CIPP/E Supervision and Enforcement Exam Questions and Answers

Supervisory authorities data protection authorities Article 51(1)(u) requires dpas to keep records of any infringements of the Regulation, as well as records of any actions taken under Article 58(2). The keeping of these records is already a standard practice across the member states, and, indeed, they provide a primary source material for the regulators when devising their national and collective work programmes. Moreover, in some jurisdictions, such as the UK, the dpas consider the regulatory track record of organisations when taking decisions on discrete issues. In other words, the worse the track record, the greater the possibility of adverse results for the controller or processor. Can dpas charge data subjects or dpos for their services? no. Article 57(3) makes it clear that dpas cannot charge data subjects or dpos for their services. However, Article 57(4) does give the ability to charge back administration costs on manifestly unfounded or excessive requests. Supervisory authorities/data protection authorities promote awareness by helping organizations understand their obligations under the GDPR, and by serving in an advisory capacity so organizations may approach them for advice on data protection issues Conduct investigations on GDPR compliance Protect fundamental human rights, including raising public awareness, by providing information to individuals who have requested information and by managing data subjects complaints Draw up annual reports that explain the data protection in their country, current issues and the agenda for the following year Facilitate the free flow of personal data within the EU. This supports the fundamental role of the eu to promote free trade and the free movement of data. Arguably the most effective tool for supervision and enforcement self-regulation How GDPR advances self regulation the concept of accountability (see Article 5(2)), which places a positive obligation on the controller to be able to demonstrate compliance with the data protection principles, through the introduction of requirements for data protection officers (dpos) (see Articles 37 to 39), and through a heightened focus on codes of conduct and certification schemes for data protection seals and marks (see Articles 40 to 43). Likewise, controllers have regulatory functions over their processors, and processors must regulate their sub-processors (see Article 28).