33
15039/15
VH/np
133
ANNEX
DGD 2C
LIMITE
EN
1b. Such a code of conduct pursuant to paragraph 1a shall contain mechanisms which enable the
body referred to in paragraph 1 of article 38a to carry out the mandatory monitoring of
compliance with its provisions by the controllers or processors which undertake to apply it,
without prejudice to the tasks and powers of the supervisory authority which is competent
pursuant to Article 51 or 51a.
2.
Associations and other bodies referred to in paragraph 1a which intend to prepare a code of
conduct or to amend or extend an existing code, shall submit the draft code to the supervisory
authority which iscompetent pursuant to Article 51. The supervisory authority shall give an
opinion on whether the draft code, or amended or extended code is in compliance with this
Regulation and shall approve such draft, amended or extended code if it finds that it provides
sufficient appropriate safeguards.
2a. Where the opinion referred to in paragraph 2 confirms that the code of conduct, or amended
or extended code, is in compliance with this Regulation and the code is approved, and if the
code of conduct does not relate to processing activities in several Member States, the
supervisory authority shall register and publish the code.
2b. Where the draft code of conduct relates to processing activities in several Member States, the
supervisory authority competent pursuant to Article 51 shall, before approval, submit it in the
procedure referred to in Article 57 to the European Data Protection Board which shall give an
opinion on whether the draft code, or amended or extended code, is in compliance with this
Regulation or, in the situation referred to in paragraph 1ab, provides appropriate safeguards.
3.
Where the opinion referred to in paragraph 2b confirms that the codes of conduct, or amended
or extended codes, is in compliance with this Regulation, or, in the situation referred to in
paragraph 1ab, provides appropriate safeguards, the European Data Protection Board shall
submit its opinion to the Commission.
37
15039/15
VH/np
134
ANNEX
DGD 2C
LIMITE
EN
4.
The Commission may adopt implementing acts for deciding that the approved codes of
conduct and amendments or extensions to existing approved codes of conduct submitted to it
pursuant to paragraph 3 have general validity within the Union. Those implementing acts
shall be adopted in accordance with the examination procedure set out in Article 87(2).
5.
The Commission shall ensure appropriate publicity for the approved codes which have been
decided as having general validity in accordance with paragraph 4.
5a. The European Data Protection Board shall collect all approved codes of conduct and
amendments thereto in a register and shall make them publicly available through any
appropriate means.
Article 38a
Monitoring of approved codes of conduct
1.
Without prejudice to the tasks and powers of the competent supervisory authority under
Articles 52 and 53, the monitoring of compliance with a code of conduct pursuant to Article
38, may be carried out by a body which has an appropriate level of expertise in relation to the
subject-matter of the code and is accredited for this purpose by the competent supervisory
authority.
2.
A body referred to in paragraph 1 may be accredited for this purpose if:
(a) it has demonstrated its independence and expertise in relation to the subject-matter of
the code to the satisfaction of the competent supervisory authority;
(b) it has established procedures which allow it to assess the eligibility of controllers and
processors concerned to apply the code, to monitor their compliance with its provisions
and to periodically review its operation;
(c) it has established procedures and structures to deal with complaints about infringements
of the code or the manner in which the code has been, or is being, implemented by a
controller or processor, and to make these procedures and structures transparent to data
subjects and the public;
VB.NET PDF: Get Started with PDF Library Document Protect. Password: Set File Permissions. Password: Open Document. Edit Digital Help VB.NET User Have Quick Evaluation of .NET PDF SDK with
copy from protected pdf; create password protected pdf
36
15039/15
VH/np
135
ANNEX
DGD 2C
LIMITE
EN
(d) it demonstrates to the satisfaction of the competent supervisory authority that its tasks
and duties do not result in a conflict of interests.
3.
The competent supervisory authority shall submit the draft criteria for accreditation of a body
referred to in paragraph 1 to the European Data Protection Board pursuant to the consistency
mechanism referred to in Article57.
4.
Without prejudice to the tasks and powers of the competent supervisory authority and the
provisions of Chapter VIII, a body referredto in paragraph 1 shall, subject to adequate
safeguards, take appropriate action in cases of infringement of the code by a controller or
processor, including suspension or exclusion of the controller or processor concerned from the
code. It shall inform the competent supervisory authority of such actions and the reasons for
taking them.
5.
The competent supervisory authority shall revoke the accreditation of a body referred to in
paragraph 1 if the conditions for accreditation are not, or no longer, met or actions taken by
the body are not in compliance with this Regulation.
6.
This article shall not apply to the processing of personal data carried out by public authorities
and bodies.
Article 39
Certification
1.
The Member States, the supervisory authorities, the European Data Protection Board and the
Commission shall encourage, in particular at Union level, the establishment of data protection
certification mechanisms and of data protection seals and marks, for the purpose of
demonstrating compliance with this Regulation of processing operations carried out by
controllers and processors. The specific needs of micro, small and medium-sized enterprises
shall be taken into account.
29
15039/15
VH/np
136
ANNEX
DGD 2C
LIMITE
EN
1a. In addition to adherence by controllers or processors subject tothis Regulation, data
protection certification mechanisms, seals or marks approved pursuant to paragraph 2a may
also be established for the purpose of demonstrating the existence of appropriate safeguards
provided by controllers or processors that are notsubject to this Regulation according to
Article 3 within the framework of personal data transfers to third countries or international
organisations under the terms referred to in Article 42(2)(e). Such controllers or processors
shall make binding and enforceable commitments, via contractual or other legally binding
instruments, to apply those appropriate safeguards, including as regards data subjects’ rights.
1b. The certification shall be voluntary and available via a process that is transparent.
2.
A certification pursuant to this Article does not reduce the responsibility of the controller or
the processor for compliance with this Regulation and is without prejudice to the tasks and
powers of the supervisory authority which is competent pursuant to Article 51 or 51a.
2a. A certification pursuant to this Article shall be issued by the certification bodies referred to in
Article 39a, or by the competent supervisory authority on the basis of the criteria approved by
the competent supervisory authority or,pursuant to Article 57, the European Data Protection
Board. In the latter case, the criteria approved by the European Data Protection Board may
result in a common certification, the European Data Protection Seal.
3 (new). The controller or processor which submits its processing to the certification mechanism
shall provide the certification body referred to in Article 39a, or where applicable, the
competent supervisory authority, with all information and access to its processing activities
which are necessary to conduct the certification procedure.
38
15039/15
VH/np
137
ANNEX
DGD 2C
LIMITE
EN
4.
The certification shall be issued to a controller or processor for a maximum period of 3 years
and may be renewed under the same conditions as long as the relevant requirements continue
to be met. It shall be withdrawn, where applicable, by the certification bodies referred to in
Article 39a, or by the competent supervisory authority where the requirements for the
certification are not or no longer met.
5.
The European Data Protection Board shall collect allcertification mechanisms and data
protection seals and marks in a register and shall make them publicly available through any
appropriate means.
Article 39a
Certification body and procedure
1.
Without prejudice to the tasks and powers of the competent supervisory authority under
Articles 52 and 53, the certification shall be issued and renewed, after informing the
supervisory authority in order to allow the exercise of its powers pursuant to Article
53(1b)(fa) where necessary,by a certification body which has an appropriate level of
expertise in relation to data protection. Each Member State shall provide whether these
certification bodies are accredited by:
(a) the supervisory authority which is competent according to Article 51 or 51a; and/or
(b) the National Accreditation Body named in accordance with Regulation (EC)
765/2008 of the European Parliament and the Council of 9 July 2008 setting out
the requirements for accreditation and market surveillance relating to the
marketing of products in compliance with EN-ISO/IEC 17065/2012 and with the
additional requirements established by the supervisory authority which is
competent according to Article 51 or51a.
2.
The certification body referred to in paragraph 1 may be accredited for this purpose only
if:
(a) it has demonstrated its independence and expertise in relation to the subject-matter of
the certification to the satisfaction of the competent supervisory authority;
34
15039/15
VH/np
138
ANNEX
DGD 2C
LIMITE
EN
(aa) it has undertaken to respect the criteria referred to in paragraph 2a of Article39 and
approved by the supervisory authority which is competent according to Article 51 or
51a or, pursuant to Article 57, the European Data Protection Board;
(b) it has established procedures for the issuing, periodic review and withdrawal of data
protection certification, seals and marks;
(c) it has established procedures and structures to deal with complaints about infringements
of the certification or the manner in which the certification has been, or is being,
implemented by the controller or processor, and to make these procedures and structures
transparent to data subjects and the public;
(d) it demonstrates to the satisfaction of the competent supervisory authority that its tasks
and duties do not result in a conflict of interests.
3.
The accreditation of the certification bodies referred to in paragraph 1 shall take place on the
basis of criteria approved by the supervisory authority which is competent according to
Article 51 or 51a or, pursuant to Article 57, the European Data Protection Board. In case of an
accreditation pursuant to point (b) of paragraph 1, these requirements complement those
envisaged in Regulation 765/2008 and the technical rules that describe the methods and
procedures of the certification bodies.
4.
The certification body referred to in paragraph 1 shall be responsible for the proper
assessment leading to the certification or the withdrawal of such certification without
prejudice to the responsibility of the controller or processor for compliance with this
Regulation. The accreditation is issued for a maximum period of five years and can be
renewed in the same conditions as long as the body meets the requirements.
5.
The certification body referred to in paragraph 1 shall provide the competent supervisory
authority with the reasons for granting or withdrawing the requested certification.
27
15039/15
VH/np
139
ANNEX
DGD 2C
LIMITE
EN
6.
The requirements referred to in paragraph 3 and the criteria referred to in paragraph 2a of
Article 39 shall be made public by the supervisory authority in an easily accessible form. The
supervisory authorities shall also transmit these to the European Data Protection Board. The
European Data Protection Board shall collect all certification mechanisms and data protection
seals in a register and shall make them publicly available through anyappropriate means.
6a. Without prejudice to the provisions of Chapter VIII, the competent supervisory authority or
the National Accreditation Body shall revoke the accreditation it granted to a certification
body referred to in paragraph 1 if the conditions for accreditation are not, or no longer, met or
actions taken by the body are not in compliance with this Regulation.
7.
The Commission shall be empowered to adopt delegated acts in accordance with Article 86,
for the purpose of specifying the requirements to be taken into account for the data protection
certification mechanisms referred to in paragraph 1 of Article 39.
7a. (…)
8.
The Commission may lay down technical standards for certification mechanisms and data
protection seals and marks and mechanisms to promote and recognize certification
mechanisms and data protection seals and marks. Those implementing acts shall be adopted in
accordance with the examination procedure set out in Article 87(2).
27
15039/15
VH/np
140
ANNEX
DGD 2C
LIMITE
EN
CHAPTER V
TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES OR
INTERNATIONAL ORGANISATIONS
Article 40
General principle for transfers
Any transfer of personal data which are undergoing processing or are intended for processing after
transfer to a third country or to an international organisation may only take place if, subject to the
other provisions of this Regulation, the conditions laid down in this Chapter are complied with by
the controller and processor, including for onward transfers of personal data from the third country
or an international organisation to another third country or to another international organisation. All
provisions in this Chapter shall be applied in order to ensure that the level of protection of
individuals guaranteed by this Regulation shall not be undermined.
Article 41
Transfers with an adequacy decision
1.
A transfer of personal data to a third country or an international organisation may take place
where the Commission has decided that the third country, or a territory or one or more
specified sectors within that third country, or the international organisation in question
ensures an adequate level of protection. Such transfer shall not require any specific
authorisation.
Documents you may be interested
Documents you may be interested
