Article 32ed

Article 32ed

Mandate and authority of data expert representatives

1.The relationship between a data expert representative and a data holder whom it represents shall be governed by a written mandate expressed in plain and intelligible language, which sets out at a minimum:

(a)the categories of personal data and the categories of data controllers to which the mandate applies;

(b)whether the mandate extends to advice only, or also to the ability to negotiate on behalf of the individual being represented;

(c)the duration of the mandate and the conditions of its revocation, which shall be exercisable by the individual at any time during the course of the mandate, free of charge and by readily accessible means;

(d)the remuneration of the expert representative, according to a formula which reflects a cost-based remuneration model approved in a Commission delegated act; and

(e)the mechanisms for lodging and resolution of complaints by affected individuals.

2.The grant of consent within the meaning of Article 4, point (11) of Regulation (EU) 2016/679 by an expert representative on behalf of an individual shall be considered to be valid when they act pursuant to the terms of their mandate and where the individual retains the capacity at all times to withdraw that consent. An individual’s direct expression of consent shall prevail over a contrary indication communicated by the expert representative.

Terms negotiated by an expert representative on behalf of an individual pursuant to a valid mandate shall be recognised as sufficient to satisfy the requirements for lawful processing under Regulation (EU) 2016/679, including where those terms establish or modify the conditions of consent, legitimate interest, or contractual agreement as the applicable legal basis.

Prior to the entry into force of the new terms negotiated by the data expert representative, the data holder shall be informed of the specific consent given and shall be afforded a reasonable opportunity to exercise their right to withdraw or confirm their acceptance of the terms as negotiated. Such confirmation may be expressed by accepting updated data processing terms on their terminal equipment or before a new use of the service

In all cases, the right of a data holder to negotiate the terms governing the processing of their personal data with the support of an data expert representative shall not be restricted, excluded, or rendered ineffective by any contractual term, service condition, or unilateral act of a data controller or processor. Any such term or condition shall be void to the extent that it purports to waive or limit that right.

Acting within its mandate the data expert representative cannot limit the ability for individuals to access their data, and shall refrain from actions that could lead to the direct monetisation of data of the individuals it represents or actions that could deter data holders from fulfilling its obligations under EU law.

3.A physical or electronic version of the mandate and any modification thereof shall be retained by the data expert representative for the duration of their mandate and for a period of five years thereafter and shall be made available to the competent authority upon request.