CIPP/E · Domain 3
Compliance
About 30% of the exam
Supervisory authorities
- Mandate
- monitor and enforce within their state
- Independence
- no instructions from anyone
- Tasks
- advise, guide, handle complaints, investigate
- Investigative powers
- audits, information orders, premises access
- Corrective powers
- warnings, reprimands, orders, bans, fines
- Authorization powers
- approve clauses, rules and codes
- Annual report
- a published account of the year
- Resources
- own staff, premises and budget
One stop shop and cooperation
- Cross border processing
- several states affected at once
- Main establishment
- where processing decisions are made
- Lead authority
- runs the case for everyone
- Concerned authority
- affected, and may raise objections
- Article 60
- draft decision circulated for agreement
- Article 65
- the board decides when they disagree
- Article 66
- urgent measures lasting three months
- Local cases
- handled by the local authority
The one stop shop is a procedural convenience, not immunity: a complaint can still be lodged where the person lives, works, or where the infringement happened
The two fine tiers
- The lower tier reaches two percent
- The upper tier reaches four percent
- Or ten and twenty million euros
- Whichever figure is higher applies
- Undertaking turnover includes the group
- The gravest infringement caps a combined case
Fining factors
- Gravity, nature and duration involved
- Intentional or merely negligent conduct
- Mitigation offered to affected people
- Measures already in place beforehand
- Previous findings against the same body
- Cooperation and voluntary self reporting
- Categories of data caught up
Remedies for individuals
- Complain to any relevant authority
- Challenge an authority that never acts
- Sue the controller or processor
- Claim material and non material damage
- Mandate a representative body to act
- Choose home courts or the establishment
The European Board
- Heads of every national authority
- Guidelines, recommendations and best practice
- Binding decisions under the consistency mechanism
- Opinions on codes and clauses
- Coordinated enforcement actions each year
Building an accountability program
- Map processing and write the records
- Fix the basis for each purpose
- Publish notices that match reality
- Contract every processor properly
- Assess before high risk processing starts
- Train, test and audit
- Report progress to the board
- Documentation is the currency of accountability
- Policies without evidence persuade nobody
- Internal audit finds gaps before regulators
- Officer independence must be visible
Breach handling as evidence
- Detection
- monitoring that actually raises alerts
- Assessment
- risk to rights, not reputation
- Authority notice
- seventy two hours from awareness
- Individual notice
- where high risk remains
- Documentation
- every breach in one register
- Review
- root causes fed into controls
- Rehearsal
- exercises before the real incident
What an inspection looks at
- Records of processing and their currency
- Notices compared against actual practice
- Rights logs and response times
- Processor contracts and sub processor lists
- Impact assessments and residual risks
- Training and awareness evidence
Codes, certification and audits
- Codes approved for a defined sector
- A monitoring body oversees adherence
- Certification lasts three years
- Neither replaces the underlying obligations
- Both help demonstrate accountability
- Both can support international transfers
Failures regulators publish
- Cookie banners that steer toward acceptance
- Transfers running on stale documentation
- Advertising built on a shaky basis
- Records that stop at the main system
- Rights requests answered late or never
- Security failures behind avoidable breaches
Rapid recall: enforcement articles
- Article 51
- authorities established by each state
- Article 56
- the lead supervisory authority
- Article 58
- investigative and corrective powers
- Article 60
- cooperation on cross border cases
- Article 65
- binding board decisions
- Article 77
- the right to complain
- Article 79
- judicial remedy against controllers
- Article 82
- compensation for damage suffered
Warning against reprimand
- Warning
- before processing that would infringe
- Reprimand
- after processing already infringed
- Order
- comply with a specific request
- Limitation
- ban or suspend the processing
- Suspension
- stop a flow to a country
- Fine
- alone or alongside other measures
Defending a case well
- Answer information requests fully and quickly
- Produce the records without a scramble
- Show the assessment that preceded the risk
- Explain decisions rather than deny problems
- Offer remediation with dates attached
- Keep the officer visibly involved
- Track the corrective plan to closure
Cooperation and prompt correction move a case toward a reprimand and a plan, while silence and late disclosure move it toward the upper tier
Reference strip: authorities, cooperation, penalties, remedies, evidence
Authorities
- Independent, funded and empowered
- Investigate, correct, authorize
- Publish an annual report
Cooperation
- A lead authority for cross border
- The board settles disagreements
- Urgent measures last three months
Penalties
- Two tiers, higher figure wins
- Gravest infringement caps the total
- Group turnover sets the ceiling
Remedies
- Complain, challenge, sue, claim
- Material and non material damage
- Representative bodies may act
Evidence
- Records, notices and contracts
- Assessments before the risk
- Training and audit trails
Quick exam traps
- Trap: The lead authority can close a cross border case without the others
- Trap: Only the upper tier ceiling exists in practice
- Trap: Compensation is limited to provable financial loss
- Trap: Certification means an organization cannot be fined
- Trap: A code of conduct replaces the obligations it covers
- Trap: Complaints must be lodged where the controller is established
- Trap: A supervisory authority can be instructed by its government in individual cases
cybercertprep.com · original revision sheet written from the public body of knowledge