Title: wetten.nl - Regeling - NL accreditation requirements for GDPR code of conduct monitoring bodies - BWBR0044929

Source: https://wetten.overheid.nl/BWBR0044929/

Content:
{"title": "wetten.nl - Regeling - NL accreditation requirements for GDPR code of conduct monitoring bodies - BWBR0044929", "content": "NL accreditation requirements for GDPR code of conduct monitoring bodies\n\nThe Dutch Data Protection Authority (in Dutch: de Autoriteit Persoonsgegevens, hereinafter:\n                                    AP),\n\nWhereas Article 41(1)of the General data Protection Regulation (GDPR) 2016/679 of\n                                    26 April 2016 states that compliance monitoring of approved codes of conduct may be\n                                    carried out by an impartial monitoring body which has an appropriate level of expertise\n                                    in relation to the subject-matter of the code and is accredited for that purpose by\n                                    the competent supervisory authority;\n\nWhereas Article 41 (3) GDPR provides that the competent supervisory authority submits\n                                    the draft requirements for accreditation of a body referred to in paragraph 1 of this\n                                    Article to the Board pursuant to the consistency mechanism referred to in Article\n                                    63 and Article 64 (1) (c);\n\nWhereas Article 57, opening lines and under p, GDPR, stipulates that each supervisory\n                                    authority is responsible for drawing up and publishing the requirements for the accreditation\n                                    of a body for the supervision of codes of conduct on the basis of Article 41 of the\n                                    GDPR;\n\nWhereas Article 6 (2) of the Dutch General Data Protection Regulation Implementation Act (in Dutch: Uitvoeringswet Algemene verordening gegevensbescherming, hereinafter:\n                                    UAVG) stipulates that the AP is the supervisory authority referred to in Article 51\n                                    (1) of the GDPR;\n\nWhereas the European Data Protection Board (EDPB) has adopted: Guidelines 1/2019 on\n                                    Codes of Conduct and Monitoring Bodies under Regulation 2016/679, in particular para\n                                    60;\n\nWhereas the Guidelines 1/2019 set out a number of requirements which the proposed\n                                    monitoring body needs to meet in order to gain accreditation. In particular the following\n                                    requirements should be met:\n\n\u2212 Demonstrate independence and expertise in relation to the subject matter of the code\n                                          as per Article 41(2)(a).\n\n\u2212 Demonstrate established procedures which allow it to assess the eligibility of controllers\n                                          and processors concerned to apply the code, to monitor their compliance with its provisions\n                                          and to periodically review its operation as per Article 41(2)(b).\n\n\u2212 Demonstrate established procedures and structures to handle complaints about infringements\n                                          of the code or the manner in which the code has been, or is being, implemented by\n                                          a controller or processor, and to make those procedures and structures transparent\n                                          to data subjects and the public as per Article 41(2)(c).\n\n\u2212 Demonstrate to the satisfaction of the competent supervisory authority that its tasks\n                                          and duties do not result in a conflict of interest as per Article 41(2)(d).\n\nWhereas the EDPB has adopted: \u2018Opinion 07/2020 on the draft decision of the competent\n                                    supervisory authority of Netherlands regarding the approval of the requirement for\n                                    accreditation of a code of conduct monitoring body pursuant to article 41 GDPR\u2019, adopted\n                                    on 23 July 2020.\n\nHas on 23 February 2021 adopted the following decision on the accreditation requirements\n                                    for code of conduct monitoring bodies:\n\nAccreditation requirements\n\nBy the present decision the AP encourages the development of codes of conduct for\n                                    micro, small and medium companies to foster a consistent implementation of the GDPR,\n                                    to increase legal certainty for controllers and processors and to strengthen the trust\n                                    of data subjects. The requirement for codes of conduct to be monitored by an accredited\n                                    monitoring body should not be an obstacle to the development of codes of conduct.\n                                    Therefore, the application of the accreditation requirements for monitoring bodies\n                                    should take into account the specificities of each sectors\u2019 processing and should\n                                    be as flexible as possible while abiding by the legal framework imposed by the GDPR,\n                                    the Guidelines 01/2019 and the relevant Opinions of the EDPB.\n\nThe AP reserves the right to conduct a risk-based review of the monitoring body to\n                                    ensure that the body still meets the requirements for accreditation. Such a review\n                                    could be initiated by (but is not limited to): amendments to the code of conduct,\n                                    substantial changes to the monitoring body or the monitoring body failing to deliver\n                                    its monitoring functions. In case of substantial changes to the monitoring body relating\n                                    to the monitoring body\u2019s ability to function independently and effectively, such a\n                                    review will always be conducted.\n\nThe monitoring body will retain its accreditation status unless the outcome of this\n                                    review concludes that the requirements for accreditation are no longer met.\n\nThe introduction of a new or additional monitoring body for a code of conduct will\n                                    require the new body to be assessed in line with the accreditation criteria.\n\nThe requirements listed in this document shall apply to a monitoring body regardless\n                                    of whether it is an internal or external body, unless the requirement states otherwise.\n\nExplanatory note:\n\nThe monitoring body shall demonstrate its independence and impartiality. The monitoring\n                                       body shall demonstrate how its structure and its formal rules of appointment guarantee\n                                       that it is able to act freely from instructions and that it shall be protected from\n                                       any sort of interference or sanctions from the code members or the code owner as a\n                                       consequence of the fulfilment of its tasks.\n\nThe requirements below set out what constitutes independence. This needs to be demonstrated\n                                       within four main areas: legal and decision making procedures, financial, organisational\n                                       and accountability. Independence for a monitoring body can be understood as a series\n                                       of formal rules and procedures for the appointment, terms of reference and operation\n                                       of the monitoring body. These rules and procedures will allow the monitoring body\n                                       to perform its monitoring tasks without influence from members of the code or its\n                                       code owner.\n\nMonitoring bodies wills be structured and managed to safeguard their independence\n                                       and impartiality and will be required to demonstrate this to the AP in their submission.\n\nInternal bodies shall be required to provide evidence to ensure that the independence\n                                       of their monitoring activities are not compromised.\n\nRequirements:\n\n1.1.1  Legal and decision-making procedures\n\n\u2212 The legal structure of the monitoring body, including its ownership, must shield the\n                                                      monitoring body from external influence with respect to the code owners and the code\n                                                      members. This might be demonstrated for example by submitting the following documents,\n                                                      the articles of incorporation (the set of formal documents filed with a government\n                                                      body to legally document the creation of a corporation) of the monitoring body and\n                                                      the articles of incorporation of the code owner and by demonstrating that the duration,\n                                                      or expiration of the mandate of the monitoring body is fixed in such a way as to prevent\n                                                      overdependence on a renewal or fear of losing the appointment, to an extent that adversely\n                                                      affects the independence in carrying out the monitoring activities by the monitoring\n                                                      body.\n\n\u2212 The monitoring body shall demonstrate any legal and economic links that may exist\n                                                      between the monitoring body and the code owner or code members, as well as with regard\n                                                      to the profession, industry or sector to which the code applies.\n\n\u2212 The monitoring body\u2019s decision-making procedures must ensure that the decision process\n                                                      from the conception of a decision to its implementation must shield the monitoring\n                                                      body from undue influence. The independence and impartiality of the decision-making\n                                                      procedure might be demonstrated for example by submitting the organigram of the monitoring\n                                                      body and the code owner; a description of the decision-making process that also points\n                                                      out to the roles and prerogatives of all parties involved in the decision-making process\n                                                      associated to a decision making procedure.\n\n\u2212 The monitoring body could be an internal or external body as long as evidence can\n                                                      be provided of adequate procedures and rules that allow monitoring of compliance with\n                                                      a code independently and without undue pressure or influence from the code owner or\n                                                      the code members.\n\n1.1.2. The monitoring body shall demonstrate that it will act independently in its choice\n                                                and application of its actions and sanctions. This could be evidenced by formal rules\n                                                for appointment, terms of reference, powers and operation of any committees or personnel\n                                                that may be involved with an internal monitoring body (such committees or personnel\n                                                shall be free from any commercial, financial and other pressures that might influence\n                                                decisions).\n\n1.1.3. An internal monitoring body shall provide information concerning its relationship\n                                                to its larger entity (in particular the code owner) and shall evidence its impartiality.\n                                                This could be demonstrated with evidence that may include information barriers, separate\n                                                reporting and separate operational and management functions.\n\n1.1.4. The monitoring body shall demonstrate organisational independence, for example, an\n                                                internal monitoring body may use different logos or names where appropriate, information\n                                                barriers and separate reporting structures.\n\n1.1.5. The monitoring body shall not provide any services to code members that would adversely\n                                                affect its independence.\n\n1.1.6. Any decisions made by the monitoring body related to its functions shall not be subject\n                                                to approval by any other organisation, including the code owner.\n\n1.2.1. The monitoring body shall demonstrate that it has the financial stability and resources,\n                                                for the operation of its activities and to meet its liabilities. The resources should\n                                                be proportionate to the expected number, size and complexity of code members (as monitored\n                                                entities), the nature and scope of their activities (which are the subject of the\n                                                code) and the risk(s) associated with the processing operation(s).\n\n1.2.2. The monitoring body shall be able to manage their budget and resources independently\n                                                and effectively monitor compliance without any form of influence from the code owner\n                                                or code members.\n\nThis could be demonstrated with evidence showing that the means by which it obtains\n                                                financial support should not adversely affect its independence. The monitoring body\n                                                would, for instance, not be considered financially independent if the rules governing\n                                                its financial support allow a code member, who is under investigation by the monitoring\n                                                body, to stop its financial contribution to it, in order to avoid a potential sanction\n                                                from the monitoring body.\n\n1.2.3. The monitoring body shall demonstrate to the AP the means by which it obtains financial\n                                                support for its monitoring role and explain how this does not compromise its independence.\n                                                This could be evidenced by delivering contractual clauses or other documentation that\n                                                demonstrates how the monitoring body obtains financial support for its monitoring\n                                                role.\n\n1.3.1. The monitoring body shall demonstrate that it has adequate resources (including technical\n                                                resources)and personnel to effectively perform its tasks, the resources should be\n                                                proportionate to the expected number and size of code members, as well as the complexity\n                                                or degree of risk of the relevant data processing, that it is able to act independently\n                                                from code owners and code members and is protected from interference or sanctions\n                                                as a result of this duty.\n\n1.3.2. The monitoring body shall provide evidence during the application process that their\n                                                personnel can act independently and without undue pressure or influence in relation\n                                                to:\n\na. supervision of resources and finances of the monitoring body;\n\nb. decisions on and performance of compliance monitoring; and\n\nc. safeguarding of impartiality.\n\nSuch evidence can include but is not limited to documented recruitment/appointment\n                                                processes, job descriptions, risk registers, risk treatments, meeting minutes and\n                                                other documented processes as appropriate.\n\n1.3.3. Where a monitoring body uses sub-contractors, it shall ensure that sufficient guarantees\n                                                are in place in terms of the knowledge, reliability and resources of the sub-contractor\n                                                and obligations applicable to the monitoring body are applicable in the same way to\n                                                the sub-contractor. Even when subcontractors are used, the monitoring body shall ensure\n                                                effective monitoring of the services provided by the contracting entity. The use of\n                                                subcontractors does not remove or diminish the responsibility of the monitoring body.\n                                                This could be demonstrated with evidence that may include:\n\na. written contacts or agreements to outline for example responsibilities, confidentiality,\n                                                      what type of data will be held and a requirement that the data is kept secure;\n\nb. a clear procedure for subcontracting shall also be documented and include the conditions\n                                                      under which this may take place, an approval process and the monitoring of subcontractors;\n\nc. requirements relating to the termination of those contracts, in particular so as to\n                                                      ensure that subcontractors fulfil their data protection obligations;\n\nand\n\nd. the monitoring body shall ensure sufficient documented procedures to guarantee the\n                                                      independence, expertise and lack of conflicts of interests of the sub-contractors.\n\n1.4.1. The monitoring body shall provide evidence to demonstrate that it is accountable for\n                                                its decisions and actions, for example, by setting out a framework for its roles and\n                                                reporting procedures and its decision-making process to ensure independence. Such\n                                                evidence could include but is not limited to job descriptions, management reports\n                                                and policies to increase awareness among the personnel about the governance structures\n                                                and the procedures in place (e.g. training).\n\nExplanatory note:\n\nThe requirements below aim to ensure that the monitoring body possesses adequate competencies\n                                       to undertake effective monitoring of a code. More detailed expertise requirements\n                                       will be defined in the relevant code itself. Code specific requirements will be dependent\n                                       upon such factors as: the size of the sector concerned, the different interests involved\n                                       and the risks of the processing activities. These code specific requirements will\n                                       be considered as part of the accreditation.\n\nIn order for a monitoring body to meet the expertise requirements, it will need to\n                                       demonstrate that its personnel have the required knowledge and experience in relation\n                                       to the sector, processing activity, data protection legislation and auditing, in order\n                                       to carry out compliance monitoring in an effective manner. This could be demonstrated\n                                       to the AP with evidence that includes: personnel job descriptions, specification requirements,\n                                       qualifications, required or relevant experience, published reports etc.\n\nRequirements:\n\n2.1 The monitoring body shall demonstrate that it has an in-depth understanding, knowledge\n                                             and experience in relation to the specific data processing activities in relation\n                                             to the code. Evidence as to whether it has recognised expertise may include its status\n                                             as a recognised and traceable professional standards body, internal committee, trade\n                                             association, interest group, federation, society or sectoral, legal, audit body or\n                                             similar.\n\n2.2 The monitoring body shall ensure that personnel conducting its monitoring functions\n                                             or making decisions on behalf of the monitoring body have in-depth sectoral and data\n                                             protection expertise and operational experience, training and qualifications such\n                                             as previous experience in auditing, monitoring or quality assurance.\n\n2.3 The monitoring body shall demonstrate that it meets the expertise requirements in\n                                             2.1 and 2.2 above and also the relevant expertise requirements as defined in the code\n                                             of conduct. Expertise may be demonstrated for example by submitting evidence of adequately\n                                             trained, educated and experienced staff in these domains. For example through the\n                                             means of a diploma, certification and a proof of experience.\n\nExplanatory note:\n\nThe requirements below aim to ensure that the proposals for monitoring are operationally\n                                       feasible, by specifically outlining the monitoring process and demonstrating how it\n                                       will deliver the code\u2019s monitoring mechanism.\n\nThe monitoring body will need to demonstrate to the AP established procedures, structures\n                                       and resources to assess the eligibility of controllers/processors to apply the code,\n                                       monitor compliance with the code and to carry out periodic reviews of the code\u2019s operation.\n\nMonitoring procedures must take into account the risk raised by the data processing,\n                                       complaints received and the expected number and size of code members. These procedures\n                                       could lead to the publication of monitoring information including audit or summary\n                                       reports or periodic outcomes reporting of findings.\n\nThe monitoring body shall apply the corrective measures and penalties as defined in\n                                       the code of conduct.\n\nRequirements:\n\n3.1 The monitoring body shall demonstrate that they have a procedure to check prior to\n                                             joining the eligibility of members to comply with the code, for example, their processing\n                                             of personal data falls within the scope of the relevant code of conduct.\n\n3.2 The monitoring body shall provide evidence of upfront, ad hoc and regular procedures\n                                             to monitor the compliance of members within a clear timeframe such as, procedures\n                                             providing for audit plans to be carried out over a definite period and on the basis\n                                             of predetermined criteria.\n\n3.3 The monitoring body shall demonstrate that they have a procedure to provide compliance\n                                             monitoring to be carried out over a defined period taking into account such things\n                                             as: the complexity and risks involved, the expected number and size of code members,\n                                             geographical scope and complaints received.\n\n3.4 The monitoring body shall demonstrate that their audit or review procedures define\n                                             the criteria to be assessed, the type of assessment to be used and a procedure to\n                                             document the findings. Review procedures can include such things as: audits, inspections,\n                                             reporting and the use of self-monitoring reports or questionnaires.\n\n3.5 The monitoring body shall demonstrate that they have a procedure for the investigation,\n                                             identification and management of code member infringements to the code and additional\n                                             controls to ensure appropriate action is taken to remedy such infringements as set\n                                             out in the relevant code of conduct.\n\n3.6 The monitoring body shall be responsible for the management of all information obtained\n                                             or created during the monitoring process. The monitoring body shall ensure that personnel\n                                             will keep all information obtained or created during the performance of their tasks\n                                             confidential, unless they are required to disclose or are exempt by law.\n\nExplanatory note:\n\nTransparent and publicly available procedures and structures to handle complaints\n                                       in relation to code members from different sources are an essential element for code\n                                       monitoring. This process will be sufficiently resourced and managed and personnel\n                                       will demonstrate adequate (sufficient to the need) knowledge and impartiality.\n\nIn order to meet these requirements the monitoring body will need to provide evidence\n                                       of a documented, independent, and transparent complaints handling process to receive,\n                                       evaluate, track, record and resolve complaints within a reasonable time frame.\n\nWhere appropriate, information concerning the monitoring body\u2019s decision will be provided\n                                       to all concerned within a period not exceeding three months.\n\nRequirements:\n\n4.1 The monitoring body shall provide evidence of a clear framework for a publicly available,\n                                                accessible and easily understood complaints handling and decision-making process.\n                                                \u2018This may be demonstrated for example by an outline of the procedure to receive, manage\n                                                and process complaints, which in turn shall be publicly available and easily accessible.\u2019\n                                                This procedure specifies for example;\n\n\u2013 how the complainant is informed;\n\n\u2013 the consequences should the complaint be rejected;\n\n\u2013 the consequences should the complaint be considered justified\u2019\n\n4.2 The monitoring body shall acknowledge receipt of the complaint and the complainant\n                                                shall be notified on the progress or outcome of the complaint without undue delay\n                                                and at the latest within three months from the receipt of the complaint.\n\nThe period to resolve the complaint may be extended by a reasonable period where necessary,\n                                                taking into account the complexity of the complaint. The monitoring body shall inform\n                                                the complainant of any such extension within three months of receipt of the complaint,\n                                                together with the reasons for the delay.\n\n4.3 The monitoring body shall provide evidence of suitable corrective measures, as defined\n                                                in the code of conduct, in cases of infringement with the code to stop the infringement\n                                                and avoid future re-occurrence. Such sanctions could also include, training, issuing\n                                                a warning, report to the board of the member, formal notice requiring action, suspension\n                                                or exclusion from the code.\n\n4.4 The monitoring body shall provide evidence of their process for notifying the AP,\n                                                code members and the code owner, immediately and without undue delay about the measures\n                                                taken and justification of any infringements leading to code member suspension or\n                                                exclusion.\n\n4.5 The monitoring body shall maintain a record of all complaints and actions which the\n                                                AP can access at any time.\n\n4.6 In accordance with the EDPB guidelines; decisions of the monitoring body shall be\n                                                made publicly available in line with its complaints handling procedure. Decisions\n                                                are published when they relate to repeated and/or serious violations, such as the\n                                                ones that could lead to the suspension or exclusion of the controller or processor\n                                                concerned from the code.\n\n4.7 Otherwise publication of summaries of decisions or statistical data should be considered\n                                                adequate.\n\nExplanatory note:\n\nThe requirements below aim to ensure that the monitoring body can deliver its monitoring\n                                       activities in an impartial manner, identifying situations that are likely to create\n                                       a conflict of interest and taking steps to avoid them.\n\nIt will be for the monitoring body to explain the approach to safeguard impartiality\n                                       and to evidence the mechanisms to remove or mitigate these risks as appropriate. Examples\n                                       of sources of risks to impartiality of the monitoring body could be based on ownership,\n                                       governance, management, personnel, shared resources, finances, contracts, outsourcing,\n                                       training, marketing and payment of sales commission.\n\nAn example of a conflict of interest situation would be the case where personnel conducting\n                                       audits or making decisions on behalf of a monitoring body had previously worked for\n                                       any of the organisations adhering to the code. In order to avoid any conflict of interest,\n                                       the personnel would declare their interest and the work would be reallocated.\n\nRequirements:\n\n5.1. The monitoring body shall have in place a documented procedure to identify, analyse,\n                                             evaluate, treat, monitor and document on an ongoing basis any risks to impartiality\n                                             arising from its activities. The monitoring body personnel shall undertake to comply\n                                             with these requirements and to report any situation likely to create a conflict of\n                                             interest. The monitoring body shall refrain from any action incompatible with its\n                                             tasks and duties.\n\n5.2. The monitoring body shall choose or direct and manage its personnel. This could be\n                                             demonstrated by providing evidence which includes job descriptions, personnel records,\n                                             recruitment personnel resource allocations and line management arrangements.\n\nStaff can be provided by another body independent of the code. An example of staff\n                                             provided by a body independent of the code would be monitoring body personnel that\n                                             have been recruited by an independent external company, which provides recruitment\n                                             and human resources services.\n\n5.3. The monitoring body shall ensure that it does not seek or take instructions from any\n                                             person, organisation or association and shall remain free from external influence.\n\n5.4. The monitoring body shall be protected from sanctions or interference by the code\n                                             owner, other relevant bodies or members of the code.\n\nExplanatory note:\n\nThe section below sets out the information the monitoring body will provide to the\n                                       AP. These include information concerning any suspension or exclusion of code members\n                                       and any substantial changes to its own status.\n\nIt is envisaged that suspension or exclusion of code members will only apply in serious\n                                       circumstances and code members would first have the opportunity to take suitable corrective\n                                       measures as appropriate and agreed with the monitoring body.\n\nAny substantial changes relating to the monitoring body\u2019s ability to function independently\n                                       and effectively, its expertise and any conflict of interests could result in a review\n                                       of its accreditation.\n\nRequirements:\n\n6.1. Applications for monitoring body accreditation with all supporting documents, as set\n                                             out as examples in the requirements above, and all other correspondence must be submitted\n                                             to the AP in the Dutch or the English language.\n\n6.2. The monitoring body shall evidence a clear framework to allow for reporting of any\n                                             suspensions or exclusions of code members to the AP. This reporting shall require\n                                             as a minimum:\n\na. inform the AP promptly and in writing of any suspension or exclusion providing valid\n                                                   reasons for the decision;\n\nb. provide information outlining details of the infringement and actions taken; and\n\nc. provide evidence that they have taken action in line with their suspension or exclusion\n                                                   process.\n\n6.3. The monitoring body shall have a documented procedure for lifting the suspension or\n                                             exclusion of a code member and notifying that code member and the AP of the outcome\n                                             of the review or investigation.\n\n6.4. Substantial changes to the monitoring body may include but are not limited to:\n\na. its legal, commercial, ownership or organisational status and key personnel;\n\nb. resources and location(s); and\n\nc. any changes to the basis of accreditation.\n\n6.5. The monitoring body shall report any substantial changes to the AP immediately and\n                                             without undue delay. Substantial changes would result in a review of the accreditation.\n\nExplanatory note:\n\nMonitoring bodies have a key role in contributing to the review of the code in conjunction\n                                       with the code owner. As a result of a code review, amendments or extensions to the\n                                       code may be made by the code owner.\n\nRequirements:\n\n7.1 The monitoring body will contribute to reviews of the code as required by the code\n                                             owner and shall therefore ensure that it has documented plans and procedures to review\n                                             the operation of the code to ensure that the code remains relevant to the members\n                                             and continues to meet the application of the GDPR.\n\nThe review mechanisms should take into account any changes in the application and\n                                             interpretation of the law or where there are new technological developments which\n                                             have impact upon the data processing carried out by the code members or the provisions\n                                             of the code.\n\n7.2 The monitoring body shall also provide the code owner and any other establishment\n                                             or institution referred to in the code of conduct with an annual report on the operation\n                                             of the code. The report shall include:\n\na. information concerning new members to the code;\n\nb. details of any suspensions and exclusions of code members;\n\nc. confirmation that a review of the code has taken place and that following review no\n                                                   amendments to the code are required;\n\nd. that there are no substantial changes to the monitoring body; and\n\ne. Information concerning data breaches by code members, complaints managed and the type\n                                                   and outcome of monitoring functions that have taken place.\n\n7.3 The monitoring body shall apply code updates and implement amendments and extensions\n                                             to the code as instructed by the code owner.\n\n7.4 The monitoring body shall ensure that information concerning its monitoring functions\n                                             is recorded and made available to the AP as required.\n\nExplanatory note:\n\nThe monitoring body may be set up or established in a number of different ways, for\n                                       example limited companies or trade associations. However the overarching principle\n                                       is that whatever form the monitoring body takes, it must demonstrate sufficient financial\n                                       and other resources to deliver its specific duties and responsibilities. The existence\n                                       of sufficient financial and other resources should be accompanied with the necessary\n                                       procedures to ensure the functioning of the code of conduct over time. The monitoring\n                                       body will therefore have to provide evidence to the AP of its legal status.\n\nFines could be administered for a monitoring body failing to deliver its monitoring\n                                       functions and failing to take appropriate action when code requirements are infringed.\n                                       A monitoring body will therefore demonstrate that it has the appropriate standing\n                                       to carry out its role under GDPR Article 41(4).\n\nRequirements:\n\n8.1. The monitoring body shall indicate whether it acts as an internal or external monitoring\n                                             body in relation to the code owner.\n\n8.2. The monitoring body shall evidence to the AP that it has the appropriate legal standing\n                                             to meet the requirements of being fully accountable in its role with sufficient financial\n                                             and other resources; in particular with reference to Article 83 of the GDPR and Article 14(3) of the UAVG and Article 16(1) of the UAVG, being able to take appropriate action in line with Article 41 GDPR, and that it\n                                             has access to adequate resource requirements to fulfil its monitoring responsibilities.\n\nThe monitoring body shall also evidence that it can deliver the code of conduct\u2019s\n                                             monitoring mechanism over a suitable period of time.\n\nSuch evidence could depend on the structure of the monitoring body and could include\n                                             (but not be limited to):\n\na. full company and business name, seat of the monitoring body and registered Chamber\n                                                   of Commerce number; and\n\nb. evidence that the monitoring body has adequate financial resources to demonstrate\n                                                   how fines will be paid, such that the requirements of GDPR Article 83(4)(c) and Article 14(3) of the UAVG and Article 16(1) of the UAVG can be met.\n\n8.3. The monitoring body shall be a legal entity, or a defined part of a legal entity such\n                                             that it is legally responsible for its monitoring activities. The monitoring body\n                                             shall agree to be responsible for its monitoring role and therefore responsible for\n                                             a fine under GDPR Article 83(4)(c) and Article 14(3) of the UAVG.\n\n8.4. The monitoring body shall be established in the European Economic Area (EEA).\n\n8.5. In addition to the seat of the monitoring body the names of its representatives and,\n                                             if different, the names of the persons responsible for its control shall be added.\n                                             Its aim is to determine who is responsible for the actions of the monitoring body\n                                             and to identify the responsible department against which to take action in the event\n                                             of non-compliance with its obligations.\n\nExplanatory note:\n\nMonitoring bodies could engage subcontractors. The requirements below set out the\n                                       relevant safeguards for engaging subcontractors.\n\nIn order to demonstrate these safeguards the monitoring body will need to provide\n                                       documented evidence.\n\nRequirements:\n\n9.1. When the monitoring body engages a subcontractor to fulfil some of its tasks, the\n                                             monitoring body remains responsible for all activities sub-contracted.\n\n9.2. The monitoring body shall specify the tasks and roles that the subcontractors will\n                                             carry out when it applies for accreditation.\n\n9.3. The monitoring body shall demonstrate that the subcontractor satisfies all relevant\n                                             requirements set out in this decision and in particular requirements 1; 2; 3; 8.5.\n\nThe monitoring body shall demonstrate that the subcontractor is effectively bound\n                                             by these requirements and can deliver compliance on them.\n\n9.4. Without prejudice to requirement 6.3, the monitoring body shall have a procedure in place to communicate to the AP without\n                                             delay all substantial changes relating to a subcontractor that have an impact on the\n                                             organisation and/or structure of the monitoring body which could affect its ability\n                                             to perform its function effectively. Such substantial changes may include:\n\n\u2212 the termination of the agreement with the subcontractor;\n\n\u2212 the replacement of the subcontractor by a new one."}