Self-regulation & the European Data Protection Board for CIPP-E

What is self-regulation under the GDPR?

An organization’s supervision and enforcement of its own policies, processes, and procedures.

Examples: through risk assessments, control implementation, and ongoing monitoring

How well did you know this?

Not at all

Perfectly

How does GDPR support self-regulation?

Through accountability
DPOs
Codes of conduct
Certifications
Controller-processor relationship requirements

How well did you know this?

Not at all

Perfectly

When is a DPIA required under Article 35?

When processing is likely to result in high risk to individuals’ rights and freedoms.

How well did you know this?

Not at all

Perfectly

What is a key feature of DPIA-related consultation?

Consultation with a DPA is required if high risk remains despite mitigation measures.

How well did you know this?

Not at all

Perfectly

What is the role of a Data Protection Officer?

(DPO)

A supervisory and enforcement figure required to cooperate with DPAs and not subject to dismissal.

How well did you know this?

Not at all

Perfectly

How is a DPO described under GDPR?

More like a quasi-regulator than a traditional employee.

How well did you know this?

Not at all

Perfectly

Why should organizations follow a code of conduct?

To enhance and demonstrate compliance, build trust, apply best practices, and gain competitive edge.

How well did you know this?

Not at all

Perfectly

Who drafts a code of conduct?

A representative body

Example: an industry association

How well did you know this?

Not at all

Perfectly

To whom is a national code of conduct submitted for approval?

The competent Data Protection Authority

(DPA)

How well did you know this?

Not at all

Perfectly

To whom is a transnational code of conduct submitted?

The European Data Protection Board

(EDPB)

How well did you know this?

Not at all

Perfectly

What happens after a code of conduct is approved?

It is published and subject to ongoing monitoring.

How well did you know this?

Not at all

Perfectly

What are the requirements for a monitoring body?

Independence
Expertise
Procedures for monitoring
Complaint handling
Violation response capacity

How well did you know this?

Not at all

Perfectly

What roles do DPAs retain with codes of conduct?

Supervisory and enforcement roles

Includes levying fines and revoking accreditation

How well did you know this?

Not at all

Perfectly

What is a key feature of certification under GDPR?

Provides outward transparency and a visible certificate, seal, or mark.

How well did you know this?

Not at all

Perfectly

How long is certification valid?

Up to 3 years

How well did you know this?

Not at all

Perfectly

How is a code of conduct different from certification?

A code is:

Internal
Sector-specific
Demonstrates compliance to regulators

How well did you know this?

Not at all

Perfectly

What is the consistency mechanism?

A cooperation framework among:

Supervisory authorities
EDPB
European Commission

Ensures consistent GDPR application across EU.

How well did you know this?

Not at all

Perfectly

How do organizations identify the appropriate DPA for transnational codes?

By considering:

Processing activity
Sector
Data subjects affected
Location of code or monitoring body headquarters

How well did you know this?

Not at all

Perfectly

What options do data subjects have to enforce GDPR rights?

Litigate within national framework
File complaint with DPA

How well did you know this?

Not at all

Perfectly

What is typically the easiest and cheapest way to enforce GDPR rights?

Filing a complaint with the Data Protection Authority

(DPA)

How well did you know this?

Not at all

Perfectly

Where can data subjects file a GDPR complaint?

Place of residence
Place of work
Where the infringement occurred

How well did you know this?

Not at all

Perfectly

What are representative actions?

Group litigation/class actions to help citizens collectively enforce GDPR rights.

How well did you know this?

Not at all

Perfectly

Who can represent individuals in representative actions?

Civil Society Organizations
Privacy advocates
Pressure groups

How well did you know this?

Not at all

Perfectly

What types of damage can compensation claims cover?

Material (financial loss)
Non-material (emotional distress, reputational harm)

How well did you know this?

Not at all

Perfectly

When can a data subject **take action** against a regulator?

* Dissatisfied with resolution * No response within 3 months

What is another name for **National Supervisory Authorities** under the GDPR?

Data Protection Authorities | (DPAs)

What **powers** do DPAs have?

Administrative **supervisory** and **enforcement** powers.

What must **member states** do under GDPR regarding regulators?

**Appoint an independent authority** to monitor GDPR implementation.

What is the **lawmaking consultation** requirement?

Legislators **must involve DPAs** in the law-making process for data protection.

What are some **responsibilities** of DPAs?

* Promote awareness * Investigate complaints * Monitor technological developments * Support consistent GDPR application

What **tools** and **areas** do DPAs oversee?

* DPIAs * Codes and certifications * SCCs and BCRs * Infringement records * DPA activity reports

What are the **3 types of powers** DPAs have under GDPR?

* Investigatory * Corrective * Authorization and advisory

What are **investigatory** powers?

Permit access to evidence, accountability documentation, audits, hardware inspections.

What are **corrective** powers?

Include issuing warnings and stopping processing activities.

What are **authorization and advisory** powers?

Approving certifications, codes of conduct, and international transfers (SCCs, BCRs).

What is the **litigation power** of DPAs?

The power to force compliance **through courts**.

What does '**legal competence**' refer to under the GDPR?

The **authority of a DPA** to carry out supervisory and enforcement activities.

What are the **3 'C’s'** the GDPR uses to allocate legal competence?

1. Competence 2. Cooperation 3. Consistency

When is a DPA **domestically** competent?

When a controller or processor is: * **Established in its member state**, or * When the processing **affects its member state**

What is **cross-border processing** under GDPR?

Processing by a controller or processor: * In **multiple member states** or * **Affecting data subjects** in multiple member states

What is the **lead supervisory authority** (LSA)?

The **DPA with competence** when cross-border processing occurs. ## Footnote Determined by the controller's or processor's main establishment

What is the **one-stop-shop** principle?

The **LSA acts as the sole interlocutor** for cross-border processing activities.

What **determines** a controller’s main establishment?

Where **decisions about processing** are made. ## Footnote Example: the HQ or central administration

Can the **location** of the main establishment **change**?

Yes ## Footnote It moves to the place with **decision-making power** over processing.

What is a **potential issue** between lead and non-lead DPAs?

A '**battle of competence**' over who has authority.

What is a '**reasoned objection**' in the cooperation process?

A DPA's **formal response to a draft decision** that must be considered by the lead supervisory authority.

What are the **2 main channels of cooperation** between DPAs?

1. Mutual assistance 2. Joint operations

What is **mutual assistance** between DPAs?

Obligation to **share information** and **support investigations** and enforcement actions. ## Footnote Example: French DPA investigating company in France with branch in Germany and enlisting help of German DPA

What is a **joint operation** between DPAs?

**Collaborative enforcement actions** with shared staff and resources.

What is the **EDPB**?

The European Data Protection Board: * Successor to WP29 * Responsible for ensuring consistent application of data protection law

Who **comprises** the EDPB?

* Chairperson * Heads of DPAs * EDPS * Delegate from the European Commission

What is the **purpose** of the **consistency mechanism**?

Ensure **uniform interpretation and enforcement** of data protection law across the EU.

What are the **main procedures** of the consistency mechanism?

* Issuing opinions * Making binding decisions * Providing guidance

When are EDPB opinions **required**?

* DPIA processing lists * Draft code of conduct amendments * Certification body approvals * SCC/BCR approvals

What **triggers dispute resolution** by the EDPB?

* LSA rejects objections * Dispute over competent authority * Failure to refer matters to EDPB

What is the **urgency procedure** under GDPR?

Allows DPAs to **adopt temporary measures** for up to 3 months when time is insufficient for cooperation.

What are the **2 main categories** of fines under GDPR Article 83?

* Up to 10 million Euro, or * 2% of global annual turnover for undertakings ## Footnote Lower amounts for non-undertakings

What is the **maximum fine** under Article 83(5) for undertakings?

Up to: * 20 million Euro, or * 4% of global annual turnover

What **factors** must fines be according to GDPR?

* Effective * Proportionate * Dissuasive

What are some **factors considered** when **calculating fines**?

* Nature of infringement * Gravity * Duration * Intent * Mitigation efforts * Cooperation * Previous infringements

What is the full title of **Opinion 04/2024**?

Opinion 04/2024 on the notion of main establishment of a controller in the Union under Article 4(16)(a) GDPR.

According to the EDPB, when can a controller’s '**place of central administration**' be considered the main establishment?

Only if it **decides on the purpose and means of processing** and has the **power to have these decisions implemented**.

What happens if the required conditions for main establishment are exercised **outside the Union**?

There is **no main establishment** and the **one-stop-shop does not apply**.

Self-regulation & the European Data Protection Board Flashcards

Explore codes of conduct, certification mechanisms, and the roles of the European Data Protection Board and national supervisory authorities. (63 cards)