Difference between revisions of "Article 51 GDPR"

From GDPRhub
Line 2: Line 2:
 
![[Article 50 GDPR|←]] Article 51 - Supervisory authority [[Article 52 GDPR|→]]
 
![[Article 50 GDPR|←]] Article 51 - Supervisory authority [[Article 52 GDPR|→]]
 
|-
 
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
+
| style="padding: 20px; background-color:#003399;" |[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
 
|-
 
|-
 
|
 
|
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 17: Line 17:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 31: Line 31:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 50: Line 50:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 77: Line 77:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 91: Line 91:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 107: Line 107:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 131: Line 131:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 146: Line 146:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 160: Line 160:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 169: Line 169:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 184: Line 184:
 
|}
 
|}
  
== Legal Text ==
+
==Legal Text==
 
<br /><center>'''Article 51 - Supervisory authority'''</center><br />
 
<br /><center>'''Article 51 - Supervisory authority'''</center><br />
  
 
<span id="1">1.  Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).</span>
 
<span id="1">1.  Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).</span>
  
<span id="2">2.  Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.</span>
+
<span id="2">2.  Each supervisory authority shall contribute to</span> <span id="2">the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.</span>
  
 
<span id="3">3.  Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.</span>
 
<span id="3">3.  Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.</span>
Line 195: Line 195:
 
<span id="4">4.  Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.</span>
 
<span id="4">4.  Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.</span>
  
== Relevant Recitals==
+
==Relevant Recitals==
''You can help us fill this section!''
+
'''Recital 117  The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.'''
  
== Commentary ==
+
'''Recital 120'''
  
''You can help us fill this section!''
+
'''Recital 118'''
  
== Decisions ==
+
'''Recital 121'''
 +
 
 +
==Commentary==
 +
 
 +
'''(1) Establishment of one or more competent authorities'''
 +
 
 +
Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (''e.g.'' see Germany of Spain ) or due to the division of competence (''e.g.'' one SA competent for private sector and another one for the public sector).
 +
 
 +
The control of the compliance to EU law concerning personal by independent supervisory authority is already enshrined in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012E%2FTXT Article 16 (2)] of the TFEU and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 Article 8 (3)] of the CFR.
 +
 
 +
The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also <span id="1">facilitating the free flow of personal data within the Union.</span>
 +
 
 +
Criteria on the independence of SAs are further elaborated in [[Articles 52]] and [[Article 53]] of the GDPR.
 +
 
 +
'''(2) Cooperation between SAs'''
 +
 
 +
The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under [[Article 65 GDPR]].
 +
 
 +
'''(3) Several SAs are etsablished in one Member State'''
 +
 
 +
Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also [[Article 68 (4)|Article 68(4)]] of the GDPR.
 +
 
 +
That implies that each member State can only send one representative to the EDPB, as reflected in the [https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_rop_version_7_adopted_20201008_en.pdf Rules of Procedure] of the EDPB (See Article 4(3)).
 +
 
 +
Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact ([https://www.bfdi.bund.de/ZASt/EN/Home/home_node.html ZASt]) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.
 +
 
 +
'''(4) Notification to the Commission'''
 +
 
 +
Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A12008E258 Article 258] of the TFEU.
 +
 
 +
==Decisions==
 
→ You can find all related decisions in [[:Category:Article 51 GDPR]]
 
→ You can find all related decisions in [[:Category:Article 51 GDPR]]
  
== References ==
+
==References==
 
<references />
 
<references />
 
[[Category:GDPR Articles]]
 
[[Category:GDPR Articles]]

Revision as of 15:01, 16 April 2021

Article 51 - Supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 51 - Supervisory authority


1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Recital 117 The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 120

Recital 118

Recital 121

Commentary

(1) Establishment of one or more competent authorities

Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany of Spain ) or due to the division of competence (e.g. one SA competent for private sector and another one for the public sector).

The control of the compliance to EU law concerning personal by independent supervisory authority is already enshrined in Article 16 (2) of the TFEU and Article 8 (3) of the CFR.

The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.

Criteria on the independence of SAs are further elaborated in Articles 52 and Article 53 of the GDPR.

(2) Cooperation between SAs

The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under Article 65 GDPR.

(3) Several SAs are etsablished in one Member State

Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also Article 68(4) of the GDPR.

That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB (See Article 4(3)).

Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact (ZASt) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.

(4) Notification to the Commission

Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 of the TFEU.

Decisions

→ You can find all related decisions in Category:Article 51 GDPR

References