Difference between revisions of "Article 51 GDPR"

From GDPRhub
 
(2 intermediate revisions by the same user not shown)
Line 2: Line 2:
 
![[Article 50 GDPR|←]] Article 51 - Supervisory authority [[Article 52 GDPR|→]]
 
![[Article 50 GDPR|←]] Article 51 - Supervisory authority [[Article 52 GDPR|→]]
 
|-
 
|-
|style="padding: 20px; background-color:#003399;"|[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
+
| style="padding: 20px; background-color:#003399;" |[[File:Gdpricon.png|100px|center|link=Overview_of_GDPR]]
 
|-
 
|-
 
|
 
|
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 1: General provisions</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 17: Line 17:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 2: Principles</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 31: Line 31:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 3: Rights of the data subject</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 50: Line 50:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 4: Controller and processor</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 77: Line 77:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 5: Transfers of personal data</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 91: Line 91:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 6: Supervisory authorities</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 107: Line 107:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 7: Cooperation and consistency</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 131: Line 131:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 8: Remedies, liability and penalties</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 146: Line 146:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 9: Specific processing situations</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 160: Line 160:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 10: Delegated and implementing acts</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 169: Line 169:
 
</div></div>
 
</div></div>
  
<div class="toccolours mw-collapsible mw-collapsed" overflow:auto;" style="border-width: 0px">
+
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;">
 
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
 
<div style="font-weight:bold;line-height:1.6;">Chapter 11: Final provisions</div>
 
<div class="mw-collapsible-content">
 
<div class="mw-collapsible-content">
Line 184: Line 184:
 
|}
 
|}
  
== Legal Text ==
+
==Legal Text==
 
<br /><center>'''Article 51 - Supervisory authority'''</center><br />
 
<br /><center>'''Article 51 - Supervisory authority'''</center><br />
  
 
<span id="1">1.  Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).</span>
 
<span id="1">1.  Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).</span>
  
<span id="2">2.  Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.</span>
+
<span id="2">2.  Each supervisory authority shall contribute to</span> <span id="2">the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.</span>
  
 
<span id="3">3.  Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.</span>
 
<span id="3">3.  Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.</span>
Line 195: Line 195:
 
<span id="4">4.  Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.</span>
 
<span id="4">4.  Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.</span>
  
== Relevant Recitals==
+
==Relevant Recitals==
''You can help us fill this section!''
+
<span id="r117">
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 117:'''</div>
 +
<div class="mw-collapsible-content">
 +
The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.
 +
</div></div>
 +
 
 +
<span id="r118">
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 118:''' </div>
 +
<div class="mw-collapsible-content">
 +
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.</div></div>
 +
 
 +
<span id="r119">
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 119:''' </div>
 +
<div class="mw-collapsible-content">
 +
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.
 +
</div></div>
 +
 
 +
 
 +
==Commentary==
 +
 
 +
'''(1) Establishment of one or more competent authorities'''
 +
 
 +
Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (''e.g.'' see Germany of Spain ) or due to the division of competence (''e.g.'' one SA competent for private sector and another one for the public sector).
 +
 
 +
The control of the compliance to EU law concerning personal by independent supervisory authority is already enshrined in [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012E%2FTXT Article 16 (2)] of the TFEU and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 Article 8 (3)] of the CFR.
 +
 
 +
The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also <span id="1">facilitating the free flow of personal data within the Union.</span>
 +
 
 +
Criteria on the independence of SAs are further elaborated in [[Articles 52]] and [[Article 53]] of the GDPR.
 +
 
 +
'''(2) Cooperation between SAs'''
 +
 
 +
The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under [[Article 65 GDPR]].
 +
 
 +
'''(3) Several SAs are etsablished in one Member State'''
 +
 
 +
Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also [[Article 68 (4)|Article 68(4)]] of the GDPR.
 +
 
 +
That implies that each member State can only send one representative to the EDPB, as reflected in the [https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_rop_version_7_adopted_20201008_en.pdf Rules of Procedure] of the EDPB (See Article 4(3)).
 +
 
 +
Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact ([https://www.bfdi.bund.de/ZASt/EN/Home/home_node.html ZASt]) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.
  
== Commentary ==
+
'''(4) Notification to the Commission'''
  
''You can help us fill this section!''
+
Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A12008E258 Article 258] of the TFEU.
  
== Decisions ==
+
==Decisions==
 
→ You can find all related decisions in [[:Category:Article 51 GDPR]]
 
→ You can find all related decisions in [[:Category:Article 51 GDPR]]
  
== References ==
+
==References==
 
<references />
 
<references />
 
[[Category:GDPR Articles]]
 
[[Category:GDPR Articles]]

Latest revision as of 15:32, 16 April 2021

Article 51 - Supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text[edit | edit source]


Article 51 - Supervisory authority


1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals[edit | edit source]

Recital 117:

The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 118:
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Recital 119:

Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.


Commentary[edit | edit source]

(1) Establishment of one or more competent authorities

Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany of Spain ) or due to the division of competence (e.g. one SA competent for private sector and another one for the public sector).

The control of the compliance to EU law concerning personal by independent supervisory authority is already enshrined in Article 16 (2) of the TFEU and Article 8 (3) of the CFR.

The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.

Criteria on the independence of SAs are further elaborated in Articles 52 and Article 53 of the GDPR.

(2) Cooperation between SAs

The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under Article 65 GDPR.

(3) Several SAs are etsablished in one Member State

Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also Article 68(4) of the GDPR.

That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB (See Article 4(3)).

Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact (ZASt) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.

(4) Notification to the Commission

Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 of the TFEU.

Decisions[edit | edit source]

→ You can find all related decisions in Category:Article 51 GDPR

References[edit | edit source]