Article 51 GDPR: Difference between revisions

From GDPRhub
No edit summary
No edit summary
(One intermediate revision by the same user not shown)
Line 196: Line 196:


==Relevant Recitals==
==Relevant Recitals==
<span id="r117">
{{Recital/117 GDPR}}
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 117:'''</div>
{{Recital/118 GDPR}}
<div class="mw-collapsible-content">
{{Recital/119 GDPR}}
The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.
</div></div>
 
<span id="r118">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 118:''' </div>
<div class="mw-collapsible-content">
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.</div></div>
 
<span id="r119">
<div class="toccolours mw-collapsible mw-collapsed" style="border-width: 0px" overflow:auto;"><div>'''Recital 119:''' </div>
<div class="mw-collapsible-content">
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.
</div></div>
 


==Commentary==
==Commentary==

Revision as of 13:10, 24 August 2021

Article 51 - Supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 51 - Supervisory authority


1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Recital 117: Establishment of Independent Supervisory Authorities
The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 118: Control and Monitoring of Supervisory Authorities
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Recital 119: Participation in Consistency Mechanism in Case of Multiple Supervisory Authorities
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.

Commentary

(1) Establishment of One or More Competent Authorities

Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany of Spain ) or due to the division of competence (e.g. one SA competent for private sector and another one for the public sector).

The control of the compliance to EU law concerning personal by independent supervisory authority is already enshrined in Article 16 (2) TFEU and Article 8 (3) CFR.

The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.

Criteria on the independence of SAs are further elaborated in Article 52 GDPR and Article 53 GDPR.

(2) Cooperation Between SAs

The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under Article 65 GDPR.

(3) Several SAs are Established in one Member State

Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also Article 68(4) GDPR).

That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB (See Article 4(3) within).

Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact (ZASt) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.

(4) Notification to the Commission

Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 TFEU.

Decisions

→ You can find all related decisions in Category:Article 51 GDPR

References