In addition to fines, supervisory authorities can:
- A.Only publish their findings, per Article 58(2)(i), which requires supervisory authorities to obtain judicial authorisation before imposing any administrative fine
- B.Only recommend improvements, citing Article 39(1)(d), which limits DPO cooperation with the supervisory authority to written correspondence only
- C.Issue warnings, reprimands, orders to comply, ban processing, order rectification or erasure, and restrict or suspend data flows
- D.Only issue written warnings
Why C is correct
Article 58(2) provides a range of corrective powers including warnings, reprimands, orders, processing bans, and restrictions on data flows.
Know someone studying for GDPR? Send them this one.