Article 51 GDPR
|← Article 51 - Supervisory authority →|
1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).
2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.
3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.
4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.
Recital 117 The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.
(1) Establishment of one or more competent authorities
Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany of Spain ) or due to the division of competence (e.g. one SA competent for private sector and another one for the public sector).
The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.
(2) Cooperation between SAs
The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under Article 65 GDPR.
(3) Several SAs are etsablished in one Member State
Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also Article 68(4) of the GDPR.
That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB (See Article 4(3)).
Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact (ZASt) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.
(4) Notification to the Commission
Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 of the TFEU.
→ You can find all related decisions in Category:Article 51 GDPR