1. Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.
Article 41 GDPR - Monitoring of approved codes of conduct
2. A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:
(a) demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;
(b) established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;
(c) established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and
(d) demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.
3. The competent supervisory authority shall submit the draft requirements for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.
4. Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.
5. The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the requirements for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.
6. This Article shall not apply to processing carried out by public authorities and bodies.
Relevant Recitals
No relevant recitals listed.
Frequently Asked Questions
Short answers to common questions about this provision. They are general information and not legal advice.
Article 41(1) allows compliance with a code of conduct approved under Article 40 to be monitored by a body with an appropriate level of expertise in the subject-matter of the code, accredited for that purpose by the competent supervisory authority. This monitoring operates without prejudice to the tasks and powers of the supervisory authority under Articles 57 and 58, so the authority retains its own enforcement role alongside the monitoring body.
Paragraph 2 sets four cumulative conditions. The body must demonstrate its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority, establish procedures to assess the eligibility of controllers and processors, monitor their compliance and periodically review the operation of the code, establish transparent procedures and structures to handle complaints about infringements of the code, and demonstrate that its tasks and duties do not result in a conflict of interests.
Under paragraph 4 the body shall, subject to appropriate safeguards, take appropriate action in cases of infringement, including suspension or exclusion of the controller or processor from the code, and must inform the competent supervisory authority of such actions and the reasons for them. These powers operate without prejudice to the tasks and powers of the supervisory authority and to the remedies and penalties in Chapter VIII.
Yes. Paragraph 5 obliges the competent supervisory authority to revoke the accreditation where the requirements for accreditation are not, or are no longer, met, or where actions taken by the body infringe the Regulation. Revocation is framed as a duty of the authority, not a discretion.
No. Paragraph 6 excludes processing carried out by public authorities and bodies from the Article, so accredited-body monitoring does not extend to them. Article 40 nonetheless permits public authorities to draw on codes of conduct, and supervision of their processing remains with the supervisory authorities under Articles 57 and 58.