目录
GDPR > 第 56 條. 領導監管機關之權限
下载PDF

第 56 條 GDPR. 領導監管機關之權限

Article 56 GDPR. Competence of the lead supervisory authority

1. 於不損及第 55 條之前提下,該控管者或處理者之主要分支機構或 該單一分支機構之監管機關,應有權作為該控管者或處理者依第 60 條程序為跨境處理時之領導監管機關。

1. Without prejudice to Article 55, the supervisory authority of the main establishment or of the single establishment of the controller or processor shall be competent to act as lead supervisory authority for the cross-border processing carried out by that controller or processor in accordance with the procedure provided in Article 60.

连接数

2. 如標的事項僅涉及該會員國之單一分支機構、或受嚴重影響之資 料主體僅在該會員國時,各監管機關應有權處理提交至其之申訴、或 對本規則可能之違反,不受第 1 項之限制。

2. By derogation from paragraph 1, each supervisory authority shall be competent to handle a complaint lodged with it or a possible infringement of this Regulation, if the subject matter relates only to an establishment in its Member State or substantially affects data subjects only in its Member State.

3. 於本條第二項之情形,監管機關應通知領導監管機關該事項,不 得無故延遲。領導監管機關應於受通知起三週內,決定是否依第 60 條之程序處理該事項,並應考量監管機關通知之會員國內是否有控管 者或處理者之分支機構。

3. In the cases referred to in paragraph 2 of this Article, the supervisory authority shall inform the lead supervisory authority without delay on that matter. Within a period of three weeks after being informed the lead supervisory authority shall decide whether or not it will handle the case in accordance with the procedure provided in Article 60, taking into account whether or not there is an establishment of the controller or processor in the Member State of which the supervisory authority informed it.

连接数

4. 於領導監管機關決定處理該事項時,應遵循第 60 條之程序。通知 領導監管機關之監管機關得提交裁決草案至領導監管機關。領導監管 機關於依第 60 條第 3 項擬訂裁決時,應盡可能考慮該草案。

4. Where the lead supervisory authority decides to handle the case, the procedure provided in Article 60 shall apply. The supervisory authority which informed the lead supervisory authority may submit to the lead supervisory authority a draft for a decision. The lead supervisory authority shall take utmost account of that draft when preparing the draft decision referred to in Article 60(3).

连接数

5. 於領導監管機關決定不處理該事項時,通知領導監管機關之監管 機關應依第 61 條及第 62 條處理。

5. Where the lead supervisory authority decides not to handle the case, the supervisory authority which informed the lead supervisory authority shall handle it according to Articles 61 and 62.

6. 領導監管機關應為控管者或處理者於其執行跨境處理時,唯一之 溝通對口。

6. The lead supervisory authority shall be the sole interlocutor of the controller or processor for the cross-border processing carried out by that controller or processor.

前言 正式文件和决定 发表评论
前言

(36) 控管者於歐盟境內之主要分支機構應為其於歐盟境內核心管理 機構之所在地,但個人資料處理的目的及方式係由控管者於歐盟境內 另一分支機構所決定者,該分支機構應被視為主要分支機構。控管者 於歐盟境內之主要分支機構應按客觀標準判定之,且其應經由穩定之 安排而就個人資料處理之目的及方式等主要決策採取有效及有實際 執行之管理行動。判定主要分支機構之標準不得取決於個人資料處理 是否於該處所為之。為處理個人資料或其處理活動之技術方法或科技之存在與利用,其本身不構成主要分支機構,且因此並非主要分支機構之決定性標準。資料處理者之主要分支機構應為其於歐盟境內核心管理機構之所在地,或其於歐盟境內並無核心管理機構時,為其於歐盟境內為主要處理活動之所在地。於同時涉及控管者及處理者時,主管之領導監管機關應為控管者主要分支機構所在地會員國之監管機關,但處理者之監管機關應被視為係相關監管機關而應參與本規則所定之合作程序。在任何情況下,於裁決草案僅涉及控管者時,有一個或多個分支機構之資料處理者所在之一個或多個會員國監管機關均不得視為係相關監管機關。個人資料處理係由企業集團實施者,控制企業之主要分支機構應被認定為企業集團之主要分支機構,但個人資料處理之目的及方式係由其他企業所決定者,不在此限。

(36) The main establishment of a controller in the Union should be the place of its central administration in the Union, unless the decisions on the purposes and means of the processing of personal data are taken in another establishment of the controller in the Union, in which case that other establishment should be considered to be the main establishment. The main establishment of a controller in the Union should be determined according to objective criteria and should imply the effective and real exercise of management activities determining the main decisions as to the purposes and means of processing through stable arrangements. That criterion should not depend on whether the processing of personal data is carried out at that location. The presence and use of technical means and technologies for processing personal data or processing activities do not, in themselves, constitute a main establishment and are therefore not determining criteria for a main establishment. The main establishment of the processor should be the place of its central administration in the Union or, if it has no central administration in the Union, the place where the main processing activities take place in the Union. In cases involving both the controller and the processor, the competent lead supervisory authority should remain the supervisory authority of the Member State where the controller has its main establishment, but the supervisory authority of the processor should be considered to be a supervisory authority concerned and that supervisory authority should participate in the cooperation procedure provided for by this Regulation. In any case, the supervisory authorities of the Member State or Member States where the processor has one or more establishments should not be considered to be supervisory authorities concerned where the draft decision concerns only the controller. Where the processing is carried out by a group of undertakings, the main establishment of the controlling undertaking should be considered to be the main establishment of the group of undertakings, except where the purposes and means of processing are determined by another undertaking.

(124) 凡個人資料之處理係由控管者或處理者於歐盟境內之分支機 構所為,且該控管者或處理者在一個以上之會員國設立分支機構,或 凡資料處理係由控管者或處理者在歐盟境內之單一分支機構所為,而 該處理顯然影響或可能顯然影響一個以上會員國之資料主體者,該控 管者或處理者之主要分支機構或該單一分支機構之監管機關應擔任 領導機關之角色。因控管者或處理者在該會員國境內設有分支機構、 或因居住於該會員國境內之資料主體受到影響,或因已對該會員國之 監管機關提出申訴時,該領導機關應與其他相關機關合作。當資料主 體並非居住於某會員國,而對該國之監管機關提出申訴者,該監管機 關亦應屬相關監管機關。在委員會所負頒佈能涵蓋本規則適用所生任 何疑義之指導原則的任務中,其應得特別在考量因素之判斷標準上頒 佈指導原則,以確認該資料處理是否顯然影響一個以上會員國之資料 主體,以及何者能構成相關且合理之異議。

(124) Where the processing of personal data takes place in the context of the activities of an establishment of a controller or a processor in the Union and the controller or processor is established in more than one Member State, or where processing taking place in the context of the activities of a single establishment of a controller or processor in the Union substantially affects or is likely to substantially affect data subjects in more than one Member State, the supervisory authority for the main establishment of the controller or processor or for the single establishment of the controller or processor should act as lead authority. It should cooperate with the other authorities concerned, because the controller or processor has an establishment on the territory of their Member State, because data subjects residing on their territory are substantially affected, or because a complaint has been lodged with them. Also where a data subject not residing in that Member State has lodged a complaint, the supervisory authority with which such complaint has been lodged should also be a supervisory authority concerned. Within its tasks to issue guidelines on any question covering the application of this Regulation, the Board should be able to issue guidelines in particular on the criteria to be taken into account in order to ascertain whether the processing in question substantially affects data subjects in more than one Member State and on what constitutes a relevant and reasoned objection.

(125) 關於執行依本規則所授予之權力的措施,領導機關應有權限通 過有拘束力之裁決。在身為領導機關之資格下,監管機關應於裁決過 程中密集參與並協調相關監管機關。當該裁決係全部或部分駁回資料 主體之申訴時,受理該申訴之監管機關即應採納該裁決。

(125) The lead authority should be competent to adopt binding decisions regarding measures applying the powers conferred on it in accordance with this Regulation. In its capacity as lead authority, the supervisory authority should closely involve and coordinate the supervisory authorities concerned in the decision-making process. Where the decision is to reject the complaint by the data subject in whole or in part, that decision should be adopted by the supervisory authority with which the complaint has been lodged.

正式文件和决定 发表评论