applies to the situations where the personal data breach is likely to result in a high
risk to the rights and freedoms of natural persons.
2.6 Codes of Conduct
The drawing up and approval of codes of conduct in the field of data protection and
certification mechanisms in this area are regulated in detail in Article 40–43 of the
GDPR. Associations and bodies representing controllers or processors are encouraged to draw up codes of conduct in order to facilitate the effective application of the
Regulation. The main goal of such codes of conduct is to specifying the application
of the data protection legislation on issues such as fair and transparent processing;
the interests pursued by controllers in specific contexts; the collection of personal
data; the information provided to data subjects; the exercise of the rights of data
subjects; the international transfer of personal data; or alternative dispute resolution
procedures for resolving disputes between controllers and data subjects with regard
to processing. Draft codes of conducted submitted by associations and other bodies
may be approved by the competent supervisory authority if it finds that it provides
sufficient appropriate safeguards. Such codes are registered and published by the
competent supervisory authority. The Commission may decide that an approved
code of conduct which relates to processing activities in several Member States has
general validity within the Union. The monitoring of compliance with a code of
conduct may be carried out by a body which is accredited for that purpose by the
competent supervisory authority.
The GDPR encourages associations or other bodies representing categories of
controllers or processors to draw up codes of conduct to facilitate the effective
application of the Regulation and calibrate the obligations of controllers and processors. Pursuant to Article 40 of the GDPR, the drafting of such codes is deemed of
particular interest to take account the specific characteristics of the processing carried
out in certain sectors and the specific needs of micro, small and medium enterprises.
Relevant stakeholders, including data subjects, should be consulted in the process of
adopting a code of conduct. Where a draft code of conduct relates to processing
activities in several Member States, it may be submitted to a procedure at European
level that can lead to a decision by the Commission establishing that an approved
code of conduct has general validity within the Union. The Commission shall ensure
appropriate publicity for such codes [Article 40(10) GDPR].
In the previous practice of the Article 29 Working Party, a reference can be made
to Opinion 4/2010 on the European code of conduct of FEDMA for the use of
personal data in direct marketing
24 and to Opinion 02/2015 on C-SIG Code of
Conduct on Cloud Computing,
25 concluding that the code provided important
24 WP 174, adopted on 13 July 2010.
25 WP 232, adopted on 22 September 2015.
Data Protection in the Internet: A European Union Perspective
467
risk to the rights and freedoms of natural persons.
2.6 Codes of Conduct
The drawing up and approval of codes of conduct in the field of data protection and
certification mechanisms in this area are regulated in detail in Article 40–43 of the
GDPR. Associations and bodies representing controllers or processors are encouraged to draw up codes of conduct in order to facilitate the effective application of the
Regulation. The main goal of such codes of conduct is to specifying the application
of the data protection legislation on issues such as fair and transparent processing;
the interests pursued by controllers in specific contexts; the collection of personal
data; the information provided to data subjects; the exercise of the rights of data
subjects; the international transfer of personal data; or alternative dispute resolution
procedures for resolving disputes between controllers and data subjects with regard
to processing. Draft codes of conducted submitted by associations and other bodies
may be approved by the competent supervisory authority if it finds that it provides
sufficient appropriate safeguards. Such codes are registered and published by the
competent supervisory authority. The Commission may decide that an approved
code of conduct which relates to processing activities in several Member States has
general validity within the Union. The monitoring of compliance with a code of
conduct may be carried out by a body which is accredited for that purpose by the
competent supervisory authority.
The GDPR encourages associations or other bodies representing categories of
controllers or processors to draw up codes of conduct to facilitate the effective
application of the Regulation and calibrate the obligations of controllers and processors. Pursuant to Article 40 of the GDPR, the drafting of such codes is deemed of
particular interest to take account the specific characteristics of the processing carried
out in certain sectors and the specific needs of micro, small and medium enterprises.
Relevant stakeholders, including data subjects, should be consulted in the process of
adopting a code of conduct. Where a draft code of conduct relates to processing
activities in several Member States, it may be submitted to a procedure at European
level that can lead to a decision by the Commission establishing that an approved
code of conduct has general validity within the Union. The Commission shall ensure
appropriate publicity for such codes [Article 40(10) GDPR].
In the previous practice of the Article 29 Working Party, a reference can be made
to Opinion 4/2010 on the European code of conduct of FEDMA for the use of
personal data in direct marketing
24 and to Opinion 02/2015 on C-SIG Code of
Conduct on Cloud Computing,
25 concluding that the code provided important
24 WP 174, adopted on 13 July 2010.
25 WP 232, adopted on 22 September 2015.
Data Protection in the Internet: A European Union Perspective
467