S.L. 586.8 Art. 49Powers of the Commissioner. 33

The Commissioner shall have the following powers:

(a) investigative powers consisting of the following:

(i) to order the controller and the processor, and, where applicable, the controller's or the processor's representative to provide any information he requires for the performance of his tasks;

(ii) to carry out investigations including in the form of data protection audits;

(iii) to notify the controller or the processor of an alleged infringement of these regulations;

(iv) to obtain, from the controller and the processor, access to all personal data and to all information necessary for the performance of its tasks.

(b) corrective powers consisting of the following:

(i) to issue warnings to a controller or processor that intended processing operations are likely to infringe the provisions of these regulations;

(ii) to issue reprimands to a controller or a processor where processing operations have infringed any provision of these regulations;

(iii) to order the controller or the processor to comply with the data subject's requests to exercise his rights pursuant to these regulations; FOR THE PURPOSES OF THE PREVENTION, INVESTIGATION, DETECTION OR PROSECUTION OF CRIMINAL OFFENCES OR THE

EXECUTION OF CRIMINAL PENALTIES

(iv) to order the controller or processor to bring processing operations into compliance with the provisions of these regulations, where appropriate, in a specified manner and within a specified period;

(v) to order the controller to communicate a personal data breach referred to in regulation 31, to the data subject;

(vi) to impose a temporary or definitive limitation including a ban on processing;

(vii) to order the rectification or erasure of personal data or restriction of processing pursuant to regulation 16 and the notification of such actions to recipients to whom the personal data have been disclosed pursuant to regulation 16(6);

(viii) to impose an administrative fine pursuant to regulation 57;

(ix) to order the suspension of data flows to a recipient in a third country or to an international organisation.

(c) authorisation and advisory powers consisting of the powers:

(i) to advise the controller in accordance with the prior consultation procedure referred to in regulation 28;

(ii) to issue, on its own initiative or on request, opinions to Parliament, the Government or, in accordance with law, to other institutions and bodies as well as to the public on any issue related to the protection of personal data;

(iii) to approve data retention policies referred to in regulation 5(3); and

(iv) to authorise the communication of personal data where the law so requires.