Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 41
Monitoring of approved codes of conduct
Chapter 4|Controller and Processor|📖 4 min read
1. Without prejudice to the tasks and powers of the competent supervisory authority under Articles 57 and 58, the monitoring of compliance with a code of conduct pursuant to Article 40 may be carried out by a body which has an appropriate level of expertise in relation to the subject-matter of the code and is accredited for that purpose by the competent supervisory authority.
2. A body as referred to in paragraph 1 may be accredited to monitor compliance with a code of conduct where that body has:
(a) demonstrated its independence and expertise in relation to the subject-matter of the code to the satisfaction of the competent supervisory authority;
(b) established procedures which allow it to assess the eligibility of controllers and processors concerned to apply the code, to monitor their compliance with its provisions and to periodically review its operation;
(c) established procedures and structures to handle complaints about infringements of the code or the manner in which the code has been, or is being, implemented by a controller or processor, and to make those procedures and structures transparent to data subjects and the public; and
(d) demonstrated to the satisfaction of the competent supervisory authority that its tasks and duties do not result in a conflict of interests.
3. The competent supervisory authority shall submit the draft requirements for accreditation of a body as referred to in paragraph 1 of this Article to the Board pursuant to the consistency mechanism referred to in Article 63.
4. Without prejudice to the tasks and powers of the competent supervisory authority and the provisions of Chapter VIII, a body as referred to in paragraph 1 of this Article shall, subject to appropriate safeguards, take appropriate action in cases of infringement of the code by a controller or processor, including suspension or exclusion of the controller or processor concerned from the code. It shall inform the competent supervisory authority of such actions and the reasons for taking them.
5. The competent supervisory authority shall revoke the accreditation of a body as referred to in paragraph 1 if the requirements for accreditation are not, or are no longer, met or where actions taken by the body infringe this Regulation.
6. This Article shall not apply to processing carried out by public authorities and bodies.
Understanding This Article
Article 41 creates a system for independent monitoring bodies to ensure that organizations adhering to codes of conduct (established under Article 40) actually comply with those codes. This is crucial because codes of conduct are voluntary industry self-regulation mechanisms, and effective monitoring ensures they maintain credibility and effectiveness.
The accreditation process is rigorous. Monitoring bodies must prove their independence and expertise to the satisfaction of the supervisory authority. They must establish clear procedures for assessing eligibility, monitoring compliance, and periodically reviewing the code's operation. Importantly, they must also create transparent complaint-handling mechanisms accessible to data subjects and the public.
These monitoring bodies have real enforcement powers. If a controller or processor violates the code, the monitoring body can take action including suspending or excluding them from the code. However, they must inform the supervisory authority of such actions. The supervisory authority retains ultimate oversight and can revoke the monitoring body's accreditation if it fails to meet requirements or infringes the GDPR.
Key Points
Monitoring bodies must be accredited by supervisory authorities to oversee code compliance
Accreditation requires demonstrated independence, expertise, and complaint-handling procedures
Monitoring bodies can suspend or exclude non-compliant organizations from codes
Supervisory authorities can revoke accreditation if requirements are not met
Does not apply to public authorities and bodies
Practical Application
Example 1 - Industry Association: A European advertising industry association creates a code of conduct for online behavioral advertising. They establish an independent monitoring body, "AdTech Compliance Monitor," which applies for accreditation with the relevant supervisory authority. The monitoring body demonstrates its expertise in online advertising technology and data protection, establishes procedures for handling consumer complaints, and proves its independence from advertising companies. Once accredited, it can monitor member companies' compliance and suspend membership for violations.
Example 2 - Healthcare Sector: A healthcare data processors association develops a code of conduct for handling electronic health records. An independent body with medical data expertise applies for accreditation. It establishes quarterly compliance audits, a transparent complaint portal for patients, and a review committee. When a member company experiences a data breach and fails to follow the code's incident response procedures, the monitoring body investigates, documents the violation, and temporarily suspends the company's membership while informing the supervisory authority.
Example 3 - Revocation of Accreditation: A monitoring body accredited to oversee a retail sector code of conduct fails to investigate multiple consumer complaints and shows bias toward larger member companies. The supervisory authority conducts a review, determines the monitoring body no longer meets independence requirements, and revokes its accreditation.