Art. 1 NL accreditation requirements for GDPR code of conduct monitoring bodies

Explanatory note: The monitoring body shall demonstrate its independence and impartiality. The monitoring body shall demonstrate how its structure and its formal rules of appointment guarantee that it is able to act freely from instructions and that it shall be protected from any sort of interference or sanctions from the code members or the code owner as a consequence of the fulfilment of its tasks. The requirements below set out what constitutes independence. This needs to be demonstrated within four main areas: legal and decision making procedures, financial, organisational and accountability. Independence for a monitoring body can be understood as a series of formal rules and procedures for the appointment, terms of reference and operation of the monitoring body. These rules and procedures will allow the monitoring body to perform its monitoring tasks without influence from members of the code or its code owner. Monitoring bodies wills be structured and managed to safeguard their independence and impartiality and will be required to demonstrate this to the AP in their submission. Internal bodies shall be required to provide evidence to ensure that the independence of their monitoring activities are not compromised. Requirements: Legal and decision-making procedures The legal structure of the monitoring body, including its ownership, must shield the monitoring body from external influence with respect to the code owners and the code members. This might be demonstrated for example by submitting the following documents, the articles of incorporation (the set of formal documents filed with a government body to legally document the creation of a corporation) of the monitoring body and the articles of incorporation of the code owner and by demonstrating that the duration, or expiration of the mandate of the monitoring body is fixed in such a way as to prevent overdependence on a renewal or fear of losing the appointment, to an extent that adversely affects the independence in carrying out the monitoring activities by the monitoring body. The monitoring body shall demonstrate any legal and economic links that may exist between the monitoring body and the code owner or code members, as well as with regard to the profession, industry or sector to which the code applies. The monitoring body’s decision-making procedures must ensure that the decision process from the conception of a decision to its implementation must shield the monitoring body from undue influence. The independence and impartiality of the decision-making procedure might be demonstrated for example by submitting the organigram of the monitoring body and the code owner; a description of the decision-making process that also points out to the roles and prerogatives of all parties involved in the decision-making process associated to a decision making procedure. The monitoring body could be an internal or external body as long as evidence can be provided of adequate procedures and rules that allow monitoring of compliance with a code independently and without undue pressure or influence from the code owner or the code members. The monitoring body shall demonstrate that it will act independently in its choice and application of its actions and sanctions. This could be evidenced by formal rules for appointment, terms of reference, powers and operation of any committees or personnel that may be involved with an internal monitoring body (such committees or personnel shall be free from any commercial, financial and other pressures that might influence decisions). An internal monitoring body shall provide information concerning its relationship to its larger entity (in particular the code owner) and shall evidence its impartiality. This could be demonstrated with evidence that may include information barriers, separate reporting and separate operational and management functions. The monitoring body shall demonstrate organisational independence, for example, an internal monitoring body may use different logos or names where appropriate, information barriers and separate reporting structures. The monitoring body shall not provide any services to code members that would adversely affect its independence. Any decisions made by the monitoring body related to its functions shall not be subject to approval by any other organisation, including the code owner. The monitoring body shall demonstrate that it has the financial stability and resources, for the operation of its activities and to meet its liabilities. The resources should be proportionate to the expected number, size and complexity of code members (as monitored entities), the nature and scope of their activities (which are the subject of the code) and the risk(s) associated with the processing operation(s). The monitoring body shall be able to manage their budget and resources independently and effectively monitor compliance without any form of influence from the code owner or code members. This could be demonstrated with evidence showing that the means by which it obtains financial support should not adversely affect its independence. The monitoring body would, for instance, not be considered financially independent if the rules governing its financial support allow a code member, who is under investigation by the monitoring body, to stop its financial contribution to it, in order to avoid a potential sanction from the monitoring body. The monitoring body shall demonstrate to the AP the means by which it obtains financial support for its monitoring role and explain how this does not compromise its independence. This could be evidenced by delivering contractual clauses or other documentation that demonstrates how the monitoring body obtains financial support for its monitoring role. The monitoring body shall demonstrate that it has adequate resources (including technical resources)and personnel to effectively perform its tasks, the resources should be proportionate to the expected number and size of code members, as well as the complexity or degree of risk of the relevant data processing, that it is able to act independently from code owners and code members and is protected from interference or sanctions as a result of this duty. The monitoring body shall provide evidence during the application process that their personnel can act independently and without undue pressure or influence in relation to: supervision of resources and finances of the monitoring body; decisions on and performance of compliance monitoring; and safeguarding of impartiality. Such evidence can include but is not limited to documented recruitment/appointment processes, job descriptions, risk registers, risk treatments, meeting minutes and other documented processes as appropriate. Where a monitoring body uses sub-contractors, it shall ensure that sufficient guarantees are in place in terms of the knowledge, reliability and resources of the sub-contractor and obligations applicable to the monitoring body are applicable in the same way to the sub-contractor. Even when subcontractors are used, the monitoring body shall ensure effective monitoring of the services provided by the contracting entity. The use of subcontractors does not remove or diminish the responsibility of the monitoring body. This could be demonstrated with evidence that may include: written contacts or agreements to outline for example responsibilities, confidentiality, what type of data will be held and a requirement that the data is kept secure; a clear procedure for subcontracting shall also be documented and include the conditions under which this may take place, an approval process and the monitoring of subcontractors; requirements relating to the termination of those contracts, in particular so as to ensure that subcontractors fulfil their data protection obligations; and the monitoring body shall ensure sufficient documented procedures to guarantee the independence, expertise and lack of conflicts of interests of the sub-contractors. The monitoring body shall provide evidence to demonstrate that it is accountable for its decisions and actions, for example, by setting out a framework for its roles and reporting procedures and its decision-making process to ensure independence. Such evidence could include but is not limited to job descriptions, management reports and policies to increase awareness among the personnel about the governance structures and the procedures in place (e.g. training).

Rechtspraak bij dit artikel