Author: Eva Souhrada-Kirchmayer

 

The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks.

I. Purpose and function of the provision

 

The provision stipulates the common cooperation obligation (“shall cooperate”) of the controller and the processor as well as of their representatives with the SA. Addressees of the norm are primarily and according to the wording and purpose of the norm (fulfilment of the tasks of the SA) the controller (Art. 4 no. 7) and the processor (Art. 4 no. 8). In cases in which they have appointed a representative in accordance with Art. 27, the representative (Art. 4 no. 17) is also addressed by this provision.

The cooperation between the above-mentioned addressees takes place to support the SA in fulfilling its tasks. These tasks are listed in Art. 57 in detail. Since, according to Art. 57 para. 1 lit. v, “any other” task in connection with the protection of personal data counts to the tasks of the SA, the task reference does not ensure a practically effective specification of Art. 31.[1]

Although the SA has investigative powers which enable it to get information from the controllers and processors (Art. 58 para. 1 lit. a, see Art. 58, mn. 5), the GDPR assumes overall cooperative behavior between the actors involved. This is shown in the relationship between the controller, the processor and the SA. The provision of Art. 58 para. 2 concerning the powers of the SA contains a graded system of corrective powers, which enables a cooperative behavior between the actors. If a violation of the GDPR is suspected, the SA is responsible to warn the controller or the processor first (Art. 58 para. 2 lit. a). The next steps are the reprimands (Art. 58 para. 2 lit. b), the order to comply with the GDPR (Art. 58 para. 2 lit. d) and a temporary or definitive limitation including a ban of processing (Art. 58 para. 2 lit. f).[2]

In addition to the (general) obligation to cooperate, which is laid down in Art. 31, the GDPR recognizes a number of special cooperation obligations. The cooperation obligations regulated by special law include the obligation of the SA to provide records of the processing activity upon request (Art. 30 para. 4),[3] the reporting obligation of Art. 33 para. 1 and para. 2 and the obligation to provide the SA with all information needed to fulfil its tasks (Art. 58 para. 1 lit. a). Art. 31 is also closely interrelated with the norm of Art. 24, para. 1, sentence 1, which generally regulates the responsibilities of the controller, as well as with the authorization norm of Art. 58. A cooperation by granting access to the business premises, including all data processing equipment and means of the controller and the processor, is now regulated in a separate obligation in Art. 58 para. 1 lit. f. According to Art. 58 para.1 lit. e, the SA has the right to obtain from the controller and the processor access to all personal data and to all information necessary for the performance of its tasks.

The independent scope of application, which remains in Art. 31 in addition to the special cooperation obligations of its addressees and the powers of the SA (in particular enforcement practice), is limited. However, this does not change the fact that Art. 31, which establishes an independent obligation that the SA can fall back on in its actions, has an independent meaning.[4]

 

 

[…]

 

 

 

 

[1] Kieck in Eßer/Kramer/Lewinski, Art. 31, para. 9.

[2] Kieck in Eßer/Kramer/Lewinski, Art. 31, para. 8.

[3] Recital 82 reads as follows: “In order to demonstrate compliance with this Regulation, the controller or processor should maintain records of processing activities under its responsibility. Each controller and processor should be obliged to cooperate with the supervisory authority and make those records, on request, available to it, so that it might serve for monitoring those processing operations.”

[4] Martini in Paal/Pauly, Art. 31, para. 3a; Polenz, ‘Art. 31’, in Simitis/Hornung/Spiecker gen. Döhmann, para. 7; different view on this: Hartung in Kühling/Buchner, Art. 31, para. 1, 5; Klug in Gola, Art. 31, mn. 1 “declarative”.