Article 53 GDPR

← Article 53 - General conditions for the members of the supervisory authority →
Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 53 - General conditions for the members of the supervisory authority

1. Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by:

— their parliament;

— their government;

— their head of State; or

— an independent body entrusted with the appointment under Member State law.

2. Each member shall have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform its duties and exercise its powers.

3. The duties of a member shall end in the event of the expiry of the term of office, resignation or compulsory retirement, in accordance with the law of the Member State concerned.

4. A member shall be dismissed only in cases of serious misconduct or if the member no longer fulfils the conditions required for the performance of the duties.

Relevant Recitals

Recital 117: Establishment of Independent Supervisory Authorities

The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 121: General Conditions for the Member(s) of Supervisory Authorities

The general conditions for the member or members of the supervisory authority should be laid down by law in each Member State and should in particular provide that those members are to be appointed, by means of a transparent procedure, either by the parliament, government or the head of State of the Member State on the basis of a proposal from the government, a member of the government, the parliament or a chamber of the parliament, or by an independent body entrusted under Member State law. In order to ensure the independence of the supervisory authority, the member or members should act with integrity, refrain from any action that is incompatible with their duties and should not, during their term of office, engage in any incompatible occupation, whether gainful or not. The supervisory authority should have its own staff, chosen by the supervisory authority or an independent body established by Member State law, which should be subject to the exclusive direction of the member or members of the supervisory authority.

Commentary

Article 53 GDPR regulates the means of appointment for supervisory authority members ("SA"). The provision governs the qualities required to hold office, circumstances relating to the termination of office and the minimum conditions for removal in the event of misconduct. This Article partly integrates Articles 51, 52 and 54 GDPR, and resultantly its paragraphs are made up of differing characteristics. For instance, some paragraphs are directly applicable as provisions of Union law, while others require legislative intervention by Member States.

(1) Authority appointing the members of the supervisory authority (SA)

Given the specificities of Member States' varying constitutional and administrative rules, this provision allows Member States to determine the manner of SA members' appointment in line with their own national frameworks. Pursuant to Article 54(1)(c) GDPR, the rules governing the appointment procedure must be legislated for by each Member State.

Transparent procedure

The procedure regulating appointment must be transparent, irrespective of which public body makes the appointment. This requirement is rooted in the principle of public accountability, and aims to ensure that the public is able to scrutinise the appointment of SA members. The GDPR does not clarify as to what qualifies as a transparent procedure. However, Commentators have noted that the minimum threshold for transparency, should be in the least, include making the details of the selection process available to the public. In addition, any such procedure should demonstrate that alternative candidates have been considered and evaluated in accordance with the criteria specified by the GDPR.

Example: Even if the European Data Protection Supervisor (EDPS) is governed by Regulation 2018/1725, rather than by the GDPR, the procedure for the appointment of its president can be considered a good example of a transparent procedure. To a certain degree, this procedure can be a source of inspiration for national SAs. In 2019 the selection process was structured in the following way:

• A public call for candidates for the Supervisor posts resulted in the most competent applicants being shortlisted by an inter-institutional selection board;
• Following interviews with the shortlisted candidates, the selection board presented the European Commission with their recommendations for its review and submission to the European Parliament and the Council.
• Hearings to evaluate the experiences, skills and independence of the candidates took place in the European Parliament. A joint decision  of the Parliament and Council was reached following their deliberations.

Appointing body

Article 53(1) names four possible appointing bodies. These are a Member State's (i) parliament, (ii) government, (iii) head of state, or (iv) an independent body entrusted with the appointment under Member State law.

If member(s) of the SA are appointed by either the (i) parliament, (ii) government, or (iii) head of state, the appointment should be made based on a proposal by any one of the aforementioned bodies. While a joint appointment by different branches of state is not foreseen by the GDPR, there is no reason to consider a joint appointment as contrary to Article 53(1) GDPR, so long as one of the bodies mentioned above is involved and can effectively determine the result of the final decision.

(2) Qualification, experience and skills of the member(s)

Article 53(2) GDPR stipulates that each SA member must ("shall") have the qualifications, experience and skills in the area of personal data protection, required to perform its duties and exercise its powers. In addition to expertise in data protection law, in particularly IT and organisational expertise are of relevance for the work of SA members. Also general requirements, such as general requirements foreseen for all employees of the national administration, can be prescribed for members. Competence requirements must be provided by law pursuant to Article 54(1)(b) GDPR.

These competence requirements serve two purposes. The first is to ensure the high quality of SAs' work, and consequently the effectiveness of data protection. The second is to act as a minimum barrier against appointments of a purely political nature, without adequate professional preparation. However, Article 53(2) GDPR does not require Member States to test the knowledge of its SAs' members. Moreover, unlike the rules regulating the appointment of members of other institutions such as the Court of Justice and the General Court, the GDPR does not require that members are to be chosen from individuals whose independence is absolute.

Qualifications

The qualification requirement refers to a member's educational background, such as the completion of vocational training, a course of study, or the acquisition of additional qualifications and further training certificates in relation to the activities of the SA. The qualification requirement is aimed at ensuring that a potential SA member is able to demonstrate that they have acquired the relevant theoretical knowledge for their position.

Experience and skills

The experience requirement necessitates that an SA member must have previously applied what was learned through practical activity. While the term “skills” concern the abilities of the applicants relevant to the position, these include both legal and non-legal skills, and it is irrelevant whether they are innate or acquired through experience.

Performance of tasks and the exercise of powers

The criteria outlined by the GDPR for the appointment of SA members is directly related to ensuring that an SA is able to effectively perform the tasks and exercise the powers afforded to it under the GDPR. These tasks and powers include handling complaints lodged by data subjects, conducting investigations on the application of the GDPR, and promoting public awareness of the risks, rules, safeguards and rights in relation to the processing of personal data. Consequently, an SA's effective functioning is based on the competence of its members, who cannot sufficiently fulfil their duties unless they have the relevant qualifications, experience and skills to do so.

(3) End of mandate

Article 53(3) GDPR regulates the ordinary coming to an end of the SA membership. It sets out three grounds for the ordinary termination of the mandate of a SA member. These are (i) expiry of term of office, (ii) resignation and (iii) compulsory retirement. Anything which falls outside of this exhaustive list cannot justify the end of a member's mandate, for instance the internal re-organisation of an SA.

The provision's aim of establishing an exhaustive list of grounds for the termination of a member's mandate is an attempt to safeguard the independence of SAs, by limiting the exposure of their members to undue political influence.

Case law: In Commission v Hungary, the CJEU held that while the Member States are entitled to restructure their data protection systems and SAs, such restructuring shall not result in a preliminary termination of the mandate of a SA member. Preliminary termination of the SA member’s mandate would unjustifiably interfere with the independence of SAs.

Case law: The Garai case is also interesting in this regard. While it did not concern a SA, it regarded the early dismissal of the members of the national regulatory authority (NRA) for electronic communications in Spain. The CJEU concluded that the dismissal of the members before the end of their mandates due to the merging between different regulatory bodies was against the requirement of independence of the NRA in the 'absence of any rules guaranteeing that such dismissals do not jeopardise the independence and impartiality of such members'.

Members of SAs can, in addition, be legally employed by SAs. In such cases the conditions for the termination of the employment of members must be in line with the provisions of Article 53 GDPR. However, the rules governing the cessation of employment must be determined by member State's national law, in accordance with Article 54(1)(f) GDPR.

Expiry of the term of office

Normally, the duties of a SA member end 'in the event of the expiry of the term of office'. The term of office is dealt with in Article 54(1) GDPR, under which Member States are obliged to legislate for through their national laws. The term in office of an SA member also expires in case of death.

Resignation and compulsory retirement

SA members can voluntarily decide to end their mandate before the full completion of their term in office. It should be highlighted that resignation should be voluntary, and not influenced by external pressure.

Retirement can be a reason for the premature termination of an SA member's mandate af a SA member, especially in cases of retirement due to age or illness. Rules regulating the retirement of SA members must be provided for through a Member State's national law before an SA member is nominated, in order to comply with the principle of independence.

Case law: The CJEU established in Commission v Hungary, that Member States cannot change the rules concerning SA Members' term in office during their term, as this could result in a form of prior compliance, undermining the requirement of independence.

(4) Dismissal of SA members

Under Article 53(4) GDPR, an SA member can be dismissed only in two cases. The first of which is in the case of serious misconduct, and the second is if members can no longer fulfil the conditions required for the performance of the duties. These are the two extraordinary reasons for the premature termination of duties of SAs and should be interpreted restrictively. Notably, these grounds are exceptions to the ordinary grounds governing the end of a member's mandate under Article 53(3) GDPR, as grounds for dismissal must be severe enough to justify the intrusion into the general principle of independence of SAs. Dismissal entails an involuntary preliminary loss of office

The GDPR does not specify what these two instances entail, nor is clear regarding which authority is responsible for deciding a member's dismissal, or for what procedural safeguards are in place, if any. These elements should be explicitly provided by a Member State's national law and be precise enough to avoid any misleading interpretation or arbitrariness.

The two cases mentioned by Article 53(4) GDPR are contained in several other EU law provisions concerning the dismissal of members of independent bodies. These are Article 247 of the Treaty on the Functioning of the European Union ("TFEU"), which regulates the dismissal of members of the Commission, Article 228(2) TFEU with regard to the dismissal of European Ombudsman, and Article 53(5) of Regulation (EU) 2018/1725 dealing with the dismissal of European Data Protection Supervisor. Interpretation of these elements and corresponding provisions by the CJEU may be of relevance for the interpretations of Article 53(4) GDPR.

Serious misconduct

An SA member's actions may amount to serious misconduct, in instances where their actions are deemed incompatible with the duties and obligations of a SA member. These actions could include engaging in criminal activity, the holding of competing offices or engaging in an incompatible occupation. For example, Article 52(2) GDPR requires SA members to remain free from external influence and Article 52(3) GDPR entails a prohibition of incompatible actions.

No longer fulfils the conditions

The failure to fulfil the conditions of office refers to the general conditions required by the Member State's law, such as citizenship and general conditions for officials to hold office, or other circumstances that would permanently prevent an SA member from fulfilling their duties.

Responsible authority and procedure

The procedure and the responsible authority should allow for an independent decisions regarding the dismissal of an SA member, ensuring that it is by no means politically influenced. For example, courts can be given the competence to decide on the dismissal of SA member. On the other hand, parliaments may not, as a decision on the dismissal of an SA member would be considered political if the deciding body was a Member State's parliament voting by a simple majority.

Decisions

→ You can find all related decisions in Category: Article 53 GDPR