Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

GDPR > Chapter 13 Supervision and Enforcement > Flashcards

Chapter 13 Supervision and Enforcement Flashcards

1
Q

Who has the powers to exercise supervision and enforcement of GDPR?

A

Regulators, courts, markets, citizens, self-regulation schemes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What is the meaning of self-regulation?

A

It’s a tool of supervision and enforcement where C&P directly control the application of appropriate processes, procedures and measures to protect data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

How is self-regulation introduced through GDPR?

A
  • accountability
  • DPOs
  • CoC, certification schemes for DP seals and marks
  • regulatory function of the Cs over the Ps, Ps over Sub-Ps
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What shows a self-regulation role of the DPO?

A

They have a supervisory and enforcement role within the organisation
- must be focused on compliance
- immune from dismissal
- duty of cooperation with DPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Who can create CoC?

A

Representative bodies of Cs and Ps, e.g. industry associations.
CoC on any aspect of DP compliance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Which body approves CoC?

A

DPA

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Who monitors Cs&Ps for compliance to CoC?

A

Monitoring body accredited by DPA
Must prove independence, expertise, must avoid conflicts of interest
must have procedures in place for effective monitoring, dealing with complaints, take action against infringements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Who issues seals and marks?

A

Certification body accredited by DPA or accreditation bodies in MS

Must prove independence, expertise, must avoid conflicts of interest
procedures for issuing, reviewing and revoking seals and marks
must have procedures in place for effective monitoring, dealing with complaints, take action against infringements

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What are transnational codes?

A

Affect at least 2 MS and are subject to consistency mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Forms of “regulation by the citizen” in GDPR

A
  • regulating the C through the use of DS rights
  • remedies for breach of obligations
  • representative actions
  • liability and compensation claims
  • regulating the regulators
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

regulating the C through the use of DS rights

A

If DS are dissatisfied with their ability to exercise their rights, they can pursue administrative and judicial remedies

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Are DS required to first raise their concerns with the C?

A

No, they can directly pursue complaints and remedies before DPAs or courts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

remedies for breach of obligations

A

If DS feel their rights have been breached, they can pursue litigation in accordance with the national laws, complain to the regulator or both

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Forum provisions for complaints before the DPA

A

DS’s place of residence
DS’s place of work
place where the infringement took place

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

representative actions

A

group litigation, class actions under Art. 80 GDPR
individuals can elect to be represented by not-for-profit organisations (CsO, privacy advocates, preassure groups)
MS may allow the representatives proceedings without individuals mandates

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

liability and compensation claims

A

against Cs and Ps if DS suffers damage as a result of an act of noncompliance
An individual CorP that is responsible for any part of the damage, can be held liable for all the damage

Damage means material and nonmaterial d. (distress)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

regulating the regulators

A

DS has the right to take action against the DPA before a court if DPA has not dealt with their complaint or they hear nothing within 3 months.
Also, where an individual or legal entity is unhappy with the decision (e.g. with corrective action or sanction)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Who is responsible for administrative supervision and enforcement

A

SA or DPA
independent bodies
must have sufficient skills and resources to do the job

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How are regulators embedded into national law making?

A

MS must consult with the R during the preparation of the proposed legislation that relates to the processing of PD

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are regulators main tasks?

A

monitoring and enforcing GDPR
providing advice to parliaments and governments
promoting awareness and understanding of GDPR
handling complaints and carrying out investigations
supporting consistent implementation of GDPR - consistency mechanism
providing assistance and supporting EDPB
monitoring the development of information and communication technologies and communications technologies and commercial practices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the role of DPAs in international transfers

A

C&P can obtain authorisation to use their own contractual models
public authorities can seek for approvals for administrative arrangements
approve transfers based on BCRs
all subject to consistency mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Can DPA charge the individuals?

A

No, except for administration costs based on manifestly unfounded or excessive requests

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are regulators powers

A

Investigative powers: R to start investigation and access to all relevant documentation (excl. legal professional privilege and privilege from self-discrimination); also R to audits and the inspection of premises and processing equipment

Corrective powers: warning, order to stop processing activities, financial penalties

Authorisation and advisory powers: CoC, certifications, marks&seals, international transfers

Litigation powers: can take legal proceedings against C&P

24
Q

What is a consistency mechanism?

A

to contribute to the consistent application of the GDPR by requiring DPAs cooperate with each other, and the commission

25
Q

What are the competence rules for DPAs?

A

DPA is competent for C&Ps established in the territory or Cs established elsewhere if there is an effect in the DPAs territory

Crossborder processing - lead SA

26
Q

What is a one-stop-shop principle in supervision and enforcement?

A

Lead SA is determined in case of cross-border processing

27
Q

When do rules of cross-border processing not apply?

A

Public authorities or private bodies processing in accordance with a legal obligation, in the public interest or for official function

28
Q

One-stop shop - how to determine competence

A

the location of the main establishment of the C or P

1) C or P is established in more than one MS and the processing takes place in the context of more than 1 establishment (multinational organisations)
2) single establishment but processing substantially affects DSs in more than one MS (multinational organisations and organisations with only 1 establishment)

29
Q

What is main establishment?

A

For C=where the decision making for the processing takes place
For P=location of main processing activities

30
Q

What triggers the battle of competence?

A

Non-lead authority decides to take action in cross-border situation if complaint relates only to its territory or it affects individuals only in its territory
must notify lead authority who can then trigger battle of competence

31
Q

Can a concerned DPA give reasoned objection against the lead authority draft decision?

A

Yes, it can be about the substantive findings on compliance or imposititon of a corrective measure or size of a fine

32
Q

What can a lead authority do after receiving the reasoned objection?

A

accept it: issue a revised draft decision and other DPAs accept or make another reasoned objection - the process will carry on until the impasse is broken
reject it: must follow the consistency mechanism

If no objections are made, the DPAs are deemed to be in agreement and the draft decision is binding

33
Q

Who must be notified about the decision?

A

C or P
other DPAs
EDPB
individual in case of complaint

34
Q

Explain mutual assistance and joint cooperation between DPAs

A

Art 61(1) mandates cooperation and exchange of information
DPA can give request for assistance with sufficient information
DPAs must have appropriate measures to provide assistance without undue delay subject to one-month-long stop
If receiving DPA does not provide assistance, the requesting DPA can adopt a provisional measure that, in turn, triggers the urgency procedure

Joint operations in case where C/P are established in multiple territories or where processing activities affect a significant number of individuals in multiple territories - DPAs have the right to be properly represented in supervisory and enforcement work

35
Q

Who is represented in EDPB?

A

Chairperson
head of each DPA
EDP Supervisor
The Commission is entitled to send a delegate to its meetings

36
Q

Who is responsible for Consistency mechanism?

A

EDPB

37
Q

What are EDPB’s responsibilities?

A

Opinions - on DPIAs lists, codes on conduct, international transfer mechanisms referred by DPAs
Dispute resolution - lead authority rejects reasoned objection; dispute between DPA about who is competent; DPA fails to refer its decisions on DPIAs lists, codes on conduct, international transfer mechanisms - result is a binding decision

38
Q

What is an urgency procedure?

A

DPA must take urgent action to protect R&F of individuals but there is not enough time for cooperation procedure or consistency mechanism
DPA can adopt provisional measures - 3 months
DPA must refer them with reasons to concerned DPAs, EDPB and Commission
At the end of 3 months the provisional measures lapse; DPA can request an urgent opinion or urgent binding decision from EDPB

39
Q

Can a non lead DPA utilize Art 58(5) - refer issues to the court or initiate or take part in legal proceeding where they are competent to regulate?

A

One-stop- shop has a primacy but the DPA can utilize Art 58(5) if a carve-out applies but must before follow the cooperation and consistency rules in full

40
Q

What are the 2 carve-outs to the one-stop shop?

A

non-lead DPA can regulate aspects of cross-border processing that concern only an establishment in its territory or substantially affects DS in its territory

cases of urgency

41
Q

Which Article GDPR deals with fines?

A

Art 83

42
Q

What fines can be imposed?

A

10 M EUR or 20 M EUR for non-undertakings (e.g. public authorities)
10 M EUR or 2% of annual turnover or 20 M EUR or 4% of annual turnover for for undertakings (e.g. companies)

43
Q

Lesser breaches

A

child consent
DP by design/default
engagement of processors by controllers
records of processing
cooperation with regulators
security
breach notification
DPIAs
DPOs
Codes of Conduct
Certification

44
Q

Higher breaches

A

Data protection principles
lawfulness of processing
consent
processing of special category data
DS rights
international transfers
failure to comply with DPAs investigatory or corrective powers

45
Q

What is the requirement for the fines?

A

effective, proportionate, dissuasive
they can be imposed in conjunction with the exercise of DPA’s investigatory and corrective powers
serious breaches can be met with multiple responses

46
Q

What is the total amount of the fine?

A

It can not exceed the amount that is specified for the most serious breach
each breach will need a particular quantum assigned to it

47
Q

Circumstances that SA must consider before imposing a fine

A

Nature, gravity and duration of the infringement taking into account the nature, scope or purpose of processing, number of DSs and the level of damage suffered by them

intentional or negligent

any action taken to mitigate the damage

degree of C’s or P’s responsibility taking into account T&O measures implemented

any relevant previous infringements

degree of cooperation with SA

categories of PD

how did the infringement become known to the SA (notification by C or P?)

if any previous measures have been ordered against P or C with regard to the same subject matter, compliance with those measures

adherence to approved codes of conduct or certification mechanisms

any other applicable aggravating or mitigating factor

48
Q

What is a definition of an undertaking

A

Entity engaged in commercial activities, i.e. companies
Excl. public authorities, unincorporated associations

49
Q

What are the rules for fine calculation for the companies that form a part of a group?

A

It could be fined up to the max % of its individual turnover or group’s turnover if the group companies are effectively acting together or in concert as one undertaking (as an economic unit, regardless of legal units) which can be rebuffed by evidence

50
Q

According to WP29 guidelines, when can a reprimand replace a fine?

A

In case of minor infringements (infringement does not pose a significant risk to the DS rights or the essence of obligation in question)
A fine would constitute a disproportionate burden on a C who is a natural person

51
Q

Must there be a causal connection btw. the breach and the suffering of material loss?

A

No, DPA is not obliged to establish a causal connection

52
Q

What is an intentional breach?

A

it includes knowledge and willfulness in relation to the offence, e.g. it might be explicitly authorised by management, done despite the DPO’s advice or in disregard of the policy

53
Q

EDPB guidelines on the calculation of fines - five-step process

A

1) Processing operations must be identified and evaluated
2) Starting point for calculating the fine must be identified - nature and seriousness of the infringement & turnover of the undertaking
3) Aggravating and mitigating features must be considered
4) max amount of fine must be established
5) Fine must be effective, proportionate and dissuasive

54
Q

What fines can be imposed in case of linked and in case of separate processing operations

A

Linked PO=1 single fine subject to legal maximum
Separate PO=separate fines which in aggregate can exceed the legal maximum

55
Q

Supervision and enforcement in LED

A

mirrored provisions except for the absence of lead authority concept and financial penalties

GDPR (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions