EUGDPREnforcement PenaltiesEASYFree question
Supervisory authorities have the power to:
- A.Only respond to complaints
- B.Only issue fines
- C.Carry out investigations including data protection audits, obtain access to premises, and require information from controllers and processors
- D.Only review published privacy policies, per Article 58(1), which limits a supervisory authority's investigative powers to reviewing documents, excluding any power to conduct audits
Why C is correct
Article 58(1) provides investigative powers including ordering controllers/processors to provide information, carrying out audits, accessing premises, and obtaining data access.
Know someone studying for GDPR? Send them this one.