id": "3", "title": "Data protection off icer"}, "article_number": 34, "article_title": "Tasks of the data protection officer", "content": "Source: LED\nChapter IV – Controller and processor\nSection 3 – Data protection off icer\nArticle 34 – Tasks of the data protection officer\n\nMember States shall provide for the controller to entrust the data protection officer at least with the following tasks:\n(a) to inform and advise the controller and the employees who carry out processing of their obligations pursuant to this\nDirective and to other Union or Member State data protection provisions;\n(b) to monitor compliance with this Directive, with other Union or Member State data protection provisions and with\nthe policies of the controller in relation to the protection of personal data, including the assignment of responsi­\nbilities, awareness-raising and training of staff involved in processing operations, and the related audits;\n(c) to provide advice where requested as regards the data protection impact assessment and monitor its performance\npursuant to Article 27;\n(d) to cooperate with the supervisory authority;\n(e) to act as the contact point for the supervisory authority on issues relating to processing, including the prior\nconsultation referred to in Article 28, and to consult, where appropriate, with regard to any other matter.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 35, "article_title": "General principles for transfers of personal data", "content": "Source: LED\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 35 – General principles for transfers of personal data\n\n1.\nMember States shall provide for any transfer by competent authorities of personal data which are undergoing\nprocessing or are intended for processing after transfer to a third country or to an international organisation including\nfor onward transfers to another third country or international organisation to take place, subject to compliance with the\nnational provisions adopted pursuant to other provisions of this Directive, only where the conditions laid down in this\nChapter are met, namely:\n(a) the transfer is necessary for the purposes set out in Article 1(1);\n(b) the personal data are transferred to a controller in a third country or international organisation that is an authority\ncompetent for the purposes referred to in Article 1(1);\n(c) where personal data are transmitted or made available from another Member State, that Member State has given its\nprior authorisation to the transfer in accordance with its national law;\n(d) the Commission has adopted an adequacy decision pursuant to Article 36, or, in the absence of such a decision,\nappropriate safeguards have been provided or exist pursuant to Article 37, or, in the absence of an adequacy\ndecision pursuant to Article 36 and of appropriate safeguards in accordance with Article 37, derogations for specific\nsituations apply pursuant to Article 38; and\n(e) in the case of an onward transfer to another third country or international organisation, the competent authority\nthat carried out the original transfer or another competent authority of the same Member State authorises the\nonward transfer, after taking into due account all relevant factors, including the seriousness of the criminal offence,\nthe purpose for which the personal data was originally transferred and the level of personal data protection in the\nthird country or an international organisation to which personal data are onward transferred.\n2.\nMember States shall provide for transfers without the prior authorisation by another Member State in accordance\nwith point (c) of paragraph 1 to be permitted only if the transfer of the personal data is necessary for the prevention of\nan immediate and serious threat to public security of a Member State or a third country or to essential interests of a\nMember State and the prior authorisation cannot be obtained in good time. The authority responsible for giving prior\nauthorisation shall be informed without delay.\n3.\nAll provisions in this Chapter shall be applied in order to ensure that the level of protection of natural persons\nensured by this Directive is not undermined."}
{"source": "LED", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 36, "article_title": "Transfers on the basis of an adequacy decision", "content": "Source: LED\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 36 – Transfers on the basis of an adequacy decision\n\n1.\nMember States shall provide that a transfer of personal data to a third country or an international organisation\nmay take place where the Commission has decided that the third country, a territory or one or more specified sectors\nwithin that third country, or the international organisation in question ensures an adequate level of protection. Such a\ntransfer shall not require any specific authorisation.\n2.\nWhen assessing the adequacy of the level of protection, the Commission shall, in particular, take account of the\nfollowing elements:\n(a) the rule of law, respect for human rights and fundamental freedoms, relevant legislation, both general and sectoral,\nincluding concerning public security, defence, national security and criminal law and the access of public authorities\nto personal data, as well as the implementation of such legislation, data protection rules, professional rules and\nsecurity measures, including rules for the onward transfer of personal data to another third country or international\norganisation, which are complied with in that country or international organisation, case-law, as well as effective and\nenforceable data subject rights and effective administrative and judicial redress for the data subjects whose personal\ndata are transferred;\n(b) the existence and effective functioning of one or more independent supervisory authorities in the third country or to\nwhich an international organisation is subject, with responsibility for ensuring and enforcing compliance with data\nprotection rules, including adequate enforcement powers, for assisting and advising data subjects in exercising their\nrights and for cooperation with the supervisory authorities of the Member States; and\n4.5.2016\nEN\n(c) the international commitments the third country or international organisation concerned has entered into, or other\nobligations arising from legally binding conventions or instruments as well as from its participation in multilateral\nor regional systems, in particular in relation to the protection of personal data.\n3.\nThe Commission, after assessing the adequacy of the level of protection, may decide, by means of implementing\nact, that a third country, a territory or one or more specified sectors within a third country, or an international\norganisation ensures an adequate level of protection within the meaning of paragraph 2 of this Article. The\nimplementing act shall provide a mechanism for periodic review, at least every four years, which shall take into account\nall relevant developments in the third country or international organisation. The implementing act shall specify its\nterritorial and sectoral application and, where applicable, identify the supervisory authority or authorities referred to in\npoint (b) of paragraph 2 of this Article. The implementing act shall be adopted in accordance with the examination\nprocedure referred to in Article 58(2).\n4.\nThe Commission shall, on an ongoing basis, monitor developments in third countries and international organ­\nisations that could affect the functioning of decisions adopted pursuant to paragraph 3.\n5.\nThe Commission shall, where available information reveals, in particular following the review referred to in\nparagraph 3 of this Article, that a third country, a territory or one or more specified sectors within a third country, or\nan international organisation no longer ensures an adequate level of protection within the meaning of paragraph 2 of\nthis Article, to the extent necessary, repeal, amend or suspend the decision referred to in paragraph 3 of this Article by\nmeans of implementing acts without retro-active effect. Those implementing acts shall be adopted in accordance with\nthe examination procedure referred to in Article 58(2).\nOn duly justified imperative grounds of urgency, the Commission shall adopt immediately applicable implementing acts\nin accordance with the procedure referred to in Article 58(3).\n6.\nThe Commission shall enter into consultations with the third country or international organisation with a view to\nremedying the situation giving rise to the decision made pursuant to paragraph 5.\n7.\nMember States shall provide for a decision pursuant to paragraph 5 to be without prejudice to transfers of\npersonal data to the third country, the territory or one or more specified sectors within that third country, or the inter­\nnational organisation in question pursuant to Articles 37 and 38.\n8.\ncountries, territories and specified sectors within a third country and international organisations for which it has decided\nthat an adequate level of protection is or is no longer ensured."}
{"source": "LED", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 37, "article_title": "Transfers subject to appropriate safeguards", "content": "Source: LED\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 37 – Transfers subject to appropriate safeguards\n\n1.\nIn the absence of a decision pursuant to Article 36(3), Member States shall provide that a transfer of personal data\nto a third country or an international organisation may take place where:\n(a) appropriate safeguards with regard to the protection of personal data are provided for in a legally binding\ninstrument; or\n(b) the controller has assessed all the circumstances surrounding the transfer of personal data and concludes that\nappropriate safeguards exist with regard to the protection of personal data.\n2.\nThe controller shall inform the supervisory authority about categories of transfers under point (b) of paragraph 1.\n3.\nWhen a transfer is based on point (b) of paragraph 1, such a transfer shall be documented and the documentation\nshall be made available to the supervisory authority on request, including the date and time of the transfer, information\nabout the receiving competent authority, the justification for the transfer and the personal data transferred.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 38, "article_title": "Derogations for specific situations", "content": "Source: LED\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 38 – Derogations for specific situations\n\n1.\nIn the absence of an adequacy decision pursuant to Article 36, or of appropriate safeguards pursuant to Article 37,\nMember States shall provide that a transfer or a category of transfers of personal data to a third country or an internat­\nional organisation may take place only on the condition that the transfer is necessary:\n(a) in order to protect the vital interests of the data subject or another person;\n(b) to safeguard legitimate interests of the data subject, where the law of the Member State transferring the personal\ndata so provides;\n(c) for the prevention of an immediate and serious threat to public security of a Member State or a third country;\n(d) in individual cases for the purposes set out in Article 1(1); or\n(e) in an individual case for the establishment, exercise or defence of legal claims relating to the purposes set out in\nArticle 1(1).\n2.\nPersonal data shall not be transferred if the transferring competent authority determines that fundamental rights\nand freedoms of the data subject concerned override the public interest in the transfer set out in points (d) and (e) of\nparagraph 1.\n3.\nWhere a transfer is based on paragraph 1, such a transfer shall be documented and the documentation shall be\nmade available to the supervisory authority on request, including the date and time of the transfer, information about\nthe receiving competent authority, the justification for the transfer and the personal data transferred."}
{"source": "LED", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 39, "article_title": "Transfers of personal data to recipients established in third countries", "content": "Source: LED\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 39 – Transfers of personal data to recipients established in third countries\n\n1.\nBy way of derogation from point (b) of Article 35(1) and without prejudice to any international agreement referred\nto in paragraph 2 of this Article, Union or Member State law may provide for the competent authorities referred to in\npoint (7)(a) of Article 3, in individual and specific cases, to transfer personal data directly to recipients established in\nthird countries only if the other provisions of this Directive are complied with and all of the following conditions are\nfulfilled:\n(a) the transfer is strictly necessary for the performance of a task of the transferring competent authority as provided\nfor by Union or Member State law for the purposes set out in Article 1(1);\n(b) the transferring competent authority determines that no fundamental rights and freedoms of the data subject\nconcerned override the public interest necessitating the transfer in the case at hand;\n(c) the transferring competent authority considers that the transfer to an authority that is competent for the purposes\nreferred to in Article 1(1) in the third country is ineffective or inappropriate, in particular because the transfer\ncannot be achieved in good time;\n(d) the authority that is competent for the purposes referred to in Article 1(1) in the third country is informed without\nundue delay, unless this is ineffective or inappropriate;\n(e) the transferring competent authority informs the recipient of the specified purpose or purposes for which the\npersonal data are only to be processed by the latter provided that such processing is necessary.\n2.\nAn international agreement referred to in paragraph 1 shall be any bilateral or multilateral international agreement\nin force between Member States and third countries in the field of judicial cooperation in criminal matters and police\ncooperation.\n3.\nThe transferring competent authority shall inform the supervisory authority about transfers under this Article.\n4.\nWhere a transfer is based on paragraph 1, such a transfer shall be documented.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "V", "title": "Transfers of personal data to third countries or international organisations"}, "section": null, "article_number": 40, "article_title": "International cooperation for the protection of personal data", "content": "Source: LED\nChapter V – Transfers of personal data to third countries or international organisations\nArticle 40 – International cooperation for the protection of personal data\n\nIn relation to third countries and international organisations, the Commission and Member States shall take appropriate\nsteps to:\n(a) develop international cooperation mechanisms to facilitate the effective enforcement of legislation for the protection\nof personal data;\n(b) provide international mutual assistance in the enforcement of legislation for the protection of personal data,\nincluding through notification, complaint referral, investigative assistance and information exchange, subject to\nappropriate safeguards for the protection of personal data and other fundamental rights and freedoms;\n(c) engage relevant stakeholders in discussion and activities aimed at furthering international cooperation in the\nenforcement of legislation for the protection of personal data;\n(d) promote the exchange and documentation of personal data protection legislation and practice, including on jurisdic­\ntional conflicts with third countries."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 41, "article_title": "Supervisory authority", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 41 – Supervisory authority\n\n1.\nEach Member State shall provide for one or more independent public authorities to be responsible for monitoring\nthe application of this Directive, in order to protect the fundamental rights and freedoms of natural persons in relation\nto processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).\n2.\nEach supervisory authority shall contribute to the consistent application of this Directive throughout the Union.\nFor that purpose, the supervisory authorities shall cooperate with each other and with the Commission in accordance\nwith Chapter VII.\n3.\nMember States may provide for a supervisory authority established under Regulation (EU) 2016/679 to be the\nsupervisory authority referred to in this Directive and to assume responsibility for the tasks of the supervisory authority\nto be established under paragraph 1 of this Article.\n4.\nWhere more than one supervisory authority is established in a Member State, that Member State shall designate\nthe supervisory authority which are to represent those authorities in the Board referred to in Article 51."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 42, "article_title": "Independence", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 42 – Independence\n\n1.\nEach Member State shall provide for each supervisory authority to act with complete independence in performing\nits tasks and exercising its powers in accordance with this Directive.\n2.\nMember States shall provide for the member or members of their supervisory authorities in the performance of\ntheir tasks and exercise of their powers in accordance with this Directive, to remain free from external influence,\nwhether direct or indirect, and that they shall neither seek nor take instructions from anybody.\n3.\nMembers of Member States' supervisory authorities shall refrain from any action incompatible with their duties\nand shall not, during their term of office, engage in any incompatible occupation, whether gainful or not.\n4.\nEach Member State shall ensure that each supervisory authority is provided with the human, technical and\nfinancial resources, premises and infrastructure necessary for the effective performance of its tasks and exercise of its\npowers, including those to be carried out in the context of mutual assistance, cooperation and participation in the\nBoard.\n4.5.2016\nEN\n5.\nEach Member State shall ensure that each supervisory authority chooses and has its own staff which shall be\nsubject to the exclusive direction of the member or members of the supervisory authority concerned.\n6.\nEach Member State shall ensure that each supervisory authority is subject to financial control which does not\naffect its independence and that it has separate, public annual budgets, which may be part of the overall state or national\nbudget."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 43, "article_title": "General conditions for the members of the supervisory authority", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 43 – General conditions for the members of the supervisory authority\n\n1.\nMember States shall provide for each member of their supervisory authorities to be appointed by means of a\ntransparent procedure by:\n— their parliament;\n— their government;\n— their head of State; or\n— an independent body entrusted with the appointment under Member State law.\n2.\nEach member shall have the qualifications, experience and skills, in particular in the area of the protection of\npersonal data, required to perform their duties and exercise their powers.\n3.\nThe duties of a member shall end in the event of the expiry of the term of office, resignation or compulsory\nretirement, in accordance with the law of the Member State concerned.\n4.\nA member shall be dismissed only in cases of serious misconduct or if the member no longer fulfils the conditions\nrequired for the performance of the duties."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "1", "title": "Independent status"}, "article_number": 44, "article_title": "Rules on the establishment of the supervisory authority", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 1 – Independent status\nArticle 44 – Rules on the establishment of the supervisory authority\n\n1.\nEach Member State shall provide by law for all of the following:\n(a) the establishment of each supervisory authority;\n(b) the qualifications and eligibility conditions required to be appointed as a member of each supervisory authority;\n(c) the rules and procedures for the appointment of the member or members of each supervisory authority;\n(d) the duration of the term of the member or members of each supervisory authority of not less than four years,\nexcept for the first appointment after 6 May 2016, part of which may take place for a shorter period where that is\nnecessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;\n(e) whether and, if so, for how many terms the member or members of each supervisory authority is eligible for\nreappointment;\n(f) the conditions governing the obligations of the member or members and staff of each supervisory authority,\nprohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and\nrules governing the cessation of employment.\n2.\nThe member or members and the staff of each supervisory authority shall, in accordance with Union or Member\nState law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any\nconfidential information which has come to their knowledge in the course of the performance of their tasks or the\nexercise of their powers. During their term of office, that duty of professional secrecy shall in particular apply to\nreporting by natural persons of infringements of this Directive.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 45, "article_title": "Competence", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 45 – Competence\n\n1.\nEach Member State shall provide for each supervisory authority to be competent for the performance of the tasks\nassigned to, and for the exercise of the powers conferred on, it in accordance with this Directive on the territory of its\nown Member State.\n2.\nEach Member State shall provide for each supervisory authority not to be competent for the supervision of\nprocessing operations of courts when acting in their judicial capacity. Member States may provide for their supervisory\nauthority not to be competent to supervise processing operations of other independent judicial authorities when acting\nin their judicial capacity."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 46, "article_title": "Tasks", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 46 – Tasks\n\n1.\nEach Member State shall provide, on its territory, for each supervisory authority to:\n(a) monitor and enforce the application of the provisions adopted pursuant to this Directive and its implementing\nmeasures;\n(b) promote public awareness and understanding of the risks, rules, safeguards and rights in relation to processing;\n(c) advise, in accordance with Member State law, the national parliament, the government and other institutions and\nbodies on legislative and administrative measures relating to the protection of natural persons' rights and freedoms\nwith regard to processing;\n(d) promote the awareness of controllers and processors of their obligations under this Directive;\n(e) upon request, provide information to any data subject concerning the exercise of their rights under this Directive\nand, if appropriate, cooperate with the supervisory authorities in other Member States to that end;\n(f) deal with complaints lodged by a data subject, or by a body, organisation or association in accordance with\nArticle 55, and investigate, to the extent appropriate, the subject-matter of the complaint and inform the\ncomplainant of the progress and the outcome of the investigation within a reasonable period, in particular if further\ninvestigation or coordination with another supervisory authority is necessary;\n(g) check the lawfulness of processing pursuant to Article 17, and inform the data subject within a reasonable period of\nthe outcome of the check pursuant to paragraph 3 of that Article or of the reasons why the check has not been\ncarried out;\n(h) cooperate with, including by sharing information, and provide mutual assistance to other supervisory authorities,\nwith a view to ensuring the consistency of application and enforcement of this Directive;\n(i) conduct investigations on the application of this Directive, including on the basis of information received from\nanother supervisory authority or other public authority;\n(j) monitor relevant developments insofar as they have an impact on the protection of personal data, in particular the\ndevelopment of information and communication technologies;\n(k) provide advice on the processing operations referred to in Article 28; and\n(l) contribute to the activities of the Board.\n2.\nEach supervisory authority shall facilitate the submission of complaints referred to in point (f) of paragraph 1 by\nmeasures such as providing a complaint submission form which can also be completed electronically, without excluding\nother means of communication.\n4.5.2016\nEN\n3.\nThe performance of the tasks of each supervisory authority shall be free of charge for the data subject and for the\ndata protection officer.\n4.\nWhere a request is manifestly unfounded or excessive, in particular because it is repetitive, the supervisory\nauthority may charge a reasonable fee based on its administrative costs, or may refuse to act on the request. The\nsupervisory authority shall bear the burden of demonstrating that the request is manifestly unfounded or excessive."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 47, "article_title": "Powers", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 47 – Powers\n\n1.\nEach Member State shall provide by law for each supervisory authority to have effective investigative powers.\nThose powers shall include at least the power to obtain from the controller and the processor access to all personal data\nthat are being processed and to all information necessary for the performance of its tasks.\n2.\nEach Member State shall provide by law for each supervisory authority to have effective corrective powers such as,\nfor example:\n(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe the\nprovisions adopted pursuant to this Directive;\n(b) to order the controller or processor to bring processing operations into compliance with the provisions adopted\npursuant to this Directive, where appropriate, in a specified manner and within a specified period, in particular by\nordering the rectification or erasure of personal data or restriction of processing pursuant to Article 16;\n(c) to impose a temporary or definitive limitation, including a ban, on processing.\n3.\nEach Member State shall provide by law for each supervisory authority to have effective advisory powers to advise\nthe controller in accordance with the prior consultation procedure referred to in Article 28 and to issue, on its own\ninitiative or on request, opinions to its national parliament and its government or, in accordance with its national law, to\nother institutions and bodies as well as to the public on any issue related to the protection of personal data.\n4.\nThe exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to\nappropriate safeguards, including effective judicial remedy and due process, as set out in Union and Member State law in\naccordance with the Charter.\n5.\nEach Member State shall provide by law for each supervisory authority to have the power to bring infringements\nof provisions adopted pursuant to this Directive to the attention of judicial authorities and, where appropriate, to\ncommence or otherwise engage in legal proceedings, in order to enforce the provisions adopted pursuant to this\nDirective."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 48, "article_title": "Reporting of infringements", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 48 – Reporting of infringements\n\nMember States shall provide for competent authorities to put in place effective mechanisms to encourage confidential\nreporting of infringements of this Directive."}
{"source": "LED", "chapter": {"id": "VI", "title": "Independent supervisory authorities"}, "section": {"id": "2", "title": "Competence, tasks and powers"}, "article_number": 49, "article_title": "Activity reports", "content": "Source: LED\nChapter VI – Independent supervisory authorities\nSection 2 – Competence, tasks and powers\nArticle 49 – Activity reports\n\nEach supervisory authority shall draw up an annual report on its activities, which may include a list of types of\ninfringement notified and types of penalties imposed. Those reports shall be transmitted to the national parliament, the\ngovernment and other authorities as designated by Member State law. They shall be made available to the public, the\nCommission and the Board.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "VII", "title": "Cooperation"}, "section": null, "article_number": 50, "article_title": "Mutual assistance", "content": "Source: LED\nChapter VII – Cooperation\nArticle 50 – Mutual assistance\n\n1.\nEach Member State shall provide for their supervisory authorities to provide each other with relevant information\nand mutual assistance in order to implement and apply this Directive in a consistent manner, and to put in place\nmeasures for effective cooperation with one another. Mutual assistance shall cover, in particular, information requests\nand supervisory measures, such as requests to carry out consultations, inspections and investigations.\n2.\nEach Member States shall provide for each supervisory authority to take all appropriate measures required to reply\nto a request of another supervisory authority without undue delay and no later than one month after receiving the\nrequest. Such measures may include, in particular, the transmission of relevant information on the conduct of an investi­\ngation.\n3.\nRequests for assistance shall contain all the necessary information, including the purpose of and reasons for the\nrequest. Information exchanged shall be used only for the purpose for which it was requested.\n4.\nThe requested supervisory authority shall not refuse to comply with the request unless:\n(a) it is not competent for the subject-matter of the request or for the measures it is requested to execute; or\n(b) compliance with the request would infringe this Directive or Union or Member State law to which the supervisory\nauthority receiving the request is subject.\n5.\nThe requested supervisory authority shall inform the requesting supervisory authority of the results or, as the case\nmay be, of the progress of the measures taken in order to respond to the request. The requested supervisory authority\nshall provide reasons for any refusal to comply with a request pursuant to paragraph 4.\n6.\nRequested supervisory authorities shall, as a rule, supply the information requested by other supervisory\nauthorities by electronic means, using a standardised format.\n7.\nRequested supervisory authorities shall not charge a fee for any action taken by them pursuant to a request for\nmutual assistance. Supervisory authorities may agree on rules to indemnify each other for specific expenditure arising\nfrom the provision of mutual assistance in exceptional circumstances.\n8.\nThe Commission may, by means of implementing acts, specify the format and procedures for mutual assistance\nreferred to in this Article and the arrangements for the exchange of information by electronic means between\nsupervisory authorities, and between supervisory authorities and the Board. Those implementing acts shall be adopted in\naccordance with the examination procedure referred to in Article 58(2)."}
{"source": "LED", "chapter": {"id": "VII", "title": "Cooperation"}, "section": null, "article_number": 51, "article_title": "Tasks of the Board", "content": "Source: LED\nChapter VII – Cooperation\nArticle 51 – Tasks of the Board\n\n1.\nThe Board established by Regulation (EU) 2016/679 shall perform all of the following tasks in relation to\nprocessing within the scope of this Directive:\n(a) advise the Commission on any issue related to the protection of personal data in the Union, including on any\nproposed amendment of this Directive;\n(b) examine, on its own initiative, on request of one of its members or on request of the Commission, any question\ncovering the application of this Directive and issue guidelines, recommendations and best practices in order to\nencourage consistent application of this Directive;\n(c) draw up guidelines for supervisory authorities concerning the application of measures referred to in Article 47(1)\nand (3);\n(d) issue guidelines, recommendations and best practices in accordance with point (b) of this subparagraph for\nestablishing personal data breaches and determining the undue delay referred to in Article 30(1) and (2) and for the\nparticular circumstances in which a controller or a processor is required to notify the personal data breach;\n4.5.2016\nEN\n(e) issue guidelines, recommendations and best practices in accordance with point (b) of this subparagraph as to the\ncircumstances in which a personal data breach is likely to result in a high risk to the rights and freedoms of natural\npersons as referred to in Article 31(1);\n(f) review the practical application of the guidelines, recommendations and best practices referred to in points (b)\nand (c);\n(g) provide the Commission with an opinion for the assessment of the adequacy of the level of protection in a third\ncountry, a territory or one or more specified sectors within a third country, or an international organisation,\nincluding for the assessment whether such a third country, territory, specified sector, or international organisation\nno longer ensures an adequate level of protection;\n(h) promote the cooperation and the effective bilateral and multilateral exchange of information and best practices\nbetween the supervisory authorities;\n(i) promote common training programmes and facilitate personnel exchanges between the supervisory authorities and,\nwhere appropriate, with the supervisory authorities of third countries or with international organisations;\n(j) promote the exchange of knowledge and documentation on data protection law and practice with data protection\nsupervisory authorities worldwide.\nWith regard to point (g) of the first subparagraph, the Commission shall provide the Board with all necessary documen­\ntation, including correspondence with the government of the third country, with the territory or specified sector within\nthat third country, or with the international organisation.\n2.\nWhere the Commission requests advice from the Board, it may indicate a time limit, taking into account the\nurgency of the matter.\n3.\nThe Board shall forward its opinions, guidelines, recommendations and best practices to the Commission and to\nthe committee referred to in Article 58(1) and make them public.\n4.\nThe Commission shall inform the Board of the action it has taken following opinions, guidelines, recommen­\ndations and best practices issued by the Board."}
{"source": "LED", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 52, "article_title": "Right to lodge a complaint with a supervisory authority", "content": "Source: LED\nChapter VIII – Remedies, liability and penalties\nArticle 52 – Right to lodge a complaint with a supervisory authority\n\n1.\nWithout prejudice to any other administrative or judicial remedy, Member States shall provide for every data\nsubject to have the right to lodge a complaint with a single supervisory authority, if the data subject considers that the\nprocessing of personal data relating to him or her infringes provisions adopted pursuant to this Directive.\n2.\nMember States shall provide for the supervisory authority with which the complaint has been lodged to transmit it\nto the competent supervisory authority, without undue delay if the complaint is not lodged with the supervisory\nauthority that is competent pursuant to Article 45(1). The data subject shall be informed about the transmission.\n3.\nMember States shall provide for the supervisory authority with which the complaint has been lodged to provide\nfurther assistance on request of the data subject.\n4.\nThe data subject shall be informed by the competent supervisory authority of the progress and the outcome of the\ncomplaint, including of the possibility of a judicial remedy pursuant to Article 53."}
{"source": "LED", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 53, "article_title": "Right to an effective judicial remedy against a supervisory authority", "content": "Source: LED\nChapter VIII – Remedies, liability and penalties\nArticle 53 – Right to an effective judicial remedy against a supervisory authority\n\n1.\nWithout prejudice to any other administrative or non-judicial remedy, Member States shall provide for the right of\na natural or legal person to an effective judicial remedy against a legally binding decision of a supervisory authority\nconcerning them.\n4.5.2016\nEN\n2.\nWithout prejudice to any other administrative or non-judicial remedy, each data subject shall have the right to an\neffective judicial remedy where the supervisory authority which is competent pursuant to Article 45(1) does not handle\na complaint or does not inform the data subject within three months of the progress or outcome of the complaint\nlodged pursuant to Article 52.\n3.\nMember States shall provide for proceedings against a supervisory authority to be brought before the courts of the\nMember State where the supervisory authority is established."}
{"source": "LED", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 54, "article_title": "Right to an effective judicial remedy against a controller or processor", "content": "Source: LED\nChapter VIII – Remedies, liability and penalties\nArticle 54 – Right to an effective judicial remedy against a controller or processor\n\nWithout prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a\nsupervisory authority pursuant to Article 52, Member States shall provide for the right of a data subject to an effective\njudicial remedy where he or she considers that his or her rights laid down in provisions adopted pursuant to this\nDirective have been infringed as a result of the processing of his or her personal data in non-compliance with those\nprovisions."}
{"source": "LED", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 55, "article_title": "Representation of data subjects", "content": "Source: LED\nChapter VIII – Remedies, liability and penalties\nArticle 55 – Representation of data subjects\n\nMember States shall, in accordance with Member State procedural law, provide for the data subject to have the right to\nmandate a not-for-profit body, organisation or association which has been properly constituted in accordance with\nMember State law, has statutory objectives which are in the public interest and is active in the field of protection of data\nsubject's rights and freedoms with regard to the protection of their personal data to lodge the complaint on his or her\nbehalf and to exercise the rights referred to in Articles 52, 53 and 54 on his or her behalf."}
{"source": "LED", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 56, "article_title": "Right to compensation", "content": "Source: LED\nChapter VIII – Remedies, liability and penalties\nArticle 56 – Right to compensation\n\nMember States shall provide for any person who has suffered material or non-material damage as a result of an unlawful\nprocessing operation or of any act infringing national provisions adopted pursuant to this Directive to have the right to\nreceive compensation for the damage suffered from the controller or any other authority competent under Member State\nlaw."}
{"source": "LED", "chapter": {"id": "VIII", "title": "Remedies, liability and penalties"}, "section": null, "article_number": 57, "article_title": "Penalties", "content": "Source: LED\nChapter VIII – Remedies, liability and penalties\nArticle 57 – Penalties\n\nMember States shall lay down the rules on penalties applicable to infringements of the provisions adopted pursuant to\nthis Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall\nbe effective, proportionate and dissuasive."}
{"source": "LED", "chapter": {"id": "IX", "title": "Implementing acts"}, "section": null, "article_number": 58, "article_title": "Committee procedure", "content": "Source: LED\nChapter IX – Implementing acts\nArticle 58 – Committee procedure\n\n1.\nThe Commission shall be assisted by the committee established by Article 93 of Regulation (EU) 2016/679. That\ncommittee shall be a committee within the meaning of Regulation (EU) No 182/2011.\n2.\nWhere reference is made to this paragraph, Article 5 of Regulation (EU) No 182/2011 shall apply.\n3.\nWhere reference is made to this paragraph, Article 8 of Regulation (EU) No 182/2011, in conjunction with\nArticle 5 thereof, shall apply.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 59, "article_title": "Repeal of Framework Decision 2008/977/JHA", "content": "Source: LED\nChapter X – Final provisions\nArticle 59 – Repeal of Framework Decision 2008/977/JHA\n\n1.\nFramework Decision 2008/977/JHA is repealed with effect from 6 May 2018.\n2.\nReferences to the repealed Decision referred to in paragraph 1 shall be construed as references to this Directive."}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 60, "article_title": "Union legal acts already in force", "content": "Source: LED\nChapter X – Final provisions\nArticle 60 – Union legal acts already in force\n\nThe specific provisions for the protection of personal data in Union legal acts that entered into force on or before 6 May\n2016 in the field of judicial cooperation in criminal matters and police cooperation, which regulate processing between\nMember States and the access of designated authorities of Member States to information systems established pursuant to\nthe Treaties within the scope of this Directive, shall remain unaffected."}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 61, "article_title": "Relationship with previously concluded international agreements in the field of judicial", "content": "Source: LED\nChapter X – Final provisions\nArticle 61 – Relationship with previously concluded international agreements in the field of judicial\n\ncooperation in criminal matters and police cooperation\nInternational agreements involving the transfer of personal data to third countries or international organisations which\nwere concluded by Member States prior to 6 May 2016 and which comply with Union law as applicable prior to that\ndate shall remain in force until amended, replaced or revoked."}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 62, "article_title": "Commission reports", "content": "Source: LED\nChapter X – Final provisions\nArticle 62 – Commission reports\n\n1.\nBy 6 May 2022, and every four years thereafter, the Commission shall submit a report on the evaluation and\nreview of this Directive to the European Parliament and to the Council. The reports shall be made public.\n2.\nIn the context of the evaluations and reviews referred to in paragraph 1, the Commission shall examine, in\nparticular, the application and functioning of Chapter V on the transfer of personal data to third countries or\ninternational organisations with particular regard to decisions adopted pursuant to Article 36(3) and Article 39.\n3.\nFor the purposes of paragraphs 1 and 2, the Commission may request information from Member States and\nsupervisory authorities.\n4.\nIn carrying out the evaluations and reviews referred to in paragraphs 1 and 2, the Commission shall take into\naccount the positions and findings of the European Parliament, of the Council and of other relevant bodies or sources.\n5.\nThe Commission shall, if necessary, submit appropriate proposals with a view to amending this Directive, in\nparticular taking account of developments in information technology and in the light of the state of progress in the\ninformation society.\n6.\nBy 6 May 2019, the Commission shall review other legal acts adopted by the Union which regulate processing by\nthe competent authorities for the purposes set out in Article 1(1) including those referred to in Article 60, in order to\nassess the need to align them with this Directive and to make, where appropriate, the necessary proposals to amend\nthose acts to ensure a consistent approach to the protection of personal data within the scope of this Directive.\n4.5.2016\nEN"}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 63, "article_title": "Transposition", "content": "Source: LED\nChapter X – Final provisions\nArticle 63 – Transposition\n\n1.\nMember States shall adopt and publish, by 6 May 2018, the laws, regulations and administrative provisions\nnecessary to comply with this Directive. They shall forthwith notify to the Commission the text of those provisions.\nThey shall apply those provisions from 6 May 2018.\nWhen Member States adopt those provisions, they shall contain a reference to this Directive or shall be accompanied by\nsuch a reference on the occasion of their official publication. Member States shall determine how such reference is to be\nmade.\n2.\nBy way of derogation from paragraph 1, a Member State may provide, exceptionally, where it involves dispropor­\ntionate effort, for automated processing systems set up before 6 May 2016 to be brought into conformity with\nArticle 25(1) by 6 May 2023.\n3.\nBy way of derogation from paragraphs 1 and 2 of this Article, a Member State may, in exceptional circumstances,\nbring an automated processing system as referred to in paragraph 2 of this Article into conformity with Article 25(1)\nwithin a specified period after the period referred to in paragraph 2 of this Article, if it would otherwise cause serious\ndifficulties for the operation of that particular automated processing system. The Member State concerned shall notify\nthe Commission of the grounds for those serious difficulties and the grounds for the specified period within which it\nshall bring that particular automated processing system into conformity with Article 25(1). The specified period shall in\nany event not be later than 6 May 2026.\n4.\nMember States shall communicate to the Commission the text of the main provisions of national law which they\nadopt in the field covered by this Directive."}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 64, "article_title": "Entry into force", "content": "Source: LED\nChapter X – Final provisions\nArticle 64 – Entry into force\n\nUnion."}
{"source": "LED", "chapter": {"id": "X", "title": "Final provisions"}, "section": null, "article_number": 65, "article_title": "Addressees", "content": "Source: LED\nChapter X – Final provisions\nArticle 65 – Addressees\n\nThis Directive is addressed to the Member States.\nDone at Brussels, 27 April 2016.\nFor the European Parliament\nThe President\nM. SCHULZ\nFor the Council\nThe President\nJ.A. HENNIS-PLASSCHAERT\n4.5.2016\nEN"}