GDPR : Sanction (Administrative fine)

Data subject’s rights are as follows:

- right of access; - right to object; - right to restriction; - right to erasure; - right to restriction; - right to rectification; - right to data portability  (see here for more details) Controllers must be able to handle individuals' right requests without delay and, in any event, within one month of the request. For more details about individuals' rights see here.

Where personal data is transferred outside the EU to a country or an international organisation not providing an adequate level of protection, Controllers and, in some cases, processors, must implement additional guarantees to ensure the level of protection of the personal data is adequate.

Several transfer mechanisms are available to controllers or processors such as BCR, EU model clauses, Privacy Shield. They may also rely on derogation such as individual's explicit consent, under specific circumstances.

The Chapter IX of the GDPR refers to specific law each Member States can enact on the following matters:

• Use of personal data in the context of employment
• Freedom of information and speech,
• Access to public/official documents,
• Use of national identification number,
• Derogations for archiving, historical and scientific purposes or
• Use by religious association and church is regulated by specific member states laws.

Processing personal data in breach of these local law is still a breach of the GDPR.

Supervisory Authorities have the right to serve fines and to issue orders and warnings. If controllers or processors does not comply with the order or warning served on them, it is another ground for the Authority to serve a fine.

When a child is under 16, parent’s consent is necessary to process child’s personal data. The age limit may be lowered to 13 by Member State law.

Where a data controller does not need to identify data subjects anymore, it should not collect or keep data enabling their identification for the sole purpose of complying with the GDPR.

It is not clear what could be an infraction but we guess that for example, where a data controller continue identifying data subjects for the sole purpose of being able to handle a subject access request, it is in breach of the regulation.

Data Protection by design and by default principles apply to data controllers only (see here for more details on these principles)

If no appropriate organisational and/or technical measures such as policies are in place for ensuring compliance with data protection principles (see here), it should be considered as a breach.

   

Article 26 of the GDPR provides that where two or more controllers jointly determines the purposes and the means of processing, they must determine in a transparent manner their respective responsibilities with regard to their obligations under the regulation by means of an arrangement. Under article 27, where the controller or the processor is located outside of the EU and subject to article 3(2) of the GDPR, it must appoint a Representative. Such appointment must be done in writing and the representative must be based in the EU.

Under article 28, when a processor processes of personal data on behalf of a controller, they must enter into a specific contract. The processor may not subcontract its obligations to another processor without the controller's prior consent. Where such consent is obtained, the processor must enter into an equivalent contract with its own processor.

Article 29 provides that any person acting under the authority of the controller or of the processor (including employee), must only process personal data on the controller's instructions.

Under Article 30, controllers and processors must maintain a record of their processing activities (unless an exemption applies)

They, as well as their representative, must cooperate with the supervisory authority.

Under article 32, controllers and processors must ensure the security of personal data.

In the event of a security breach, processors must notify their controller and the latter must notify the authority within 72 hours if there is a risk for the data subjects (article 33).

If there is a high risk for data subjects, they must also be notified (article 34).

Where a processing activity is likely to result in a high risk for data subjects (e.g. very intrusive processing), controllers must assess the risk for their rights and freedom by carrying out a data protection impact assessment (DPIA).

If the risks identified when carrying out the DPIA cannot be sufficiently mitigated, controllers must consult the supervisory authority.

Data protection officers are not directly liable for any data controller or processor’s breach of the GDPR.

Therefore a breach of article 39 relating to DPO's mission should mean that if the Data Protection officer is prevented from accomplishing their mission, data controller or processor is in breach of the GDPR.

See here for more information about the DPO role and responsibilities.