wetzoeker

4 — Complaints about code members NL accreditation requirements for GDPR code of conduct monitoring bodies

Complaints about code members

4.1 The monitoring body shall provide evidence of a clear framework for a publicly available, accessible and easily understood complaints handling and decision-making process. ‘This may be demonstrated for example by an outline of the procedure to receive, manage and process complaints, which in turn shall be publicly available and easily accessible.’ This procedure specifies for example;

– how the complainant is informed;

– the consequences should the complaint be rejected;

– the consequences should the complaint be considered justified’

4.2 The monitoring body shall acknowledge receipt of the complaint and the complainant shall be notified on the progress or outcome of the complaint without undue delay and at the latest within three months from the receipt of the complaint.

The period to resolve the complaint may be extended by a reasonable period where necessary, taking into account the complexity of the complaint. The monitoring body shall inform the complainant of any such extension within three months of receipt of the complaint, together with the reasons for the delay.

4.3 The monitoring body shall provide evidence of suitable corrective measures, as defined in the code of conduct, in cases of infringement with the code to stop the infringement and avoid future re-occurrence. Such sanctions could also include, training, issuing a warning, report to the board of the member, formal notice requiring action, suspension or exclusion from the code.

4.4 The monitoring body shall provide evidence of their process for notifying the AP, code members and the code owner, immediately and without undue delay about the measures taken and justification of any infringements leading to code member suspension or exclusion.

4.5 The monitoring body shall maintain a record of all complaints and actions which the AP can access at any time.

4.6 In accordance with the EDPB guidelines; decisions of the monitoring body shall be made publicly available in line with its complaints handling procedure. Decisions are published when they relate to repeated and/or serious violations, such as the ones that could lead to the suspension or exclusion of the controller or processor concerned from the code.

4.7 Otherwise publication of summaries of decisions or statistical data should be considered adequate.

Regeling
NL accreditation requirements for GDPR code of conduct monitoring bodies
Soort
ZBO-regeling
Geldend vanaf
10-03-2021
BWB-id
BWBR0044929
Versie
2021-03-10_0

In de hele regeling · Officiële tekst op wetten.overheid.nl