Art. 8 NL accreditation requirements for GDPR code of conduct monitoring bodies

Explanatory note: The monitoring body may be set up or established in a number of different ways, for example limited companies or trade associations. However the overarching principle is that whatever form the monitoring body takes, it must demonstrate sufficient financial and other resources to deliver its specific duties and responsibilities. The existence of sufficient financial and other resources should be accompanied with the necessary procedures to ensure the functioning of the code of conduct over time. The monitoring body will therefore have to provide evidence to the AP of its legal status. Fines could be administered for a monitoring body failing to deliver its monitoring functions and failing to take appropriate action when code requirements are infringed. A monitoring body will therefore demonstrate that it has the appropriate standing to carry out its role under GDPR Article 41(4). Requirements: The monitoring body shall indicate whether it acts as an internal or external monitoring body in relation to the code owner. The monitoring body shall evidence to the AP that it has the appropriate legal standing to meet the requirements of being fully accountable in its role with sufficient financial and other resources; in particular with reference to Article 83 of the GDPR and Article 14(3) of the UAVG and Article 16(1) of the UAVG, being able to take appropriate action in line with Article 41 GDPR, and that it has access to adequate resource requirements to fulfil its monitoring responsibilities. The monitoring body shall also evidence that it can deliver the code of conduct’s monitoring mechanism over a suitable period of time. Such evidence could depend on the structure of the monitoring body and could include (but not be limited to): full company and business name, seat of the monitoring body and registered Chamber of Commerce number; and evidence that the monitoring body has adequate financial resources to demonstrate how fines will be paid, such that the requirements of GDPR Article 83(4)(c) and Article 14(3) of the UAVG and Article 16(1) of the UAVG can be met. The monitoring body shall be a legal entity, or a defined part of a legal entity such that it is legally responsible for its monitoring activities. The monitoring body shall agree to be responsible for its monitoring role and therefore responsible for a fine under GDPR Article 83(4)(c) and Article 14(3) of the UAVG. The monitoring body shall be established in the European Economic Area (EEA). In addition to the seat of the monitoring body the names of its representatives and, if different, the names of the persons responsible for its control shall be added. Its aim is to determine who is responsible for the actions of the monitoring body and to identify the responsible department against which to take action in the event of non-compliance with its obligations.

Legal status

Rechtspraak bij dit artikel