Article 53 GDPR
Legal Text
1. Member States shall provide for each member of their supervisory authorities to be appointed by means of a transparent procedure by:
— their parliament;
— their government;
— their head of State; or
— an independent body entrusted with the appointment under Member State law.
2. Each member shall have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform its duties and exercise its powers.
3. The duties of a member shall end in the event of the expiry of the term of office, resignation or compulsory retirement, in accordance with the law of the Member State concerned.
4. A member shall be dismissed only in cases of serious misconduct or if the member no longer fulfils the conditions required for the performance of the duties.
Relevant Recitals
Commentary
Article 53 GDPR regulates, for the first time by means of a European law, the manner of appointment of the members of the supervisory authority (SA), the qualities required to hold office, certain elements relating to the termination of office and the minimum conditions for removal in the event of misconduct. The provision, which partly integrates Article 51, Article 52 and Article 54 GDPR, has different characteristics depending on the different paragraphs. In some cases, it is directly applicable as a provision of a EU regulation, in others, it requires legislative intervention by the member states.
(1) Authority appointing the members of the supervisory authority (SA)
In line with the specificities of the different constitutional and organisational rules, this provision leaves the decision on how the member(s) of the supervisory authorities should be appointed up to the members states.[1] Pursuant to Article 54(1)(c) GDPR the rules and the the procedure for the appointment must be laid down by the law.
Transparent procedure
Irrespective of which body makes the appointment, the procedure must be transparent. This should ensure that the public is able to review and comprehend the appointment of a member of a SAs.[2] The GDPR does not provide any information on how a procedure should be structured to qualify as transparent. However, as a minimum requirement of transparency, publicity of the selection process should be fully adopted. The procedure should also show that several alternatives have been considered and evaluated according to the criteria specified by the GDPR.[3]
Example: Even if the European Data Protection Supervisor (EDPS) is governed by Regulation 2018/1725 rather than by the GDPR, the procedure for the appointment of its president can be considered a good example of 'transparent procedure'. To a certain degree, this procedure can be a source of inspiration for national SAs. In 2019 the selection process was structured in the following way:
- A public call for candidates for the Supervisor posts resulted in the most competent applicants being shortlisted by an inter-institutional selection board;
- Following interviews with the shortlisted candidates, the selection board presented the European Commission with their recommendations for its review and submission to the European Parliament and the Council.
- Hearings to evaluate the experiences, skills and independence of the candidates took place in the European Parliament. A joint decision of the Parliament and Council was reached following their deliberations.[4]
Appointing body
Article 53(1) names four possible appointing bodies: the parliament, the government, the head of state or an independent body. If member(s) of the SA are appointed by the parliament, the government or the head of state the appointment should be made based on a proposal by the government, a member of the government, the parliament or a chamber of the parliament.[5] A joint appointment by different branches of state is not foreseen.[6] However, there is no reason to consider a joint appointment as contrary to Article 53(1), as long as one of the bodies mentioned above is involved and can effectively determine the result of the final decision.
(2) Qualification, expertise and skills of the member(s)
Article 53(2) GDPR stipulates that each SA member must ("shall") have the qualifications, experience and skills, in particular in the area of the protection of personal data, required to perform its duties and exercise its powers. In addition to expertise in data protection law, in particularly IT and organisational expertise are of relevance for the work of SA members.[7] Also general requirements, such as general requirements foreseen for all employees of the national administration, can be prescribed for members.[8] Competence requirements must be provided by law pursuant to Article 54(1)(b) GDPR.
These competence requirements serve two purposes. On the one hand, this should contribute to the quality of the work of the SAs and consequently to the effectiveness of data protection. On the other hand, these requirements act as a minimum barrier against appointments of a purely political nature, without adequate professional preparation.[9] However, Article 53(2) does not require member states to test the knowledge of the members. There is also no requirement that the members are chosen among independent individuals.[10]
Qualifications
The “qualification” includes the educational background, such as the completion of vocational training, the completion of a course of study, the acquisition of additional qualifications, and further training certificates in relation to the activities of the SA. The qualification is thus aimed at proving that theoretical knowledge has been acquired.[11]
Experience
The “experience” establishes a temporal framework in which what was learned has been applied and deepened in the practical activity.[12]
Example: DPOs have experience in the field of data protection.
Skills
“Skills” concern the intrinsic abilities of the applicants, both legal and non-legal and regardless of whether they are innate or acquired through experience.
Performance of tasks and the exercise of powers
The above mentioned requirements are instrumental to the performance of the SA's tasks and to the exercise of SA's powers. These tasks and powers include handling of complaints lodged by a data subject, conducting investigations on the application of the GDPR and promoting public awareness of the risks, rules, safeguards and rights in relation to the processing of personal data.[13] More precisely, tasks of SAs are provided in Article 57 GDPR; powers of SAs are listed in Article 58 GDPR.
(3) End of mandate
Article 53(3) GDPR regulates the ordinary coming to an end of the duties of SA members. It sets out three reasons for the ordinary termination of the mandate of a SA member: expiry of term of office, resignation and compulsory retirement. Internal reorganisations of the SA, real or alleged, do not fall within the mandatory cases under Article 53(3) GDPR and therefore do not justify the termination of the mandate.[14]
The aim of establishing an exhaustive list of reasons for the termination of mandates of SA members is to limit the exposure of members of SAs to political influences.[15] This way the independence of SAs and its members is safeguarded. Full terms in office also further contribute to the effectiveness of the work of SAs and its members.
Case law: In its judgment C- 288/2012 - Commission v Hungary, the CJEU held that while the states are entitled to restructure their data protection systems and SAs such restructuring shall not result in a preliminary termination of the mandate of a SA member. Preliminary termination of the SA member’s mandate would unjustifiably interfere with the independence of SAs.[16]
Members of SAs can be employed in SAs. In such cases the conditions for the termination of the employment of members must be in line with the provisions of Article 53 GDPR. Rules on termination of employment must be determined by law according to Article 54(1)(f) GDPR.
Expiry of the term of office
Normally, the duties of a SA member end “in the event of the expiry of the term of office”. The term of office is dealt with in Article 54(1) GDPR, as an obligation for the member states to include a provision in their national laws. The term in office of a SA member also expires in case of death.[17]
Example: The member of a SA was nominated in September 2022 for a 6-year term in accordance with the national law. Her mandate will expire in September 2028.
Resignation
A member of SA can voluntarily decide to end his duties before the end of the full term in office. It should be highlighted that resignation should be voluntary, so not pressured by government or parliament.[18]
Example: A member of a SA decides that he wants to resign for family reasons and resigns two years after his 6-year appointment in office.
Compulsory retirement
Retirement can be a reason for a premature termination of the mandate af a SA member, in particularly in cases of retirement due to age or illness.[19] It must be provided for in the national law of the state before the SA member is nominated to comply with the requirement of independence of SAs.[20]
Example: According to a member state’s law officials can work until the age of 70 years. Once they reach 70 years of age they cannot continue working in the public sector and must retire.
(4) Dismissal of SA members
Under Article 53(4) GDPR, an SA member can be dismissed only in two cases: serious misconduct or if they no longer fulfill the conditions required for the performance of the duties. These are the two extraordinary reasons for the premature termination of duties of SAs and should be interpreted strictly. First, these reasons are an exception to the ordinary end of duties of SA members from Article 53(3) GDPR.[21] Also, they must be serious enough to justify the intrusion into the general principle of independence of SAs.[22]
The GDPR does not specify what these two important requirements entail nor is clear about which authority is responsible for deciding on removal or what procedural safeguards are in place, if any. These elements should be explicitly provided by member state law and be precise enough to avoid any misleading interpretation or arbitrariness.
The two cases mentioned by Article 53(4) are contained also in several other EU law provisions concerning the dismissal of members of independent bodies, such as Article 247 TFEU regulating the dismissal of members of the Commission, Article 228(2) TFEU with regard to the dismissal of European Ombudsman, and Article 53(5) of the Regulation (EU) 2018/1725 dealing with the dismissal of European Data Protection Supervisor.[23] Interpretation of these elements and corresponding provisions by the CJEU may be of relevance for the interpretations of Article 53(4) GDPR.
Dismissed
Dismissal entails an involuntary preliminary loss of office.
Serious misconduct
Personal actions and acts of the SA member can constitute serious misconduct. These can be actions and acts incompatible with the duties and obligations of a SA member, as well as holding of competing offices or engaging in an incompatible occupation.[24] For example, Article 52(2) GDPR requires SA members to remain free from external influence and Article 52(3) GDPR entails a prohibition of incompatible actions. Also engaging in criminal activity can be a serious misconduct.
For example: a SA member takes money to decide in favour of a controller in a complaint procedure.
No longer fulfills the conditions
The failure to fulfill the conditions can in particularlly concern serious health issues that would permanently prevent the ability of the SA member to conduct the duties or general conditions required by the member state's law, such as citizenship and general conditions for officials to hold office.[25]
Example: Citizenship of the member state is a requirement to hold the office. The SA member acquires the citizenship of another state and gives up their former citizenship.
Responsible authority and procedure
The procedure and the responsible authority should allow for an independent and not purely political decisions regarding the dismissal of SA member(s). For example, courts can be given the competence to decide on the dismissal of SA member(s). On the other hand, a decision on the dismissal of SA member(s) is politcal if the responsible body is the parliament voting by a simple majority.[26] If the SA is entitled to judicial remedy against the decision, this would enchance the independence and objectivness of the dismissal procedure.
Decisions
→ You can find all related decisions in Category: Article 53 GDPR
References
- ↑ For examples, see FRA, Elements of independence of the data protection authorities in the EU, p.19 (available here).
- ↑ Boehm, in Kühling, Buchner, DS-GVO BDSG, Article 53 GDPR, margin number 5 (C.H. Beck 2020, 3rd Edition).
- ↑ Polenz, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 53 GDPR, margin number 4 (NOMOS 2019).
- ↑ https://edps.europa.eu/about-edps/supervisors_en
- ↑ Recital 121 GDPR.
- ↑ Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 53 GDPR, p. 888 (Oxford University Press 2020).
- ↑ Boehm, in Kühling, Buchner, DS-GVO BDSG, Article 54 GDPR, margin numbers 8 and 9 (C.H. Beck 2020, 3rd Edition).
- ↑ Ziebarth, in Sydow, Marsch, DS-GVO/BDSG, Article 53 GDPR, margin number 21 (Nomos 2022).
- ↑ Ziebarth, in Sydow, Europäische Datenschutzgrundverordnung, Article 53 GDPR, margin number 18 (Nomos 2018, 2nd edition).
- ↑ Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 53 GDPR, page 889 (Oxford University Press 2020).
- ↑ Polenz, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 53 GDPR, margin number 6 (NOMOS 2019).
- ↑ Polenz, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 53 GDPR, margin number 6 (NOMOS 2019).
- ↑ See Recital 122 GDPR.
- ↑ In this respect, reference should be made to Commission vs. Hungary, where the Court found that the complete independence of the SA was not guaranteed due to the premature termination of the mandate of the Commissioner for the protection of personal data, at the occasion of a restructuration of the SA. Beside the Commission v. Hungary judgement of the CJEU, the Garai case is also interesting in this regard. It concerned the early dismissal of the members of the national regulatory authority (NRA) for electronic communications in Spain. The CJEU concluded that the dismissal of the members before the end of their mandates due to the merging between different regulatory bodies was against the requirement of independence of the NRA in the "absence of any rules guaranteeing that such dismissals do not jeopardise the independence and impartiality of such members".
- ↑ Boehm, in Kühling, Buchner, DS-GVO BDSG, Article 53 GDPR, margin number 10 (C.H. Beck 2020, 3rd Edition).
- ↑ CJEU in case C-288/2012 - Commission v Hungary, paragraphs 53 to 59.
- ↑ Polenz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 53 GDPR, margin number 11 (Nomos 2019).
- ↑ Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 53 GDPR, p. 890 (Oxford University Press 2020).
- ↑ Polenz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 53 GDPR, margin number 11 (Nomos 2019).
- ↑ CJEU established in C-288/12 - Commission v Hungary, that member states cannot change the rules concerning the term in office of a members of SA during his term. Otherwise the option of such changes could result in a form of prior compliance by members of a SA and they would risk to not be able to act in all circumstances above all suspicion of partiality. To this extend see also Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 53 GDPR, p. 891 (Oxford University Press 2020).
- ↑ Boehm, in Kühling, Buchner, DS-GVO BDSG, Article 53 GDPR, margin number 12 (C.H. Beck 2020, 3rd Edition).
- ↑ Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 53 GDPR, page 890 (Oxford University Press 2020).
- ↑ Other relevant provisions include Articles 11.4 and 14.2 of the Protocol (No 4) to TFEU on the statute of the statute of the European System of Central Banks and of the European Central Bank regarding the members of the executive board of the ECB and governors of national central banks. See also Selmayr, in Ehmann, Selmayr, DS-GVO Kommentar, Article 53 GDPR, margin number 13 (C.H. Beck 2018).
- ↑ Polenz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 53 GDPR, margin number 13 (Nomos 2019).
- ↑ Ziebarth, in Sydow, Marsch, DS-GVO/BDSG, Article 53 GDPR, margin numbers 27, 28 and 21 (Nomos 2022).
- ↑ Ziebarth, in Sydow, Marsch, DS-GVO/BDSG, Article 53 GDPR, margin numbers 30 and 31 (Nomos 2022).
