Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18

2023-04-18T15:01:35Z

1 revision imported: GDPRHUB import 2023 04 18

New page

{| class="wikitable" style="width: 25%; margin-left: 10px; float:right;"
![[Article 23 GDPR|←]] Article 24 - Responsibility of the controller [[Article 25 GDPR|→]]
|-
| style="padding: 20px; background-color:#003399;" |[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
|-
|

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 1 GDPR|Article 1: Subject-matter and objectives]]<br />
[[Article 2 GDPR|Article 2: Material scope]]<br />
[[Article 3 GDPR|Article 3: Territorial scope]]<br />
[[Article 4 GDPR|Article 4: Definitions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
<div class="mw-collapsible-content">
<small>
[[Article 5 GDPR|Article 5: Principles relating to processing of personal data]]<br />
[[Article 6 GDPR|Article 6: Lawfulness of processing]]<br />
[[Article 7 GDPR|Article 7: Conditions for consent]]<br />
[[Article 8 GDPR|Article 8: Conditions applicable to child’s consent in relation to information society services]]<br />
[[Article 9 GDPR|Article 9: Processing of special categories of personal data]]<br />
[[Article 10 GDPR|Article 10: Processing of personal data relating to criminal convictions and offences]]<br />
[[Article 11 GDPR|Article 11: Processing which does not require identification]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
<div class="mw-collapsible-content">
<small>
[[Article 12 GDPR|Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject]]<br />
[[Article 13 GDPR|Article 13: Information to be provided where personal data are collected from the data subject]]<br />
[[Article 14 GDPR|Article 14: Information to be provided where personal data have not been obtained from the data subject]]<br />
[[Article 15 GDPR|Article 15: Right of access by the data subject]]<br />
[[Article 16 GDPR|Article 16: Right to rectification]]<br />
[[Article 17 GDPR|Article 17: Right to erasure (‘right to be forgotten’)]]<br />
[[Article 18 GDPR|Article 18: Right to restriction of processing]]<br />
[[Article 19 GDPR|Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing]]<br />
[[Article 20 GDPR|Article 20: Right to data portability]]<br />
[[Article 21 GDPR|Article 21: Right to object]]<br />
[[Article 22 GDPR|Article 22: Automated individual decision-making, including profiling]]<br />
[[Article 23 GDPR|Article 23: Restrictions]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
<div class="mw-collapsible-content">
<small>
[[Article 24 GDPR|Article 24: Responsibility of the controller]]<br />
[[Article 25 GDPR|Article 25: Data protection by design and by default]]<br />
[[Article 26 GDPR|Article 26: Joint controllers]]<br />
[[Article 27 GDPR|Article 27: Representatives of controllers or processors not established in the Union]]<br />
[[Article 28 GDPR|Article 28: Processor]]<br />
[[Article 29 GDPR|Article 29: Processing under the authority of the controller or processor]]<br />
[[Article 30 GDPR|Article 30: Records of processing activities]]<br />
[[Article 31 GDPR|Article 31: Cooperation with the supervisory authority]]<br />
[[Article 32 GDPR|Article 32: Security of processing]]<br />
[[Article 33 GDPR|Article 33: Notification of a personal data breach to the supervisory authority]]<br />
[[Article 34 GDPR|Article 34: Communication of a personal data breach to the data subject]]<br />
[[Article 35 GDPR|Article 35: Data protection impact assessment]]<br />
[[Article 36 GDPR|Article 36: Prior consultation]]<br />
[[Article 37 GDPR|Article 37: Designation of the data protection officer]]<br />
[[Article 38 GDPR|Article 38: Position of the data protection officer]]<br />
[[Article 39 GDPR|Article 39: Tasks of the data protection officer]]<br />
[[Article 40 GDPR|Article 40: Codes of conduct]]<br />
[[Article 41 GDPR|Article 41: Monitoring of approved codes of conduct]]<br />
[[Article 42 GDPR|Article 42: Certification]]<br />
[[Article 43 GDPR|Article 43: Certification bodies]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
<div class="mw-collapsible-content">
<small>
[[Article 44 GDPR|Article 44: General principle for transfers]]<br />
[[Article 45 GDPR|Article 45: Transfers on the basis of an adequacy decision]]<br />
[[Article 46 GDPR|Article 46: Transfers subject to appropriate safeguards]]<br />
[[Article 47 GDPR|Article 47: Binding corporate rules]]<br />
[[Article 48 GDPR|Article 48: Transfers or disclosures not authorised by Union law]]<br />
[[Article 49 GDPR|Article 49: Derogations for specific situations]]<br />
[[Article 50 GDPR|Article 50: International cooperation for the protection of personal data]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
<div class="mw-collapsible-content">
<small>
[[Article 51 GDPR|Article 51: Supervisory authority]]<br />
[[Article 52 GDPR|Article 52: Independence]]<br />
[[Article 53 GDPR|Article 53: General conditions for the members of the supervisory authority]]<br />
[[Article 54 GDPR|Article 54: Rules on the establishment of the supervisory authority]]<br />
[[Article 55 GDPR|Article 55: Competence]]<br />
[[Article 56 GDPR|Article 56: Competence of the lead supervisory authority]]<br />
[[Article 57 GDPR|Article 57: Tasks]]<br />
[[Article 58 GDPR|Article 58: Powers]]<br />
[[Article 59 GDPR|Article 59: Activity reports]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
<div class="mw-collapsible-content">
<small>
[[Article 60 GDPR|Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned]]<br />
[[Article 61 GDPR|Article 61: Mutual assistance]]<br />
[[Article 62 GDPR|Article 62: Joint operations of supervisory authorities]]<br />
[[Article 63 GDPR|Article 63: Consistency mechanism]]<br />
[[Article 64 GDPR|Article 64: Opinion of the Board]]<br />
[[Article 65 GDPR|Article 65: Dispute resolution by the Board]]<br />
[[Article 66 GDPR|Article 66: Urgency procedure]]<br />
[[Article 67 GDPR|Article 67: Exchange of information]]<br />
[[Article 68 GDPR|Article 68: European Data Protection Board]]<br />
[[Article 69 GDPR|Article 69: Independence]]<br />
[[Article 70 GDPR|Article 70: Tasks of the Board]]<br />
[[Article 71 GDPR|Article 71: Reports]]<br />
[[Article 72 GDPR|Article 72: Procedure]]<br />
[[Article 73 GDPR|Article 73: Chair]]<br />
[[Article 74 GDPR|Article 74: Tasks of the Chair]]<br />
[[Article 75 GDPR|Article 75: Secretariat]]<br />
[[Article 76 GDPR|Article 76: Confidentiality]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
<div class="mw-collapsible-content">
<small>
[[Article 77 GDPR|Article 77: Right to lodge a complaint with a supervisory authority]]<br />
[[Article 78 GDPR|Article 78: Right to an effective judicial remedy against a supervisory authority]]<br />
[[Article 79 GDPR|Article 79: Right to an effective judicial remedy against a controller or processor]]<br />
[[Article 80 GDPR|Article 80: Representation of data subjects]]<br />
[[Article 81 GDPR|Article 81: Suspension of proceedings]]<br />
[[Article 82 GDPR|Article 82: Right to compensation and liability]]<br />
[[Article 83 GDPR|Article 83: General conditions for imposing administrative fines]]<br />
[[Article 84 GDPR|Article 84: Penalties]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
<div class="mw-collapsible-content">
<small>
[[Article 85 GDPR|Article 85: Processing and freedom of expression and information]]<br />
[[Article 86 GDPR|Article 86: Processing and public access to official documents]]<br />
[[Article 87 GDPR|Article 87: Processing of the national identification number]]<br />
[[Article 88 GDPR|Article 88: Processing in the context of employment]]<br />
[[Article 89 GDPR|Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes]]<br />
[[Article 90 GDPR|Article 90: Obligations of secrecy]]<br />
[[Article 91 GDPR|Article 91: Existing data protection rules of churches and religious associations]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
<div class="mw-collapsible-content">
<small>
[[Article 92 GDPR|Article 92: Exercise of the delegation]]<br />
[[Article 93 GDPR|Article 93: Committee procedure]]<br />
</small>
</div></div>

<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
<div class="mw-collapsible-content">
<small>
[[Article 94 GDPR|Article 94: Repeal of Directive 95: /46: /EC]]<br />
[[Article 95 GDPR|Article 95: Relationship with Directive 20: 02: /58: /EC]]<br />
[[Article 96 GDPR|Article 96: Relationship with previously concluded Agreements]]<br />
[[Article 97 GDPR|Article 97: Commission reports]]<br />
[[Article 98 GDPR|Article 98: Review of other Union legal acts on data protection]]<br />
[[Article 99 GDPR|Article 99: Entry into force and application]]<br />
</small>
</div>
</div>
|}

==Legal Text==
<br /><center>'''Article 24 - Responsibility of the controller'''</center>

<span id="1">1. Taking into account the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with this Regulation. Those measures shall be reviewed and updated where necessary.</span>

<span id="2">2. Where proportionate in relation to processing activities, the measures referred to in paragraph 1 shall include the implementation of appropriate data protection policies by the controller.</span>

<span id="3">3. Adherence to approved codes of conduct as referred to in Article 40 or approved certification mechanisms as referred to in Article 42 may be used as an element by which to demonstrate compliance with the obligations of the controller.</span>

==Relevant Recitals==
{{Recital/74 GDPR}}{{Recital/75 GDPR}}{{Recital/76 GDPR}}{{Recital/77 GDPR}}{{Recital/78 GDPR}}

==Commentary==
This provision opens Section 1 of Chapter IV, which is dedicated to the “''General obligations''” of the controller and processor. It provides an overview of the controller’s responsibilities as the first addressee for compliance with the provisions of the GDPR. The actual obligations that follow from this position are described more specifically in other provisions, such as [[Article 25 GDPR]] or [[Article 32 GDPR]].<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24, margin number 11 (C.H. Beck 2020, 3rd Edition).</ref> However, according to ''Plath'', this does not mean that the provision is merely declaratory: it also establishes directly applicable obligations.<ref>''Plath,'' in Plath DSGVO BDSG, Article 24 GDPR, margin number 2 (Ottoschmidt 2018, 3rd Edition).</ref> Nevertheless, Article 24 GDPR is the only provision in this section which precludes the imposition of fines under [[Article 83 GDPR|Article 83(4)(a)]] or [[Article 83 GDPR|Article 83(5) GDPR]]. As ''Hartung'' notes, this supports the view that it is intended as a general provision that provides an overview of the controller’s responsibilities.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24, margin number 24 (C.H. Beck 2020, 3rd Edition).</ref> Although the provision refers to “''responsibility''”, it builds on Article 5(2) GDPR by imposing accountability on the controller. According to ''Docksey'', this shift from ‘passive’ responsibility to a concept of ‘proactive’ and demonstrable compliance is one of the GDPR’s most innovative aspects.<ref>''Docksey'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 24 GDPR, p. 557 (Oxford University Press 2020).</ref> Hence, the controller’s processing operations must be known (“''taking into account''”), controlled (through “''appropriate technical and organisational measures''”) and regularly reviewed (“''updated where necessary''”), so that the controller can “''ensure''” compliance with the Regulation. <blockquote><u>EDPB Guidelines:</u> For this Article there are the [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-072020-concepts-controller-and-processor-gdpr_en Guidelines 07/2020 on the concepts of controller and processor in the GDPR] </blockquote>

===(1) Appropriate Technical and Organisational Measures===
The controller must implement effective technical and organisational measures to ensure compliance with the entire GDPR, including data protection principles ([[Article 5 GDPR]]), data subject rights (amongst others, [[Article 12 GDPR|Articles 12]] to [[Article 22 GDPR|22 GDPR]]) and controllers’ obligations.

==== Measures ====
The term "''measure''" must be understood broadly since it refers to all actions that are appropriate to make the processing compliant with the GDPR. As the provision explains, this can be done through technical and organisational means. However, the GDPR does not define ''what'' is a technical measure, it merely gives examples,<ref>''Lang'', in Taeger, Gabel, DSGVO BDSG, Article 24, margin numbers 23-24 (C.H. Beck 2022, 4th Edition).</ref> such as securing the access (password protection) or transfer (encryption). Of course, these technical measures would be ineffective if no organisational measures that secure compliance with them are implemented (e.g. data audits, activity logs, internal training of employees by the DPO).<ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin numbers 21-22 (C.H. Beck 2021, 3rd Edition).</ref> Other examples of "measures" are given in Recital 78, which lists pseudonymisation, data minimisation, and "''transparency with regard to the functions and processing of personal data''". In practice, the distinction between technical and organisational measures is not always clear as these can overlap. However, as ''Hartung'' observes, this is not really a problem because the GDPR does not differentiate between the two in terms of legal requirements.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24, margin number 17 (C.H. Beck 2020, 3rd Edition).</ref>

==== Risk-based Approach ====
To decide which measures to implement, the controller must perform a risk assessment and select the most appropriate ones. The provision lists several elements that the controller must take into account when assessing the risk. First, it must consider the ''nature'' of the processing (manual or automated), the ''scope'' of the processing (amount of data subjects affected, amount of data collected, bulk or individual processing, sensitivity of the data), the ''context'' of the processing (how many parties are involved, which systems are used, etc.), and the ''purposes'' of the processing.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24, margin number 14 (C.H. Beck 2020, 3rd Edition).</ref> Second, the controller must assess the severity of the risks for the rights and freedoms of natural persons, as well as the likelihood that these materialise. This obligation to consider the likelihood of the materialisation expands on Article 17 of the Data Protection Directive (DPD), which merely mentioned the consideration of risks.<ref>''Docksey'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 24 GDPR, p. 564 (Oxford University Press 2020).</ref>
Recital 75 gives useful guidance to determine what this risk actually entails. Besides clarifying that the damage can be physical, material, or immaterial, it lists a range of examples of damages, such as discrimination, identity theft or fraud. However, it also mentions "''loss of confidentiality of personal data protected by professional secrecy''". Moreover, it is important to note that, although this is not mentioned in the provision, it follows from Article 52(1) of the Charter of Fundamental Rights that the principle of proportionality plays an important role in determining whether a measure is appropriate. Thus, the cost-effectiveness of a measure can play an important part in the assessment.<span lang="EN-GB">This
provision opens Section 1 of Chapter IV, which is dedicated to the “''General
obligations''” of the controller and processor. It provides an overview of
the controller’s responsibilities as the first addressee for compliance with
the provisions of the GDPR.</span><ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin number 24 (C.H. Beck 2021, 3rd Edition).</ref> Lastly, although GDPR prescribes that the controller must determine the risk, it does not prescribe procedural steps on how to perform this assessment. Hence, this assessment is left to the controller. In this regard, ''Martini'' points to Article 35(4) GDPR, which states that “''The supervisory au''<span lang="EN-GB">This
provision opens Section 1 of Chapter IV, which is dedicated to the “''General
obligations''” of the controller and processor. It provides an overview of
the controller’s responsibilities as the first addressee for compliance with
the provisions of the GDPR.</span>''thority shall establish and make public a list of the kind of processing operations which are subject to the requirement for a data protection impact assessment''”, and notes that such a list can provide guidance to controllers since it shows which processing operations constitute a high risk. However, he also stipulates that “''informative content is limited to whether there is a high or normal risk and whether a data protection impact assessment is therefore indicated (Art. 35(1)) and the supervisory authority must be consulted (Art. 36(1)) before the controller takes concrete measures''”. Hence, such a list is merely an indication of risk and does not provide the controller with certainty as to which measures are suitable and effective in a specific case.<ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin number 36-36b (C.H. Beck 2021, 3rd Edition).</ref> Moreover, the EDPB could also provide useful guidance. ''Lang'' notes that the Board ''may'' issue guidelines pursuant to Article 70(1)(e) GDPR, and that this applies in particular to the determination of risk that is related to processing (recital 77 GDPR).<ref>''Lang'', in Taeger, Gabel, DSGVO BDSG, Article 24, margin number 62 (C.H. Beck 2022, 4th Edition).</ref>

==== Demonstrating Compliance and Updating Data Processing Measures ====
Controllers not only have to ensure compliance, but have to demonstrate it through evidence. The comprehensiveness of this evidence must be proportionate to the risk posed by the processing operation. The more risky a processing operation, the more comprehensive the accompanying evidence must be.<ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin number 25a (C.H. Beck 2021, 3rd Edition).</ref> Conversely, where the risk is lower a witness statement rather than physical documentation might be sufficient. Like other elements of the provision, this requirement is elaborated on in other GDPR articles (e.g. maintaining a record of processing activities under [[Article 30 GDPR|Article 30(1)]] GDPR; documenting personal data breaches under [[Article 33 GDPR|Article 33(5) GDPR]]). Whether the controller’s obligation to demonstrate compliance, also implies a reversal of the burden of proof when a data subject seeks compensation for damages pursuant to Article 82, is uncertain. Some authors, such as Bergt and Quaas, argue in favour of this point of view,<ref>For example, Bergt, in Kühling, Buchner, DS-GVO BDSG, Article 24, margin numbers 46, 48 (C.H. Beck 2020, 3rd Edition); ''Quaas'', in: Wolff, Brink, BeckOK Datenschutzrecht, Article 82 GDPR, margin number 16 (C.H. Beck 2021, 39th Edition).</ref> as does the Regional Labor Court of Baden-Württemberg.<ref>LAG Baden-Württemberg, 25 February 2021, 17 Sa 37/20, margin number 61 (available [http://lrbw.juris.de/cgi-bin/laender_rechtsprechung/document.py?Gericht=bw&nr=34234 here]).</ref> Others, however, disagree with this interpretation. According to ''Martini,'' the controller’s obligation to demonstrate compliance does not necessarily imply that the burden of proof lies with it where a claim is brought under civil law. If a data subject asserts a claim for damages under [[Article 82 GDPR]], it is still up to them to prove the violation of data protection law, damage, and causality.<ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin number 25a (C.H. Beck 2021, 3rd Edition). See also ''Moos, Schefzig,'' in Taeger, Gabel, DSGVO BDSG, Article 24, margin number 62 (C.H. Beck 2022, 4th Edition).</ref> The controller must continuously be able to demonstrate compliance, where necessary by reviewing existing measures and updating them. This requirement is closely related to the controller's obligations laid down in [[Article 32 GDPR|Article 32(1)(d) GDPR]]. Beyond the qualifier "''where necessary''", it is not specified how frequently updates must be carried out. Again, it is the controller’s responsibility to ensure that their processing operations are still compliant.<ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin numbers 37a-38 (C.H. Beck 2021, 3rd Edition).</ref>
=== (2) Data Protection Policies ===
Although ''Hartung'' claims that this paragraph is obscure,<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24, margin number 21 (C.H. Beck 2020, 3rd Edition).</ref> ''Martini'' argues it simply expands on Article 24(1) GDPR by specifying the conditions under which the technical and organisational measures must also include data protection measures. By singling these out, ''Martini'' contends that they constitute specific measures within the "''general''" organisational measures, and that paragraph 2 simply refers to procedural measures. These policies are thus not merely legal requirements, but concrete procedural instructions to follow to avoid any violation of the GDPR. The instructions that should follow from such policies are linked to [[Article 39 GDPR|Article 39(1)(b) GDPR]], which states that the DPO’s duty to monitor compliance with the data protection policies. Again, the principle of proportionality plays a big role. A large company carrying out many different processing operations should have more comprehensive and specific policies than a small company with few processing operations.<ref>''Martini'', in Paal, Pauly, DS-GVO, Article 24, margin numbers 39-42 (C.H. Beck 2021, 3rd Edition).</ref>

=== (3) Self-Regulation Measures as Evidence of Compliance ===
Article 24(3) provides the controller with more certainty regarding the question whether it is sufficiently able to demonstrate compliance with its obligations. The controller can show that it adhered to (i) approved codes of conduct ([[Article 40 GDPR]]), (ii) approved certification mechanisms ([[Article 42 GDPR]]), or (iii) guidelines by the EDPB and advice by the data protection officer (Recital 77 GDPR). Nevertheless, it follows from the word "''element''" that such self-regulation measures only support the assumption that the controller is compliant, but does not prove it.<ref>''Hartung'', in Kühling, Buchner, DS-GVO BDSG, Article 24, margin number 23 (C.H. Beck 2020, 3rd Edition).</ref>
==Decisions==
→ You can find all related decisions in [[:Category:Article 24 GDPR]]

==References==
<references />

[[Category:Article 24 GDPR]]
[[Category:GDPR Articles]]

Article 24 GDPR - Revision history

Bodobalazs: 1 revision imported: GDPRHUB import 2023 04 18