Article 51 GDPR

← Article 51 - Supervisory authority →
Expand Chapter 1: General provisions Article 1: Subject-matter and objectives Article 2: Material scope Article 3: Territorial scope Article 4: Definitions Expand Chapter 2: Principles Article 5: Principles relating to processing of personal data Article 6: Lawfulness of processing Article 7: Conditions for consent Article 8: Conditions applicable to child’s consent in relation to information society services Article 9: Processing of special categories of personal data Article 10: Processing of personal data relating to criminal convictions and offences Article 11: Processing which does not require identification Expand Chapter 3: Rights of the data subject Article 12: Transparent information, communication and modalities for the exercise of the rights of the data subject Article 13: Information to be provided where personal data are collected from the data subject Article 14: Information to be provided where personal data have not been obtained from the data subject Article 15: Right of access by the data subject Article 16: Right to rectification Article 17: Right to erasure (‘right to be forgotten’) Article 18: Right to restriction of processing Article 19: Notification obligation regarding rectification or erasure of personal data or restriction of processing Article 20: Right to data portability Article 21: Right to object Article 22: Automated individual decision-making, including profiling Article 23: Restrictions Expand Chapter 4: Controller and processor Article 24: Responsibility of the controller Article 25: Data protection by design and by default Article 26: Joint controllers Article 27: Representatives of controllers or processors not established in the Union Article 28: Processor Article 29: Processing under the authority of the controller or processor Article 30: Records of processing activities Article 31: Cooperation with the supervisory authority Article 32: Security of processing Article 33: Notification of a personal data breach to the supervisory authority Article 34: Communication of a personal data breach to the data subject Article 35: Data protection impact assessment Article 36: Prior consultation Article 37: Designation of the data protection officer Article 38: Position of the data protection officer Article 39: Tasks of the data protection officer Article 40: Codes of conduct Article 41: Monitoring of approved codes of conduct Article 42: Certification Article 43: Certification bodies Expand Chapter 5: Transfers of personal data Article 44: General principle for transfers Article 45: Transfers on the basis of an adequacy decision Article 46: Transfers subject to appropriate safeguards Article 47: Binding corporate rules Article 48: Transfers or disclosures not authorised by Union law Article 49: Derogations for specific situations Article 50: International cooperation for the protection of personal data Collapse Chapter 6: Supervisory authorities Article 51: Supervisory authority Article 52: Independence Article 53: General conditions for the members of the supervisory authority Article 54: Rules on the establishment of the supervisory authority Article 55: Competence Article 56: Competence of the lead supervisory authority Article 57: Tasks Article 58: Powers Article 59: Activity reports Expand Chapter 7: Cooperation and consistency Article 60: Cooperation between the lead supervisory authority and the other supervisory authorities concerned Article 61: Mutual assistance Article 62: Joint operations of supervisory authorities Article 63: Consistency mechanism Article 64: Opinion of the Board Article 65: Dispute resolution by the Board Article 66: Urgency procedure Article 67: Exchange of information Article 68: European Data Protection Board Article 69: Independence Article 70: Tasks of the Board Article 71: Reports Article 72: Procedure Article 73: Chair Article 74: Tasks of the Chair Article 75: Secretariat Article 76: Confidentiality Expand Chapter 8: Remedies, liability and penalties Article 77: Right to lodge a complaint with a supervisory authority Article 78: Right to an effective judicial remedy against a supervisory authority Article 79: Right to an effective judicial remedy against a controller or processor Article 80: Representation of data subjects Article 81: Suspension of proceedings Article 82: Right to compensation and liability Article 83: General conditions for imposing administrative fines Article 84: Penalties Expand Chapter 9: Specific processing situations Article 85: Processing and freedom of expression and information Article 86: Processing and public access to official documents Article 87: Processing of the national identification number Article 88: Processing in the context of employment Article 89: Safeguards and derogations relating to processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes Article 90: Obligations of secrecy Article 91: Existing data protection rules of churches and religious associations Expand Chapter 10: Delegated and implementing acts Article 92: Exercise of the delegation Article 93: Committee procedure Expand Chapter 11: Final provisions Article 94: Repeal of Directive 95: /46: /EC Article 95: Relationship with Directive 20: 02: /58: /EC Article 96: Relationship with previously concluded Agreements Article 97: Commission reports Article 98: Review of other Union legal acts on data protection Article 99: Entry into force and application

Legal Text

Article 51 - Supervisory authority

1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Expand

Recital 117: Establishment of Independent Supervisory Authorities

The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Expand

Recital 118: Control and Monitoring of Supervisory Authorities

The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Expand

Recital 119: Participation in Consistency Mechanism in Case of Multiple Supervisory Authorities

Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.

Commentary

Chapter VI

This provisions opens Chapter VI of the GDPR which is dedicated to supervisory authorities ("SAs"). SA is defined in Article 4(21) GDPR as an independent public authority which is established by a Member State pursuant to Article 51 GDPR. Chapter VI is divided into two sections. The former regulates SAs' establishment (Articles 51-54 GDPR), staffing and other organisational requirements that the Member State must enforce to ensure their independent and proper functioning. While the latter defines the competences, tasks, and powers of SAs (Articles 55-59 GDPR).

The GDPR provides for exceptions from provisions entailed in Chapter VI (independent supervisory authorities). Article 85(2) GDPR mandates Member States to, among others, provide for exemptions or derogations from Chapter VI (independent supervisory authorities) where processing is carried out for journalistic purposes or the purpose of academic, artistic or literary expression, where necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

Also, the SA's competence does cover the processing of personal data where courts are acting in their judicial capacity (see Article 55(3) GDPR).

Article 51 GDPR

Article 51 GDPR is the fundamental article governing the establishment of SAs and their duties, providing a basis upon which other provisions build upon. The following articles provide for more detailed rules.

Therefore, Article 51 GDPR and the related articles provide the institutional framework for the enforcement of the data protection rules, one of the main objectives of the GDPR. As noted in Recital 117 the effective and independent functioning of SAs constitutes an essential element of a data subject's fundamental right to data protection. Therefore, SAs have a wide range of tasks (see Article 57 GDPR) as well as extensive competencies (see Article 58 GDPR), which they should use in a preventive manner (e.g. by raising awareness or giving advice on processing operations) and retrospectively, after a violation of the GDPR took place (e.g. by handling complaints lodged by data subjects).

Article 51(1) GDPR provides for the general obligation of Member States to establish a SA. Article 51(2) GDPR aims to provide for the consistent application of the GDPR within the EU/EEA ("Union"), thereby obliging SAs to cooperate with each other and the Commission (see cooperation and consistency mechanism in Chapter VII). Article 51(3) GDPR entails a special provision in case a Member State established more than one SA; in that case, only one SA can be part of the EDPB. Finally, Article 51(4) GDPR imposes an obligation on the Member States to notify the Commission about the national provisions setting up the national SA(s).

Article 51 GDPR has to be read in conjunction with Article 4(21) (definition of SA), as well as with Article 52 (independence), Article 53 (General conditions for the members of SA), Article 54 (Rules on the establishment of SA), Articles 55-59 (Competence, tasks and powers), Articles 60-62 (Cooperation), Articles 63-67 (Consistency), and Article 68-76 (European Data Protection Board).

(1) Establishment of a supervisory authority (SA)

Establishment of SAs

Each Member State must appoint one or more supervisory authorities (SAs), which have to be independent public authorities and are responsible for monitoring the application of the GDPR with the aim of protecting the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union.

This provision already gives a glimpse of the requirements (e.g. independence) and tasks (e.g. monitor the GDPR's application) of SAs which are stipulated in more detail in other provisions of Chapter VI.

Regarding the possibility to establish more than one SA (e.g. for different geographical regions or different business sectors), see commentary on Article 51(3) GDPR below.

Independent

This provision already mentions that the SA established by a Member State must be independent. This requirement is described in more detail in Article 52 GDPR. For comprehensive remarks on this requirement, see commentary on Article 52 GDPR.

To put it briefly, the SAs independence is already required in Article 8(3) of the Charter of Fundamental Rights of the European Union ("CFR"), as well as Article 16(2) of the Treaty on the Functioning of the European Union ("TFEU").

Public authorities

By definition, SAs must be public bodies (see Article 4(21) GDPR). Member States cannot outsource the enforcement of the GDPR to private entities.

Monitoring the application

A SA's main task is to monitor the correct application of the GDPR. This aim should be understood in line with the wording used by Article 16(2) TFEU and Article 8(3) CFR, which provides that the enforcement of the GDPR itself is something that must be managed by "an independent authority."

"Data protection authorities are given a legal mandate in this regard, as set forth in article 51(1) GDPR, which is to monitor the application of the GDPR in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union."

EDPB, ‘Opinion 5/2019 on the interplay between the ePrivacy Directive and the GDPR, in particular regarding the competence, tasks and powers of data protection authorities’, 12 March 2019, margin number 53.

In order to

Article 51(1) GDPR specifies that the role of SAs is twofold. The first element is the protection of the fundamental rights and freedoms of individuals, and the second is to facilitate the free flow of personal data within the Union.

Protect the fundamental rights and freedoms of natural persons in relation to processing

The SA is directly tasked with the protection of the fundamental rights and freedoms of individuals. The SAs' structure, tasks and powers are supposed to serve this purpose.

When monitoring and enforcing the GDPR, SAs must not only take into account the fundamental rights to privacy and data protection, but also other fundamental rights and freedoms, given that the right to data protection is not an absolute right. For instance, the fundamental rights to data protection (Article 8 CFR) and privacy (Article 7 CFR) must be weighed up against the fundamental rights freedom of expression (Article 11 CFR) and right to property (Article 17 CFR). Also, other laws and regulations are not outside of the SAs' jurisdiction, as to correctly apply the GDPR, SA's must regularly determine provisions of the GDPR while taking into account other laws. One area where this is especially relevant is the interplay between the ePrivacy Directive and the GDPR.

For example: A SA must determine the necessity of processing personal data under applicable tax laws. In this instance, record keeping requirements under other laws become applicable for the purposes of Article 5(1)(e) GDPR when determining the duration for which data must be stored. Any such laws would also be relevant for determining whether the processing is necessary for complying with a legal obligation to which the controller is subject, under Article 6(1)(c) GDPR.

At this point it is worth reminding that only the protection of natural persons with regard to the processing of personal data falls in the scope of the GDPR (see Article 1 GDPR). The protection of a legal person's data is therefore not covered by this provision.

Facilitate the free flow of personal data within the Union

In line with the general objectives of the GDPR, as outlined in Article 1 GDPR, SAs are also required to take into account the requirements of the free flow of personal data within the Union. However, SAs are not supposed to directly facilitate the free flow of personal data in the sense that they are responsible to take action against any barrier of that free flow. Rather, SAs indirectly facilitate the free flow of personal data within the Union by ensuring a high level of data protection in the Union as a prerequisite for such transfer.

According to some Commentators, the dual objectives mean that the SA must take into account the various interests of data subjects and data processors and strike a fair balance between them.

(2) Consistent application of the GDPR

Paragraph 2 of this provision addresses the consistent application of the GDPR thorough the Union and obliges the SAs to cooperate with each other and with the Commission. Detailed provisions regarding this cooperation can be found in Chapter 7 GDPR where a cooperation and consistency mechanism is described.

In contrast to the other provisions in this Article, this paragraph generally needs no specific implementation by each Member State.

Shall

The use of the imperative "shall" imposes a positive legal obligation upon SAs to facilitate the consistent application of the GDPR throughout the EU/EEA. This has to be read in conjunction with each SA's obligation to ensure GDPR compliance on its respective territory.

Contribute

The use of the verb “contribute” denotes a form of proactive participation specifically aimed at the “consistent monitoring and enforcement of this Regulation” and, according to Recital 135, the uniform application of the law. Accordingly, SAs are required to identify any problems and act for their prompt resolution. For example, prompt action for resolution could be necessary in case of inactivity of a SA or lead supervisory authority in cross-border cases, where cooperation and assistance between SAs is required.

Consistent application

The use of the term "consistent application" mandates that the application and interpretation of GDPR provisions should not differ between Member States' respective SAs, as well as where applicable, between the multiple SAs within a Member State (for further analysis on this point, see Article 51(3) GDPR below). All SAs should have the same understanding of GDPR provisions and interpret and enforce the law in the same vein. The GDPR's predecessor, Directive 95/46/EC ("DPD"), was criticised for its fragmented enforcement of the right to data protection, which differed significantly from Member State to Member States, this was something that the GDPR sought to remedy by legislating for the consistent application of its provisions.

Cooperation

Under the DPD, there was limited cooperation between supervisory authorities, this too was something that the GDPR sought to remedy. Article 51(2) GDPR provides that SAs must cooperate with each other and the Commission and references to Chapter VII of the GDPR. Cooperation is an essential element of SAs' obligations under the GDPR, it is seen as the primary tool for enabling the GDPR's consistent application. Cooperation is a notion which is embedded in the foundations of Union law, through Article 4(3) of the Treaty on the European Union ("TEU"), which imposes a general duty of sincere co-operation. Chapter VII provides rules on cooperation between SAs in cross-border cases, as well as for their participation in the consistency mechanism and the European Data Protection Board, affording SAs responsibilities on a national and European level. For detailed information on this mechanism see commentary on Article 60 GDPR et seqq.

The cooperation between SAs is based directly on the GDPR and no specific agreement or treaty between Member states is necessary.

When cooperation takes place with other 'independent' SAs, no conflict arises under treaty law for the purposes of Article 8(3) CFR and Article 16(2) TFEU. However, tensions may arise with the concept of 'independence' when SAs must cooperate with the European Commission, as the Commission is a political body. Consequently, cooperation with the Commission may undermine the independence demanded of SAs, as Article 8(3) CFR and Article 16(2) TFEU require complete independence.

(3) More than one SA in a Member State

For the purposes of Article 51 GDPR, it is sufficient if a Member State provides for only one SA. However, several SAs may co-exist in the same Member State in accordance with Article 51(3) GDPR. Article 51(3) GDPR is particularly relevant for Member States with a federal constitutional structure. Germany, for example, consists of 16 Federal States (“Bundesländer”) each with its own SA. Currently the German SAs are represented by the German Federal SA ("BfDI"). Similarly, Spain appoints separate SAs for Catalonia and the Basque Country.

States may appoint multiple SAs in respect of their territorial division of competences or sectorial division of competences. For instance, a State may choose to appoint an SA responsible for controllers from the private sector and another for controllers from the public sector. Additionally, based on derogations concerning processing of data for journalistic purposes or the purpose of artistic and literary expression under Article 85(2) GDPR, some German states have established separate SAs for broadcasting companies. Furthermore, Article 91(2) GDPR allows for the establishment of separate SAs for religious groups. This provision has also been relied upon in Germany, where SAs are partly incorporated within the Catholic and Protestant churches.

Pursuant to Article 51(3) GDPR, Member States with several SAs must firstly designate which of these authorities represents the Member State in the EDPB, and secondly, should by law establish mechanisms for ensuring the effective participation of its SAs in the consistency mechanism. Member States with multiple SAs should designate which one is to function as representative, responsible for functioning as the contact point for other Member States' SAs, the Board and the Commission.

(4) Notification to the Commission

Member States are obligated to notify the Commission of the provisions of its law which it adopts pursuant to Chapter VI GDPR (i.e. the measures adopted regarding the establishment of their SAs and of any subsequent changes to these measures).

Such a notification by the member states was necessary by 25 May 2018. Any subsequent amendments are also subject to such notification to the Commission.

The duty to notify is of significance as non-compliance with GDPR requirements may give rise to the infringement procedure under Article 258 TFEU. In the past infringement procedures before the CJEU were successfully brought by the Commission against Germany, Austria and Hungary with regard to the independence requirement. A possible consequence in case of a violation against this provision is the law's inapplicability.

For more information consult commentary to Article 52 GDPR.

Decisions

→ You can find all related decisions in Category:Article 51 GDPR