Article 68 GDPR: Difference between revisions
| Line 212: | Line 212: | ||
===EU Body with Legal Personality (Article 6(1))=== | ===EU Body with Legal Personality (Article 6(1))=== | ||
Article 68(1), as well as Recital 139, establish the EDPB as a body of the Union with legal personality. Recital 139 explains, ‘In order to promote the consistent application of [the GDPR], the Board should be set up as an independent body of the Union’ and ‘should have legal personality.’ | Article 68(1), as well as Recital 139, establish the EDPB as a body of the Union with legal personality. Recital 139 explains, ‘In order to promote the consistent application of [the GDPR], the Board should be set up as an independent body of the Union’ and ‘should have legal personality.’ | ||
This contrasts with the WP29, which, although expected to act independently, did not have legal personality, and fulfilled a merely advisory role.<ref name=":0">Ehmann, Selmayr, Albrecht, Article 68 GDPR, margin number 1, 2 (Beck 2018, 2nd Ed.) (accessed 22.04.21).</ref> This contributed to what was generally seen as a fragmented application and interpretation of European data protection rules by supervisory authorities. | |||
As Docksey notes, imbuing the EDPB with legal personality, “strengthens [its] nature […] as a governing body in its own right, deriving its legitimacy directly from legislation rather than by delegation from the Commission. Importantly, “in practical terms it means that the Board may take action before the Courts.<ref name=":1">''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).</ref> | This contrasts with the WP29, which, although expected to act independently, did not have legal personality, and fulfilled a merely advisory role.<ref name=":0">Ehmann, Selmayr, Albrecht, Article 68 GDPR, margin number 1, 2 (Beck 2018, 2nd Ed.) (accessed 22.04.21).</ref> This contributed to what was generally seen as a fragmented application and interpretation of European data protection rules by supervisory authorities. | ||
Notably, in addition to legal personality, Article 65 GDPR grants the EDPB legally-binding decision-making powers. | |||
The EDPB’s status as an EU body is significant as it means the EDPB is subject to the oversight of bodies in the EU system, helping to ensure its political and legal accountability.<ref name=":1" /> For example, the EDPB’s decisions may be appealed to the General Court,<ref name=":1" /><ref>Article 263 TFEU</ref> and its compliance with data protection rules is supervised by the EDPS. This oversight helps to ensure the political | As Docksey notes, imbuing the EDPB with legal personality, “strengthens [its] nature […] as a governing body in its own right, deriving its legitimacy directly from legislation rather than by delegation from the Commission. Importantly, “in practical terms it means that the Board may take action before the Courts.<ref name=":1">''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).</ref> Notably, in addition to legal personality, Article 65 GDPR grants the EDPB legally-binding decision-making powers. | ||
The EDPB’s status as an EU body is significant as it means the EDPB is subject to the oversight of bodies in the EU system, helping to ensure its political and legal accountability.<ref name=":1" /> For example, the EDPB’s decisions may be appealed to the General Court,<ref name=":1" /><ref>Article 263 TFEU</ref> and its compliance with data protection rules is supervised by the EDPS. This oversight helps to ensure the political. | |||
The independent nature of the Board is addressed further at Article 69. | The independent nature of the Board is addressed further at Article 69. | ||
===Chair (Article 6(2))=== | ===Chair (Article 6(2))=== | ||
The EDPB will be represented by a Chair, who fulfils both a public role - that is, representing the Board and its supervisory authorities at conferences, press meetings and so forth - as well as a formal role - that is, representing the Board legally, for example at discussions of the European parliament.<ref name=":2">''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).</ref> This contrasts with the WP29, which had a public role only. | The EDPB will be represented by a Chair, who fulfils both a public role - that is, representing the Board and its supervisory authorities at conferences, press meetings and so forth - as well as a formal role - that is, representing the Board legally, for example at discussions of the European parliament.<ref name=":2">''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).</ref> This contrasts with the WP29, which had a public role only. | ||
Articles 73 and 74 GDPR contain provisions on the Chair’s appointment and tasks. | Articles 73 and 74 GDPR contain provisions on the Chair’s appointment and tasks. | ||
===National Supervisory Authorities (Article 6(3))=== | ===National Supervisory Authorities (Article 6(3))=== | ||
Whilst the WP29 comprised of ‘members’ of the national supervisory authorities, Article 68(3) GDPR specifically requires the Board to be composed of the heads of the supervisory authorities in each Member State. As noted by Docksey, this “emphasizes that the Board is intended to be a high-level body” and “significantly increases the ‘self-binding’ effect on national authorities of discussions and decisions by their heads at the Board.”<ref name=":2" /> | Whilst the WP29 comprised of ‘members’ of the national supervisory authorities, Article 68(3) GDPR specifically requires the Board to be composed of the heads of the supervisory authorities in each Member State. As noted by Docksey, this “emphasizes that the Board is intended to be a high-level body” and “significantly increases the ‘self-binding’ effect on national authorities of discussions and decisions by their heads at the Board.”<ref name=":2" /> | ||
Beyond being the head of a national supervisory authority, the GDPR does not establish rules on the eligibility and qualifications required to be a Board member. This contrasts with the rules regarding supervisory authority members in Article 53 GDPR.<ref name=":2" /> | |||
Whilst not explicitly stated, it can be inferred that all ordinary EDPB members will have the right to vote. This is because Article 68(5) outlines that the Commission can participate in Board’s activities and meetings, just without voting rights.<ref name=":0" /> | Beyond being the head of a national supervisory authority, the GDPR does not establish rules on the eligibility and qualifications required to be a Board member. This contrasts with the rules regarding supervisory authority members in Article 53 GDPR.<ref name=":2" /> | ||
Whilst not explicitly stated, it can be inferred that all ordinary EDPB members will have the right to vote. This is because Article 68(5) outlines that the Commission can participate in Board’s activities and meetings, just without voting rights.<ref name=":0" /> | |||
The EEA EFTA supervisory authorities are also members of the EDPB. Although they generally have the same rights and obligations as member state authorities, they do not have the right to vote, or to stand for election as deputy chairs.<ref name=":3">''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).</ref> | The EEA EFTA supervisory authorities are also members of the EDPB. Although they generally have the same rights and obligations as member state authorities, they do not have the right to vote, or to stand for election as deputy chairs.<ref name=":3">''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).</ref> | ||
| Line 236: | Line 243: | ||
===EDPS (Article 6(6))=== | ===EDPS (Article 6(6))=== | ||
The EDPS’ voting rights in the board are limited to those dispute resolution decisions under Article 65, which concern principles and rules applicable to the Union institutions, bodies, offices and agencies - that is, under the EUDPR - which correspond in substance to those of the GDPR. | The EDPS’ voting rights in the board are limited to those dispute resolution decisions under Article 65, which concern principles and rules applicable to the Union institutions, bodies, offices and agencies - that is, under the EUDPR - which correspond in substance to those of the GDPR. | ||
This | |||
Indeed, in practice, it arguably makes little difference, as the EUDPR, and the “EDPS’ mission as a public sector supervisory authority, have been very closely aligned with those of the GDPR.<ref name=":3" />” | This setup is a compromise between, on the one-hand, the notion that the EDPS should not be able to vote on decisions that are not of its concern, and on the other, the notion that the EDPS should be treated the same as any other supervisory authority.<ref name=":3" /> Indeed, in practice, it arguably makes little difference, as the EUDPR, and the “EDPS’ mission as a public sector supervisory authority, have been very closely aligned with those of the GDPR.<ref name=":3" />” | ||
== Decisions == | == Decisions == | ||
Revision as of 13:53, 23 April 2021
Legal Text
1. The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality.
2. The Board shall be represented by its Chair.
3. The Board shall be composed of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives.
4. Where in a Member State more than one supervisory authority is responsible for monitoring the application of the provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member State's law.
5. The Commission shall have the right to participate in the activities and meetings of the Board without voting right. The Commission shall designate a representative. The Chair of the Board shall communicate to the Commission the activities of the Board.
6. In the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of this Regulation.
Relevant Recitals
In order to promote the consistent application of this Regulation, the Board should be set up as an independent body of the Union. To fulfil its objectives, the Board should have legal personality. The Board should be represented by its Chair. It should replace the Working Party on the Protection of Individuals with Regard to the Processing of Personal Data established by Directive 95/46/EC. It should consist of the head of a supervisory authority of each Member State and the European Data Protection Supervisor or their respective representatives. The Commission should participate in the Board’s activities without voting rights and the European Data Protection Supervisor should have specific voting rights. The Board should contribute to the consistent application of this Regulation throughout the Union, including by advising the Commission, in particular on the level of protection in third countries or international organisations, and promoting cooperation of the supervisory authorities throughout the Union. The Board should act independently when performing its tasks.
Commentary
Overview
Article 68 addresses the nature, status, and composition of the European Data Protection Board ('EDPB'), which replaces the Article 29 Working Party (‘WP29’), the former supervisory authority established under Directive 95/46/EC. Article 68 is the first of eight Articles (Articles 68-75) governing the EDPB set forth in Section 3 of Chapter VII GDPR.
EU Body with Legal Personality (Article 6(1))
Article 68(1), as well as Recital 139, establish the EDPB as a body of the Union with legal personality. Recital 139 explains, ‘In order to promote the consistent application of [the GDPR], the Board should be set up as an independent body of the Union’ and ‘should have legal personality.’
This contrasts with the WP29, which, although expected to act independently, did not have legal personality, and fulfilled a merely advisory role.[1] This contributed to what was generally seen as a fragmented application and interpretation of European data protection rules by supervisory authorities.
As Docksey notes, imbuing the EDPB with legal personality, “strengthens [its] nature […] as a governing body in its own right, deriving its legitimacy directly from legislation rather than by delegation from the Commission. Importantly, “in practical terms it means that the Board may take action before the Courts.[2] Notably, in addition to legal personality, Article 65 GDPR grants the EDPB legally-binding decision-making powers.
The EDPB’s status as an EU body is significant as it means the EDPB is subject to the oversight of bodies in the EU system, helping to ensure its political and legal accountability.[2] For example, the EDPB’s decisions may be appealed to the General Court,[2][3] and its compliance with data protection rules is supervised by the EDPS. This oversight helps to ensure the political.
The independent nature of the Board is addressed further at Article 69.
Chair (Article 6(2))
The EDPB will be represented by a Chair, who fulfils both a public role - that is, representing the Board and its supervisory authorities at conferences, press meetings and so forth - as well as a formal role - that is, representing the Board legally, for example at discussions of the European parliament.[4] This contrasts with the WP29, which had a public role only.
Articles 73 and 74 GDPR contain provisions on the Chair’s appointment and tasks.
National Supervisory Authorities (Article 6(3))
Whilst the WP29 comprised of ‘members’ of the national supervisory authorities, Article 68(3) GDPR specifically requires the Board to be composed of the heads of the supervisory authorities in each Member State. As noted by Docksey, this “emphasizes that the Board is intended to be a high-level body” and “significantly increases the ‘self-binding’ effect on national authorities of discussions and decisions by their heads at the Board.”[4]
Beyond being the head of a national supervisory authority, the GDPR does not establish rules on the eligibility and qualifications required to be a Board member. This contrasts with the rules regarding supervisory authority members in Article 53 GDPR.[4]
Whilst not explicitly stated, it can be inferred that all ordinary EDPB members will have the right to vote. This is because Article 68(5) outlines that the Commission can participate in Board’s activities and meetings, just without voting rights.[1]
The EEA EFTA supervisory authorities are also members of the EDPB. Although they generally have the same rights and obligations as member state authorities, they do not have the right to vote, or to stand for election as deputy chairs.[5]
Joint Representative (Article 6(4))
Under Article 6(4), where a Member State has multiple supervisory authorities, these should be represented by a joint representative appointed in accordance with that Member State’s law.
European Commission (Article 6(5))
Whilst the Commission may participate in the Board’s meetings and activities, it is not a member and does not enjoy voting rights. Docksey notes that this right to participation is somewhat “remarkable,” and underscores the EDPB’s independent nature.[6] This is discussed further in the GDPRhub commentary on Article 69.
EDPS (Article 6(6))
The EDPS’ voting rights in the board are limited to those dispute resolution decisions under Article 65, which concern principles and rules applicable to the Union institutions, bodies, offices and agencies - that is, under the EUDPR - which correspond in substance to those of the GDPR.
This setup is a compromise between, on the one-hand, the notion that the EDPS should not be able to vote on decisions that are not of its concern, and on the other, the notion that the EDPS should be treated the same as any other supervisory authority.[5] Indeed, in practice, it arguably makes little difference, as the EUDPR, and the “EDPS’ mission as a public sector supervisory authority, have been very closely aligned with those of the GDPR.[5]”
Decisions
→ You can find all related decisions in Category:Article 68 GDPR
References
- ↑ 1.0 1.1 Ehmann, Selmayr, Albrecht, Article 68 GDPR, margin number 1, 2 (Beck 2018, 2nd Ed.) (accessed 22.04.21).
- ↑ 2.0 2.1 2.2 Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).
- ↑ Article 263 TFEU
- ↑ 4.0 4.1 4.2 Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).
- ↑ 5.0 5.1 5.2 Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).
- ↑ Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1050 (Oxford University Press 2020).
