# Standards and Regulatory References

## Primary Legislation

### GDPR Article 31 — Cooperation with the Supervisory Authority
The controller and the processor and, where applicable, their representatives, shall cooperate, on request, with the supervisory authority in the performance of its tasks.

### GDPR Article 58 — Powers of Supervisory Authorities
- **Art. 58(1) — Investigative powers**: (a) order controller/processor to provide information; (b) carry out data protection audits; (c) carry out review of certifications; (d) notify of alleged infringements; (e) obtain access to personal data; (f) obtain access to premises.
- **Art. 58(2) — Corrective powers**: (a) issue warnings; (b) issue reprimands; (c) order compliance; (d) order communication to data subject; (e) impose processing ban; (f) order rectification/erasure/restriction; (g) withdraw certification; (h) impose administrative fines; (i) order suspension of data flows.
- **Art. 58(4)**: Exercise of powers shall be subject to appropriate safeguards, including effective judicial remedy and due process.

### GDPR Article 83(5)(e) — Fines for Non-Cooperation
Non-compliance with an order by the supervisory authority pursuant to Article 58(2) is subject to administrative fines up to EUR 20,000,000 or 4% of annual global turnover.

### GDPR Articles 60-66 — Cooperation and Consistency Mechanism
- **Art. 60**: Cooperation between lead supervisory authority and other concerned authorities.
- **Art. 61**: Mutual assistance between supervisory authorities.
- **Art. 63**: Consistency mechanism via the EDPB.

## Regulatory Guidance

### EDPB Guidelines on Administrative Fines (2017, last endorsed 2023)
The EDPB guidelines on calculation of fines include cooperation/non-cooperation with the supervisory authority as an aggravating/mitigating factor under Art. 83(2)(f). Proactive cooperation can reduce fines; obstruction increases them.

### National Supervisory Authority Powers
- **BfDI (Germany)**: Additional investigative powers under Section 16 BDSG, including the power to enter business premises during operating hours.
- **ICO (UK)**: Information notices under Section 142 DPA 2018; assessment notices under Section 146; enforcement notices under Section 149.
- **CNIL (France)**: On-site inspection powers under Article 19 of Loi Informatique et Libertés; right to obtain copies of all documents.

## Enforcement Precedents

- **Clearview AI (Multiple DPAs, 2021-2022)**: Fined by Italian Garante (EUR 20M), Greek DPA (EUR 20M), French CNIL (EUR 20M), and UK ICO (GBP 7.5M). Non-cooperation was cited as an aggravating factor by several authorities.
- **WhatsApp Ireland (Irish DPC, 2021, EUR 225M)**: Cooperation during the investigation was noted but the length of the investigation (3 years) reflected complexity of cross-border cooperation under Art. 60.
- **Amazon Europe (Luxembourg CNPD, 2021, EUR 746M)**: Largest GDPR fine to date. The CNPD exercised its full investigative powers under Art. 58(1).

## ISO/IEC Standards

- **ISO/IEC 27701:2019** — Section 7.2.6: Contacts with authorities — organisations should maintain contact procedures with relevant authorities including data protection supervisory authorities.
- **ISO/IEC 27001:2022** — Annex A Control 5.5 (Contact with authorities): Appropriate contacts with relevant authorities shall be maintained.