The monitoring body designated by the code of conduct

When drawing up a code of conduct, the code owner must organise the monitoring of the code after its approval. The GDPR specifies that this activity can be entrusted to a dedicated body whose mission does not interfere with that of the competent supervisory authority. It is possible to use an internal committee of the code owner or one or more third party bodies.

The guidelines on codes of conduct adopted by the European Data Protection Board (EDPB) also provide explanations and practical examples of the conditions for the designation of this body.

The code of conduct must necessarily describe the mechanisms by which the monitoring body will carry out its missions. The third-party body will use these mechanisms as a basis for creating the procedures that it will implement in order to:

•  Carry out audits prior to adherence to the code of conduct or regular audits after adherence to the code of conduct to ensure that the code is being properly applied by the adherents;
• Dealing with complaints regarding a breach of the code or the way the code has been or is being applied by a controller or processor;
• Take appropriate measures in case of violation of the code, such as suspension or exclusion of the adherent to the code;
• Participate in the updating of the code of conduct.

You can submit an accreditation request if you meet the following three criterions:

1. The code of conduct identifies you as monitoring body;
2. You meet the requirements defined by the CNIL’s accreditation framework;
3. The reference code of conduct is in its final phase of approval by the CNIL or, for European codes, has received a favourable opinion by the EDPB.

Article 41 of the GDPR provides that bodies responsible for monitoring compliance of a code of conduct must be accredited for this purpose by the competent supervisory authority.

In accordance with Article 57(1)(p) of the GDPR, the CNIL drew up a draft accreditation reference framework which was the subject of a public consultation before being submitted to the EDPB for its opinion. On the basis of this opinion, the CNIL adopted its working document regarding accreditation of bodies responsible for monitoring compliance with codes of conduct.

Before submitting an application for accreditation to the CNIL, an applicant must therefore ensure that it is able to meet the requirements listed in the accreditation’s working document adopted on the 24th of July 2020. The applicant can, in particular, rely on a table that proposes examples of documents that can be produced to demonstrate compliance.

This standard has two main categories of requirements: general requirements and special requirements.

The monitoring body must demonstrate the sound management of its activity, by establishing:

• That all the processing carried out by it, in the course of its missions, complies with the GDPR;
• That it has human, financial and material resources proportionate with the scope of the code of conduct;
• That it carries out the tasks set out in the code of conduct;
• That it keeps the documents related to the exercise of its missions in such a way as to preserve their confidentiality or destroy them definitively and in complete safety if they prove to be useless;
• That it respects the security measures put in place by the code’s adherents in the course of its missions.

The monitoring body must demonstrate that it provides sufficient guarantees regarding:

• To its independence:

This independence must be functional, material and decision-making. It can be demonstrated by the implementation of formal rules and procedures governing the appointment, mandate and operating of the monitoring body. The applicant may provide documents or procedures that clearly establishes the division of employees’ roles, the functioning of the decision-making process and the reporting procedures.

• The absence of conflict of interest:

Internal procedures are needed to prevent and avoid conflicts of interest. The body must remain free from all external influence and refrain from actions that are incompatible with its missions and functions.

• The appropriate level of expertise of its member:

The staff, both operational and decision-making, must have the skills and experiences required by the code of conduct and the accreditation’s working document. Each request for accreditation will be assessed in the light of the specific expertise requirements defined by the relevant code.

• Regular, complete and transparent control procedures:

The monitoring procedure used by the monitoring body should be regular, complete and transparent to the code of conduct’s adherents. It may include unannounced audits, annual inspections, regular reports and the use of surveys, but is should be based on objective criterions and correspond to the framework established by the code of conduct.

• The transparent complaints handling procedures:

The monitoring body should have procedures in place to allow for the impartial and objective handling of complaints about breaches of the code or the manners in which the code is being applied by an adherent. Such procedure must be transparent and understandable.

The handling of complaints must be adequately resourced and the employees involved must be sufficiently knowledgeable and impartial.

• The communication and information procedure of the CNIL:

It allows the CNIL to be informed of the decisions taken by the monitoring body, particularly in terms of the seriousness of these decisions and such, within a reasonable time.

• The procedure for the review mechanisms of the Code of Conduct:

The monitoring body is involved in the review of the code when this is decided by the code owner. It must then implement procedures for incorporating the changes decided by the code owner.

• Its status and responsibility, particularly in the context of subcontracting its tasks:

The monitoring body is responsible to the supervisory authority for its actions, including in the case of subcontracting.

It will have to justify the adequate and necessary resources for the continuous exercise of its missions.

• The procedure for the adoption of sanctions and corrective measures:

A code of conduct should include the matrix of corrective measures that can be applied by the monitoring body. The monitoring body should demonstrate that it has procedures in place to take decisions and sanctions under the code of conduct.

To this end, a model letter of formal notice or reminder, as well as a document setting out a procedure for handling disputes, can be presented.

The validity period of an accreditation is five years.

The bodies must first contact the code owner to express their interest in being identified as a monitoring body. Then, it is necessary to wait until the reference code of conduct is in its final accreditation phase before submitting an application for accreditation (in French) to the CNIL.  Indeed, the procedures that the monitoring body will have to put in place will depend on the mechanisms provided for by the code.

For European codes, the application for accreditation can be submitted after the EDPB has given a favourable opinion on the reference code of conduct.

Once the application for accreditation has been submitted, the completeness of the file is examined by the CNIL within ten days.

If the file is not complete, a request for additional information is sent by the CNIL. If the applicant does not reply within the time limit, the file is closed as is.

If the file is complete, an acknowledgement of receipt is sent by the CNIL within ten days. After examining the file, and subject to compliance with the requirements of the accreditation’s working document, the CNIL decides in plenary session on the adoption of the decision to grant accreditation. The applicant is notified of this decision.

The CNIL has published a list of the accredited bodies on its website.

The application for renewal of the accreditation is submitted electronically, at the latest six months before its expiry date (if your accreditation expires on 31th of July 2020, your application for renewal must be send to the CNIL before the 31th of January 2020). As part of the instruction of the renewal application by the Commission’s departments, any document may be requested.

In the event of a substantial change concerning the previously accredited monitoring body, it is necessary to inform the CNIL without delay. Any substantial change may lead to re-examination of the application for accreditation. A substantial change could result, for example, from a shareholding that would call into question the independence of the body, from a reorganisation that would lead to the monitoring body being located outside the European Union or from a change in its financial resources that would no longer allow it to ensure the continuity of its supervisory activities.

If a monitoring body no longer fulfils the requirements for accreditation or if the measures taken by the body constitute a breach of the GDPR, the CNIL’s restricted formation may pronounce the suspension or withdrawal of the accreditation.

Failure to comply with the obligations of a monitoring body may, in addition, expose the monitoring body to an administrative fine up to 10 000 000 euros, or up to 2% of its annual worldwide turnover.