235.11

¹For the in­vest­ig­a­tion of the cir­cum­stances un­der Art­icles 27 and 29 DPA, and in par­tic­u­lar the ex­am­in­a­tion of the law­ful­ness of data pro­cessing, the Com­mis­sion­er may re­quest the fol­low­ing in­form­a­tion in par­tic­u­lar from the con­trol­ler of the data file:

a.

tech­nic­al and or­gan­isa­tion­al meas­ures (Art. 8-10, 20) that have been taken or that are planned;

b.

the reg­u­la­tions re­lat­ing to the cor­rec­tion, block­ing, ren­der­ing an­onym­ous, stor­ing, safe­guard­ing and de­struc­tion of per­son­al data;

c.

the con­fig­ur­a­tion of the in­form­a­tion tech­no­logy used;

d.

links with oth­er data files;

e.

the man­ner of the dis­clos­ure the data;

f.

the de­scrip­tion of the data fields and the or­gan­isa­tion­al units that have ac­cess to them;

g.

the nature and ex­tent of ac­cess by users to the data in the data file.

²In the case of trans­bor­der dis­clos­ure, the Com­mis­sion­er may re­quest ad­di­tion­al in­form­a­tion, in par­tic­u­lar on the pro­cessing pos­sib­il­it­ies of the data re­cip­i­ent or on the data pro­tec­tion meas­ures taken.