Artikolu 58 📖 RĠPD (GDPR). Setgħat

Artikolu 58 RĠPD (GDPR). Setgħat

Article 58 GDPR. Powers

1. Kull awtorità superviżorja għandu jkollha s-setgħat kollha investigattivi li ġejjin:

1. Each supervisory authority shall have all of the following investigative powers:

(a) li tordna lill-kontrollur u l-proċessur, u, fejn applikabbli, lir-rappreżentant tal-kontrollur jew tal-proċessur biex jipprovdu kwalunkwe informazzjoni li tirrikjedi għat-twettiq tal-kompiti tagħha;

(a) to order the controller and the processor, and, where applicable, the controller’s or the processor’s representative to provide any information it requires for the performance of its tasks;

(b) li twettaq investigazzjonijiet fil-forma ta’ awditi tal-protezzjoni tad-data;

(b) to carry out investigations in the form of data protection audits;

(c) li twettaq rieżami ta’ ċertifikazzjonijiet maħruġa skont l-Artikolu 42(7);

(c) to carry out a review on certifications issued pursuant to Article 42(7);

Testi relatati

Artikolu 42 RĠPD (GDPR). Ċertifikazzjoni

Article 42 GDPR. Certification

[…]

7. Iċ-ċertifikazzjoni għandha tinħareġ lil kontrollur jew proċessur għal perijodu massimu ta’ tliet snin u tista’ tiġġedded, skont l-istess kondizzjonijiet, sakemm jibqgħu jiġu sodisfatti r-rekwiżiti rilevanti. Iċ-ċertifikazzjoni għandha tiġi rtirata, fejn applikabbli, mill-korpi ta’ ċertifikazzjoni msemmija fl-Artikolu 43, jew mill-awtorità superviżorja kompetenti fejn ma jiġux sodisfatti jew ma jibqgħux jiġu sodisfatti r-rekwiżiti għaċ-ċertifikazzjoni.

7. Certification shall be issued to a controller or processor for a maximum period of three years and may be renewed, under the same conditions, provided that the relevant criteria continue to be met. Certification shall be withdrawn, as applicable, by the certification bodies referred to in Article 43 or by the competent supervisory authority where the criteria for the certification are not or are no longer met.

[…]

(d) li tinnotifika lill-kontrollur jew il-proċessur dwar ksur allegat ta’ dan ir-Regolament;

(d) to notify the controller or the processor of an alleged infringement of this Regulation;

(e) li tikseb, mill-kontrollur u l-proċessur, aċċess għad-data personali kollha u għall-informazzjoni kollha meħtieġa għat-twettiq tal-kompiti tagħha;

(e) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks;

(f) li tikseb aċċess għal kwalunkwe bini tal-kontrollur u l-proċessur, inkluż għal kwalunkwe tagħmir u mezz għall-ipproċessar tad-data, f’konformità mal-liġi proċedurali tal-Unjoni jew il-liġi proċedurali tal-Istat Membru.

(f) to obtain access to any premises of the controller and the processor, including to any data processing equipment and means, in accordance with Union or Member State procedural law.

2. Kull awtorità superviżorja għandu jkollha s-setgħat kollha korrettivi li ġejjin:

2. Each supervisory authority shall have all of the following corrective powers:

(a) li toħroġ twissijiet lil kontrollur jew proċessur li l-operazzjonijiet ta’ pproċessar maħsuba x’aktarx jiksru dispożizzjonijiet ta’ dan ir-Regolament;

(a) to issue warnings to a controller or processor that intended processing operations are likely to infringe provisions of this Regulation;

(b) li ċċanfar kontrollur jew proċessur fejn l-operazzjonijiet ta’ pproċessar ikunu kisru dispożizzjonijiet ta’ dan ir-Regolament;

(b) to issue reprimands to a controller or a processor where processing operations have infringed provisions of this Regulation;

(c) li tordna lill-kontrollur jew il-proċessur jikkonforma mat-talbiet tas-suġġett tad-data li jeżerċita d-drittijiet tiegħu skont dan ir-Regolament;

(c) to order the controller or the processor to comply with the data subject’s requests to exercise his or her rights pursuant to this Regulation;

(d) li tordna lill-kontrollur jew il-proċessur jagħmel operazzjonijiet ta’ pproċessar konformi mad-dispożizzjonijiet ta’ dan ir-Regolament, fejn xieraq, b’mod speċifiku u f’perijodu ta’ żmien speċifiku;

(d) to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specified manner and within a specified period;

(e) li tordna lill-kontrollur jikkomunika ksur ta’ data personali lis-suġġett tad-data;

(e) to order the controller to communicate a personal data breach to the data subject;

(f) li timponi limitazzjoni temporanja jew definittiva inkluża projbizzjoni fuq l-ipproċessar;

(f) to impose a temporary or definitive limitation including a ban on processing;

(g) li tordna r-rettifika jew it-tħassir ta’ data personali jew ir-restrizzjoni tal-ipproċessar skont l-Artikoli 16, 17 u 18 u n-notifika ta’ tali azzjonijiet lir-riċevituri li lilhom tkun ġiet żvelata d-data personali skont l-Artikolu 17(2) u l-Artikolu 19;

(g) to order the rectification or erasure of personal data or restriction of processing pursuant to Articles 16, 17 and 18 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to Article 17(2) and Article 19;

Testi relatati

Artikolu 16 RĠPD (GDPR). Dritt għar-rettifika

Article 16 GDPR. Right to rectification

Is-suġġett tad-data għandu d-dritt li jikseb mingħand il-kontrollur mingħajr dewmien żejjed ir-rettifika ta’ data personali li tikkonċerna lilu li ma tkunx eżatta. B’kont meħud tal-għanijiet tal-ipproċessar, is-suġġett tad-data għandu d-dritt li jikseb il-kompletezza tad-data personali mhux kompluta, inkluż billi jipprovdi dikjarazzjoni supplimentari.

The data subject shall have the right to obtain from the controller without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

Artikolu 17 RĠPD (GDPR). Dritt għal tħassir (“dritt li wieħed jintesa”)

Article 17 GDPR. Right to erasure (‘right to be forgotten’)

[…]

2. Fejn il-kontrollur ikun ippubblika d-data personali u jiġi obbligat skont il-paragrafu 1 li jħassar id-data personali, il-kontrollur, b’kont meħud tat-teknoloġija disponibbli u l-ispiża tal-implimentazzjoni, għandu jieħu passi raġonevoli, inklużi miżuri tekniċi, biex jinforma lill-kontrolluri li jkunu qegħdin jipproċessaw id-data personali, li s-suġġett tad-data talabhom iħassru kwalunkwe konnessjoni għal dik id-data personali, jew koppja jew replika tagħha.

2. Where the controller has made the personal data public and is obliged pursuant to paragraph 1 to erase the personal data, the controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

[…]

Artikolu 18 RĠPD (GDPR). Dritt għal restrizzjoni tal-ipproċessar

Article 18 GDPR. Right to restriction of processing

Artikolu 19 RĠPD (GDPR). Obbligu ta' notifika rigward rettifika jew tħassir ta' data personali jew restrizzjoni tal-ipproċessar

Article 19 GDPR. Notification obligation regarding rectification or erasure of personal data or restriction of processing

Il-kontrollur għandu jikkomunika kwalunkwe rettifika jew tħassir ta’ data personali jew restrizzjoni tal-ipproċessar imwettqa f’konformità mal-Artikolu 16, l-Artikolu 17(1) u l-Artikolu 18 lil kull riċevitur li lilu tkun ġiet żvelata d-data personali, għajr jekk dan jirriżulta impossibbli jew ikun jinvolvi sforz sproporzjonat. Il-kontrollur għandu jinforma lis-suġġett tad-data dwar dawk ir-riċevituri jekk is-suġġett tad-data jitlob dan.

The controller shall communicate any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. The controller shall inform the data subject about those recipients if the data subject requests it.

(h) li tirtira ċertifikazzjoni jew li tordna lill-korp taċ-ċertifikazzjoni biex jirtira ċertifikazzjoni maħruġa skont l-Artikolu 42 u 43, jew li tordna lill-korp taċ-ċertifikazzjoni biex ma joħroġx ċertifikazzjoni jekk ma jkunux jew ma jibqgħux sodisfatti r-rekwiżiti għaċ-ċertifikazzjoni;

(h) to withdraw a certification or to order the certification body to withdraw a certification issued pursuant to Articles 42 and 43, or to order the certification body not to issue certification if the requirements for the certification are not or are no longer met;

Testi relatati

Artikolu 42 RĠPD (GDPR). Ċertifikazzjoni

Article 42 GDPR. Certification

Artikolu 43 RĠPD (GDPR). Korpi ta' ċertifikazzjoni

Article 43 GDPR. Certification bodies

(i) li timponi multa amministrattiva skont l-Artikolu 83, flimkien ma’, jew minflok il-miżuri msemmija f’dan il-paragrafu, skont iċ-ċirkostanzi ta’ kull każ individwali;

(i) to impose an administrative fine pursuant to Article 83, in addition to, or instead of measures referred to in this paragraph, depending on the circumstances of each individual case;

(j) li tordna s-sospensjoni ta’ flussi ta’ data lejn riċevitur f’pajjiż terz jew lejn organizzazzjoni internazzjonali.

(j) to order the suspension of data flows to a recipient in a third country or to an international organisation.

3. Kull awtorità superviżorja għandu jkollha s-setgħat kollha konsultattivi u ta’ awtorizzazzjoni li ġejjin:

3. Each supervisory authority shall have all of the following authorisation and advisory powers:

(a) li tagħti parir lill-kontrollur f’konformità mal-proċedura ta’ konsultazzjoni minn qabel imsemmija fl-Artikolu 36;

(a) to advise the controller in accordance with the prior consultation procedure referred to in Article 36;

Testi relatati

Artikolu 36 RĠPD (GDPR). Konsultazzjoni minn qabel

Article 36 GDPR. Prior consultation

(b) li tagħti, fuq l-inizjattiva tagħha stess jew fuq talba, opinjonijiet lill-parlament nazzjonali, il-gvern tal-Istat Membru jew, f’konformità mal-liġi tal-Istat Membru, lil istituzzjonijiet u korpi oħra kif ukoll lill-pubbliku dwar kwalunkwe kwistjoni marbuta mal-protezzjoni tad-data personali;

(b) to issue, on its own initiative or on request, opinions to the national parliament, the Member State government or, in accordance with Member State law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(c) li tawtorizza l-ipproċessar imsemmi fl-Artikolu 36(5), jekk il-liġi tal-Istat Membru teħtieġ tali awtorizzazzjoni minn qabel;

(c) to authorise processing referred to in Article 36(5), if the law of the Member State requires such prior authorisation;

Testi relatati

Artikolu 36 RĠPD (GDPR). Konsultazzjoni minn qabel

Article 36 GDPR. Prior consultation

[…]

5. Minkejja l-paragrafu 1, il-liġi tal-Istat Membru tista’ tirrikjedi li l-kontrolluri jikkonsultaw mal-awtorità superviżorja u jiksbu awtorizzazzjoni minn qabel minnha b’rabta mal-ipproċessar minn kontrollur għall-prestazzjoni ta’ kompitu mwettaq minn kontrollur fl-interess pubbliku, inkluż l-ipproċessar b’rabta mal-protezzjoni soċjali u s-saħħa pubblika.

5. Notwithstanding paragraph 1, Member State law may require controllers to consult with, and obtain prior authorisation from, the supervisory authority in relation to processing by a controller for the performance of a task carried out by the controller in the public interest, including processing in relation to social protection and public health.

(d) li toħroġ opinjoni u tapprova abbozzi ta’ kodiċijiet ta’ kondotta skont l-Artikolu 40(5);

(d) to issue an opinion and approve draft codes of conduct pursuant to Article 40(5);

Testi relatati

Artikolu 40 RĠPD (GDPR). Kodiċijiet ta' kondotta

Article 40 GDPR. Codes of conduct

[…]

5. L-assoċjazzjonijiet u korpi oħra msemmija fil-paragrafu 2 ta’ dan l-Artikolu li għandhom l-għan li jħejju kodiċi ta’ kondotta jew li jemendaw jew jestendu kodiċi eżistenti, għandhom jippreżentaw l-abbozz ta’ kodiċi, l-emenda jew l-estensjoni lill-awtorità superviżorja li hija kompetenti skont l-Artikolu 55. L-awtorità superviżorja għandha tipprovdi opinjoni dwar jekk l-abbozz ta’ kodiċi, l-emenda jew l-estensjoni jikkonformawx ma’ dan ir-Regolament u għandha tapprova tali abbozz ta’ kodiċi, emenda jew estensjoni jekk hija tqis li jipprovdu biżżejjed salvagwardji xierqa.

5. Associations and other bodies referred to in paragraph 2 of this Article which intend to prepare a code of conduct or to amend or extend an existing code shall submit the draft code, amendment or extension to the supervisory authority which is competent pursuant to Article 55. The supervisory authority shall provide an opinion on whether the draft code, amendment or extension complies with this Regulation and shall approve that draft code, amendment or extension if it finds that it provides sufficient appropriate safeguards.

[…]

(e) li takkredita korpi ta’ ċertifikazzjoni skont l-Artikolu 43;

(e) to accredit certification bodies pursuant to Article 43;

Testi relatati

Artikolu 43 RĠPD (GDPR). Korpi ta' ċertifikazzjoni

Article 43 GDPR. Certification bodies

(f) li toħroġ ċertifikazzjonijiet u tapprova kriterji ta’ ċertifikazzjoni f’konformità mal-Artikolu 42(5);

(f) to issue certifications and approve criteria of certification in accordance with Article 42(5);

Testi relatati

Artikolu 42 RĠPD (GDPR). Ċertifikazzjoni

Article 42 GDPR. Certification

[…]

5. Ċertifikazzjoni skont dan l-Artikolu għandha tinħareġ mill-korpi ta’ ċertifikazzjoni msemmija fl-Artikolu 43, jew mill-awtorità superviżorja kompetenti abbażi ta’ kriterji approvati mill-awtorità superviżorja kompetenti jew mill-Bord, skont l-Artikolu 63. Fejn il-kriterji huma approvati mill-Bord, dan jista’ jirriżulta f’ċertifikazzjoni komuni, is-Siġill Ewropew għall-Protezzjoni tad-Data.

5. A certification pursuant to this Article shall be issued by the certification bodies referred to in Article 43 or by the competent supervisory authority, on the basis of criteria approved by that competent supervisory authority pursuant to Article 58(3) or by the Board pursuant to Article 63. Where the criteria are approved by the Board, this may result in a common certification, the European Data Protection Seal.

[…]

(g) li tadotta l-klawżoli standard ta’ protezzjoni tad-data msemmija fl-Artikolu 28(8) u fil-punt (d) tal-Artikolu 46(2);

(g) to adopt standard data protection clauses referred to in Article 28(8) and in point (d) of Article 46(2);

Testi relatati

Artikolu 28 RĠPD (GDPR). Proċessur

Article 28 GDPR. Processor

[…]

8. Awtorità superviżorja tista’ tadotta klawżoli kuntrattwali standard għall-kwistjonijiet imsemmijin fil-paragrafu 3 u 4 ta’dan l-Artikolu u f’konformità mal-mekkaniżmu ta’ konsistenza msemmi fl-Artikolu 63.

8. A supervisory authority may adopt standard contractual clauses for the matters referred to in paragraph 3 and 4 of this Article and in accordance with the consistency mechanism referred to in Article 63.

[…]

Artikolu 46 RĠPD (GDPR). Trasferimenti soġġetti għal salvagwardji xierqa

Article 46 GDPR. Transfers subject to appropriate safeguards

2. Is-salvagwardji xierqa msemmija fil-paragrafu 1 jistgħu jkunu previsti, mingħajr ma jkun jinħtieġ ebda awtorizzazzjoni speċifika minn awtorità superviżorja, permezz ta’:

2. The appropriate safeguards referred to in paragraph 1 may be provided for, without requiring any specific authorisation from a supervisory authority, by:

(d) klawżoli standard ta’ protezzjoni tad-data adottati minn awtorità superviżorja u approvati mill-Kummissjoni skont il-proċedura ta’ eżami msemmija fl-Artikolu 93(2); jew

(d) standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure referred to in Article 93(2);

(h) li tawtorizza l-klawżoli kuntrattwali msemmija fil-punt (a) tal-Artikolu 46(3);

(h) to authorise contractual clauses referred to in point (a) of Article 46(3);

Testi relatati

Artikolu 46 RĠPD (GDPR). Trasferimenti soġġetti għal salvagwardji xierqa

Article 46 GDPR. Transfers subject to appropriate safeguards

3. Soġġett għall-awtorizzazzjoni mill-awtorità superviżorja kompetenti, is-salvagwardji xierqa msemmija fil-paragrafu 1 jistgħu wkoll jiġu previsti, B’mod partikolari permezz ta’:

3. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:

(a) klawżoli kuntrattwali bejn il-kontrollur jew il-proċessur u l-kontrollur, il-proċessur jew ir-riċevitur tad-data personali fil-pajjiż terz jew l-organizzazzjoni internazzjonali; jew

(a) contractual clauses between the controller or processor and the controller, processor or the recipient of the personal data in the third country or international organisation; or

(i) li tawtorizza l-arranġamenti amministrattivi msemmija fil-punt (b) tal-Artikolu 46(3);

(i) to authorise administrative arrangements referred to in point (b) of Article 46(3);

Testi relatati

Artikolu 46 RĠPD (GDPR). Trasferimenti soġġetti għal salvagwardji xierqa

Article 46 GDPR. Transfers subject to appropriate safeguards

3. Soġġett għall-awtorizzazzjoni mill-awtorità superviżorja kompetenti, is-salvagwardji xierqa msemmija fil-paragrafu 1 jistgħu wkoll jiġu previsti, B’mod partikolari permezz ta’:

3. Subject to the authorisation from the competent supervisory authority, the appropriate safeguards referred to in paragraph 1 may also be provided for, in particular, by:

(b) dispożizzjonijiet li għandhom jiddaħħlu f’arranġamenti amministrattivi bejn l-awtoritajiet jew il-korpi pubbliċi li jinkludu drittijiet infurzabbli u effettivi tas-suġġett tad-data.

(b) provisions to be inserted into administrative arrangements between public authorities or bodies which include enforceable and effective data subject rights.

(j) li tapprova regoli korporattivi vinkolanti skont l-Artikolu 47.

(j) to approve binding corporate rules pursuant to Article 47.

Testi relatati

Artikolu 47 RĠPD (GDPR). Regoli korporattivi vinkolanti

Article 47 GDPR. Binding corporate rules

4. L-eżerċizzju tas-setgħat ikkonferiti lill-awtorità superviżorja skont dan l-Artikolu għandu jkun soġġett għal salvagwardji xierqa, inklużi r-rimedju ġudizzjarju effettiv u l-proċess ġust, stabbiliti fil-liġi tal-Unjoni u l-liġijiet tal-Istati Membri f’konformità mal-Karta.

4. The exercise of the powers conferred on the supervisory authority pursuant to this Article shall be subject to appropriate safeguards, including effective judicial remedy and due process, set out in Union and Member State law in accordance with the Charter.

5. Kull Stat Membru għandu jipprevedi bil-liġi li l-awtorità superviżorja tiegħu għandu jkollha s-setgħa li tiġbed l-attenzjoni tal-awtoritajiet ġudizzjarji għal ksur ta’ dan ir-Regolament u, fejn xieraq, tibda jew timpenja ruħha b’mod ieħor fi proċedimenti legali, sabiex tinforza d-dispożizzjonijiet ta’ dan ir-Regolament.

5. Each Member State shall provide by law that its supervisory authority shall have the power to bring infringements of this Regulation to the attention of the judicial authorities and where appropriate, to commence or engage otherwise in legal proceedings, in order to enforce the provisions of this Regulation.

6. Kull Stat Membru jista’ jipprevedi bil-liġi li l-awtorità superviżorja tiegħu għandu jkollha setgħat addizzjonali minbarra dawk imsemmija fil-paragrafi 1, 2 u 3. L-eżerċizzju ta’ dawk is-setgħat ma għandux jostakola l-operazzjoni effettiva tal-Kapitolu VII.

6. Each Member State may provide by law that its supervisory authority shall have additional powers to those referred to in paragraphs 1, 2 and 3. The exercise of those powers shall not impair the effective operation of Chapter VII.

Regolament Ġenerali dwar il-Protezzjoni tad-Data (RĠPD, GDPR)

General Data Protection Regulation (EU GDPR)

The latest consolidated version of the Regulation with corrections by Corrigendum, OJ L 127, 23.5.2018, p. 2 ((EU) 2016/679). Source: EUR-lex.

Premessi Linji ta 'Gwida & Ġurisprudenza Ħalli kumment

Premessi

(129) Sabiex jiġu żgurati monitoraġġ u infurzar konsistenti ta' dan ir-Regolament kullimkien fl-Unjoni, f'kull wieħed mill-Istati Membri, l-awtoritajiet superviżorji għandu jkollhom l-istess kompiti u setgħat effettivi, inklużi setgħat investigattivi, setgħat korrettivi u sanzjonijiet, u setgħat ta' awtorizzazzjoni u konsultattivi, b'mod partikolari f'każijiet ta' ilmenti minn persuni fiżiċi, u mingħajr preġudizzju għas-setgħat tal-awtoritajiet tal-prosekuzzjoni taħt il-liġi tal-Istat Membru, biex iressqu l-ksur ta' dispożizzjonijiet f'dan ir-Regolament għall-attenzjoni tal-awtoritajiet ġudizzjarji u jidħlu fi proċedimenti legali. Dawn is-setgħat għandhom jinkludu wkoll is-setgħa li tiġi imposta limitazzjoni temporanja jew definittiva, inkluża projbizzjoni, fuq l-ipproċessar. L-Istati Membri jistgħu jispeċifikaw kompiti oħra relatati mal-protezzjoni ta' data personali skont dan ir-Regolament. Is-setgħat tal-awtoritajiet superviżorji għandhom jiġu eżerċitati f'konformità ma' salvagwardji proċedurali xierqa stabbiliti fil-liġi tal-Unjoni u fil-liġijiet tal-Istati Membri, b'mod imparzjali, ġust u fil-mument opportun. B'mod partikolari, kull miżura għandha tkun xierqa, meħtieġa u proporzjonata sabiex tiġi żgurata l-konformità ma' dan ir-Regolament, b'kont meħud taċ-ċirkostanzi ta' kull każ individwali, ir-rispett tad-dritt ta' kull persuna li tinstema' qabel ma tittieħed kwalunkwe miżura individwali li tolqotha ħażin u biex jiġu evitati spejjeż żejda u inkonvenjenzi eċċessivi għall-persuni kkonċernati. Is-setgħat investigattivi rigward l-aċċess għall-bini għandhom jitħaddmu f'konformità ma' rekwiżiti speċifiċi fil-liġi proċedurali tal-Istat Membru, bħalma huwa r-rekwiżit li tinkiseb awtorizzazzjoni ġudizzjarja minn qabel. Kull miżura legalment vinkolanti tal-awtorità superviżorja għandha tkun bil-miktub, ċara u mhux ambigwa, għandha tindika l-awtorità superviżorja li tkun ħarġet l-miżura, id-data tal-ħruġ tal-miżura, għandha tkun iffirmata mill-kap, jew membru tal-awtorità superviżorja awtorizzata minnu jew minnha, għandha tagħti r-raġunijiet għall-miżura, u tirreferi għad-dritt għal rimedju effettiv. Dan ma għandux jipprekludi rekwiżiti addizzjonali skont il-liġi proċedurali tal-Istat Membru. L-adozzjoni ta' deċiżjoni legalment vinkolanti timplika li din tista' tagħti lok għal stħarriġ ġudizzjarju fl-Istat Membru tal-awtorità superviżorja li adottat id-deċiżjoni.

(129) In order to ensure consistent monitoring and enforcement of this Regulation throughout the Union, the supervisory authorities should have in each Member State the same tasks and effective powers, including powers of investigation, corrective powers and sanctions, and authorisation and advisory powers, in particular in cases of complaints from natural persons, and without prejudice to the powers of prosecutorial authorities under Member State law, to bring infringements of this Regulation to the attention of the judicial authorities and engage in legal proceedings. Such powers should also include the power to impose a temporary or definitive limitation, including a ban, on processing. Member States may specify other tasks related to the protection of personal data under this Regulation. The powers of supervisory authorities should be exercised in accordance with appropriate procedural safeguards set out in Union and Member State law, impartially, fairly and within a reasonable time. In particular each measure should be appropriate, necessary and proportionate in view of ensuring compliance with this Regulation, taking into account the circumstances of each individual case, respect the right of every person to be heard before any individual measure which would affect him or her adversely is taken and avoid superfluous costs and excessive inconveniences for the persons concerned. Investigatory powers as regards access to premises should be exercised in accordance with specific requirements in Member State procedural law, such as the requirement to obtain a prior judicial authorisation. Each legally binding measure of the supervisory authority should be in writing, be clear and unambiguous, indicate the supervisory authority which has issued the measure, the date of issue of the measure, bear the signature of the head, or a member of the supervisory authority authorised by him or her, give the reasons for the measure, and refer to the right of an effective remedy. This should not preclude additional requirements pursuant to Member State procedural law. The adoption of a legally binding decision implies that it may give rise to judicial review in the Member State of the supervisory authority that adopted the decision.

Linji ta 'Gwida & Ġurisprudenza

(EN)

Case law

CJEU, Data Protection Commissioner/Facebook Ireland Ltd and Schrems, C-311/18 (2020).

Ħalli kumment

[js-disqus]