During a lawful investigation, a supervisory authority requests information from a controller, and the controller refuses all cooperation without a recognised legal ground. Which accountability rule is breached?
Select an answer to reveal the explanation.
Short Explanation
When the referee asks for the match sheet mid-game, walking off is not a strategy. GDPR expects controllers and processors to cooperate with supervisory authorities doing their jobs. Waiting until after a fine, or blaming an internal ‘silence policy,’ misses the duty.
Full Explanation
Article 31 requires controllers and processors to cooperate with the supervisory authority on request in the performance of its tasks. Refusing all cooperation during a lawful investigation without a recognised legal ground breaches that duty and undermines the public supervisory system that protects data subjects. Accountability includes answering authorities with timely, accurate information—not only drafting internal policies that look complete on a shelf.
Internal policy preferring silence does not override Article 31. Controllers are not excused on the theory that only processors must cooperate or that controllers deal solely with courts. Cooperation duties are not limited to the period after a fine is issued; they apply during investigations and ongoing supervisory tasks.
Exam caveat: legally privileged materials and recognised objections may sometimes limit disclosure, but blanket non-cooperation is the failure mode tested here. Article 58 investigative powers sit alongside the Article 31 cooperation duty.
Operational check: establish a supervisory-authority response playbook with legal-review timelines, preserve requested records, train staff not to ignore official requests, and document cooperation steps in the inquiry or incident file.