Navigacija
GDPR > Članak 41.. Praćenje odobrenih kodeksa ponašanja
Preuzmite PDF

Članak 41. GDPR. Praćenje odobrenih kodeksa ponašanja

Article 41 GDPR. Monitoring of approved codes of conduct

1. Ne dovodeći u pitanje zadaće i ovlasti nadležnog nadzornog tijela iz članaka 57. i 58., praćenje sukladnosti s kodeksom ponašanja u skladu s člankom 40. može provoditi tijelo s odgovarajućim stupnjem stručnosti za predmet kodeksa i koje je u tu svrhu akreditiralo nadležno nadzorno tijelo.

1. Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.

2. Tijelo iz stavka 1. može biti akreditirano za praćenje sukladnosti s kodeksom ponašanja ako je to tijelo:

2. A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:

(a) nadležnom nadzornom tijelu zadovoljavajuće dokazalo svoju neovisnost i stručnost u predmetu kodeksa;

(a) demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;

(b) uspostavilo postupke koji mu omogućuju procjenu kvalificiranosti voditelja obrade i izvršitelja obrade za primjenu kodeksa, praćenje njihova poštovanja odredbi kodeksa i periodičnog preispitivanja njegova funkcioniranja;

(b) established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;

(c) uspostavilo postupke i strukture za rješavanje pritužbi na kršenja kodeksa ili na način na koji voditelj obrade ili izvršitelj obrade provode ili su proveli kodeks i učinilo te postupke i strukture transparentnima ispitanicima i javnosti; i

(c) established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and

(d) nadležnom nadzornom tijelu na njemu zadovoljavajući način dokazalo da njegove zadaće i dužnosti ne dovode do sukoba interesa.

(d) demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.

3. Nadležno nadzorno tijelo predaje nacrt kriterija za akreditaciju tijela iz stavka 1. ovog članka Odboru u skladu s mehanizmom konzistentnosti iz članka 63.

3. The competent supervisory authority shall submit the draft requirements for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.

Vezani tekstovi

4. Ne dovodeći u pitanje zadaće i ovlasti nadležnog nadzornog tijela i odredbe poglavlja VIII., tijelo iz stavka 1. ovog članka, uz primjenu prikladnih zaštitnih mjera, poduzima odgovarajuće radnje u slučajevima u kojima voditelj obrade ili izvršitelj obrade krše kodeks, što uključuje suspendiranje ili isključivanje dotičnog voditelja obrade ili izvršitelja obrade iz kodeksa. Ono izvješćuje nadležno nadzorno tijelo o takvim radnjama i razlozima za njihovo poduzimanje.

4. Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.

5. Nadležno nadzorno tijelo povlači akreditaciju tijela iz stavka 1. ako se ne ispune uvjeti za akreditaciju ili oni više nisu ispunjeni, ili radnje koje provodi tijelo krše ovu Uredbu.

5. The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the requirements for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.

6. Ovaj članak ne primjenjuje se na obradu obavljaju tijela javne vlasti i javna tijela.

6. This Article shall not apply to processing carried out by public authorities and bodies.

ISO 27701 Smjernice i sudska praksa Ostavite komentar
ISO 27701

(EN) ISO/IEC 27701, adopted in 2019, added a requirement additional to ISO/IEC 27001, section 4.1.

Here is the relevant paragraph to article 41 GDPR:

5.2.1 Understanding the organization and its context

The organization shall include among its interested parties (see ISO/IEC 27001:2013, 4.2), those parties having interests or responsibilities associated with the processing of PII, including the PII principals.

(EN) […]


to read the full text

Smjernice i sudska praksa Ostavite komentar
[js-disqus]