Article 60(5) and (6) of that directive is worded as follows: ‘5. Member States shall ensure that legal persons can be held liable for the breaches referred to in Article 59(1) committed for their benefit by any person, acting individually or as part of an organ of that legal person, and having a leading position within the legal person based on any of the following: (a) power to represent the legal person; (b) authority to take decisions on behalf of the legal person; or (c) authority to exercise control within the legal person. 6 Member States shall also ensure that legal persons can be held liable where the lack of supervision or control by a person referred to in paragraph 5 of this Article has made it possible to commit one of the breaches referred to in Article 59(1) for the benefit of that legal person by a person under its authority.’ Regulation (EU) 2016/679