Article 51 GDPR: Difference between revisions

From GDPRhub
Line 203: Line 203:
Chapter VI of the GDPR is dedicated to supervisory authorities (SAs). Chapter VI is divided into two sections. Section 1 regulates the establishment of SAs, staffing and other organizational requirements that the Member State must enforce to ensure independence and proper functioning of SAs. Section 2 defines the tasks and powers of SAs.  
Chapter VI of the GDPR is dedicated to supervisory authorities (SAs). Chapter VI is divided into two sections. Section 1 regulates the establishment of SAs, staffing and other organizational requirements that the Member State must enforce to ensure independence and proper functioning of SAs. Section 2 defines the tasks and powers of SAs.  


Article 51 GDPR marks the beginning of the more procedural part of the GDPR, where the SAs play a key role.[1] It is the core article regarding the establishment and key responsibilities of SAs. It is followed by Articles that are laying down more detailed rules on SAs and its powers. Article 51 and the related Articles provide the institutional framework for the enforcement of the data protection rules, one of the main objectives of the GDPR.<ref>A c''omprehensive approach'' on personal ''data protection'' in the ''European Union''<nowiki/>', Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions, (''2010'') COM(''2010'') ''609 final'' (available [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2010:0609:FIN:EN:PDF here]).</ref>
Article 51 GDPR marks the beginning of the more procedural part of the GDPR, where the SAs play a key role.<ref>''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).</ref> It is the core article regarding the establishment and key responsibilities of SAs. It is followed by Articles that are laying down more detailed rules on SAs and its powers. Article 51 and the related Articles provide the institutional framework for the enforcement of the data protection rules, one of the main objectives of the GDPR.<ref>A c''omprehensive approach'' on personal ''data protection'' in the ''European Union''<nowiki/>', Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions, (''2010'') COM(''2010'') ''609 final'' (available [https://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=COM:2010:0609:FIN:EN:PDF here]).</ref>


Article 51 is closely connected to Article 4(21) (definition of SA), Article 52 (independence), Article 53 (General conditions for the members of SA), Article 54 (Rules on the establishment of SA), Articles 55-59 (Competence, tasks and powers), Articles 60-62 (Cooperation), Articles 63-67 (Consistency), Article 68 (European Data Protection Board).<ref>[1] ''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).</ref>
Article 51 is closely connected to Article 4(21) (definition of SA), Article 52 (independence), Article 53 (General conditions for the members of SA), Article 54 (Rules on the establishment of SA), Articles 55-59 (Competence, tasks and powers), Articles 60-62 (Cooperation), Articles 63-67 (Consistency), Article 68 (European Data Protection Board).<ref>''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).</ref>


=== (1) Establishment of Supervisory authority (SA) ===
=== (1) Establishment of Supervisory authority (SA) ===
hjajhdgasjkgsakj
==== Appointment of SAs ====
==== Appointment of SAs ====
Pursuant to Article 51(1) GDPR, each Member State must establish one or more SAs, i.e. independent public authorities responsible to monitor the application of the GDPR. The establishment of SAs performing their tasks and powers in an independent manner, is an essential component of a data subject’s right to data protection (Recital 117).
Pursuant to Article 51(1) GDPR, each Member State must appoint one or more SAs, i.e. independent public authorities responsible to monitor the application of the GDPR. The establishment of SAs performing their tasks and powers in an independent manner, is an essential component of a data subject’s right to data protection (Recital 117).


===== One or more =====
===== One or more =====
It is sufficient if a member state provides for one SA.<ref>''Ziebarth,'' in Sydow, Marsch, DS-GVO/BDSG, Article 51GDPR, margin number 6 (Nomos 2022).</ref> However also several SAs can co-exist in one Member State (see below).
It is sufficient if a Member State provides for one SA.<ref>''Ziebarth,'' in Sydow, Marsch, DS-GVO/BDSG, Article 51 GDPR, margin number 6 (Nomos 2022).</ref> However also several SAs can co-exist in one Member State (see below).


===== Independent =====
===== Independent =====
Line 223: Line 221:


==== Monitoring the application ====
==== Monitoring the application ====
The SA's main task is to monitor the correct application of the GDPR. The term monitoring the application should be understood as being equal to control of compliance, which is the terminology used in Article 16(2) TFEU and Article 8(3) CFR. Control by an independent supervisory authority is one of the main elements of the EU mechanism of data protection. It is also an essential component of the right to data protection under CJEU case law.<ref>''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 864-868 (Oxford University Press 2020).</ref>
The SA's main task is to monitor the correct application of the GDPR. The term monitoring the application should be understood as being equal to control of compliance, which is the terminology used in [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A12008E258 Article 16(2) TFEU] and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 Article 8(3) CFR]. Control by an independent supervisory authority is one of the main elements of the EU mechanism of data protection. It is also an essential component of the right to data protection under CJEU case law.<ref>''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 864-868 (Oxford University Press 2020).</ref>


==== In order to ====
==== In order to ====
Article 51(2) specifies two aims that the SAs shall pursue when monitoring the application of the GDPR: (i) protecting the fundamental rights and freedoms of individuals and (ii) facilitating the free flow of personal data within the Union. The role of SAs is therefore twofold.<ref>''Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6'' (Beck 2020, 38th edition)''.''</ref> Protect the fundamental rights and freedoms of natural persons in relation to processing.
Article 51(2) specifies two aims that the SAs shall pursue when monitoring the application of the GDPR: (i) protecting the fundamental rights and freedoms of individuals and (ii) facilitating the free flow of personal data within the Union. The role of SAs is therefore twofold.<ref>''Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6'' (Beck 2020, 38th edition)''.''</ref>  


Protecting the fundamental rights and freedoms of individuals includes the right to fair, transparent and lawful data processing as well as the rights of access, rectification, erasure and objection. Protection also extends to all rights and freedoms guaranteed by the EU Charter of Fundamental Rights and the Treaty on the Functioning of the European Union.<ref>''Polenz'', in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 51 GDPR, margin numbers 11-13 (Nomos 2019).</ref> Protection of fundamental rights and freedoms of individuals with regard processing of personal data is the direct and actual purpose of SAs. SAs structure, tasks and powers serve this purpose.<ref>''Ziebarth,'' in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 19 (Nomos 2022).</ref><blockquote><u>Example</u>: Lisa lives in Stockholm. Ana lives in Athens. Both are keen squash players and regularly visit their local gym to play squash. Their gyms start sending them emails about offers. They have never agreed to such use of their personal data. Consistent application of GDPR means that the outcome of their complaints procedures must be the same, even though one is conducted by the Greek SA and the other by the Swedish SA.
===== Protect the fundamental rights and freedoms of natural persons in relation to processing. =====
Protecting the fundamental rights and freedoms of individuals includes the right to fair, transparent and lawful data processing as well as the rights of access, rectification, erasure and objection. Protection also extends to all rights and freedoms guaranteed by the EU Charter of Fundamental Rights and the Treaty on the Functioning of the European Union.<ref>''Polenz'', in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 51 GDPR, margin numbers 11-13 (Nomos 2019).</ref> Protection of fundamental rights and freedoms of individuals with regard processing of personal data is the direct and actual purpose of SAs. SAs structure, tasks and powers serve this purpose.<ref>''Ziebarth,'' in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 19 (Nomos 2022).</ref>


<u>Case-law</u>: The CJEU held that [[Article 15 GDPR#1c|Article 15(1)(c) GDPR]] obliges the controller to disclose the identity of specific recipients of personal data if the data subject requests it, unless the request is manifestly unfounded or excessive, in which case information about categories of recipients is sufficient.<ref>CJEU, Case C-553/07'', College van burgemeester en wethouders v. Meerijkeboer'', 7 May 2009, margin numbers 51–52 (available [[CJEU - C-154/21 - RW v Österreichische Post|here]]). </ref>
===== Facilitate the free flow of personal data within the Union =====
In line with the general objectives of the GDPR ([[Article 1 GDPR]]), SAs will also be required to facilitate the free flow of information within the European Union, thus taking into account the requirements of the single market. This means that the SAs should not apply measures that would impair or prevent the free flow of data within the EU when exercising their powers.<ref>''Ziebarth,'' in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 20 (Nomos 2022); see also Kühling, Buchner, Boehm, DS-GVO, Article 51 GDPR, margin number 13 (C.H. Beck 2020).</ref>


<u>EDPB</u>: The EDPB suggests that ..... <ref>EDPB, ‘Guidelines 01/2022 on data subject rights - Right of access’, 28 March 2023 (Version 2.0), p. example___ (available [https://edpb.europa.eu/our-work-tools/our-documents/guidelines/guidelines-012022-data-subject-rights-right-access_en here]).</ref>
The aim of this provision is thus not to put protection of fundamental rights and freedoms of natural persons and economic interests of controllers to free flow of personal data on equal footing but to prevent national measures on data protection and GDPR related issues that would negatively affect the free flow of personal data. Any measure adopted by a SA must be neutral with regard to the cross-border flow of data within the EU.


<u>Common misunderstanding</u>: hsajhasdfadshjg.  
Such interpretation of the obligation to facilitate the free flow of personal data within the Union is also in line with the concept of the right to data privacy as a fundamental right under the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 CFR] and the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:12007L/TXT Lisbon Treaty] and the more profound role of fundamental rights in the newer case law of the CJEU.<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).</ref> After the entry into force of the Lisbon Treaty the center of gravity in data protection is no longer the free flow of data but rather the protection of fundamental rights.<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).</ref>
 
However, also different opinions can be found. According to these opinions the right to free flow of data is understood as the right to process personal data for economic purposes, whereas both purposes, protection of fundamental rights of private persons and the right to free flow of personal data should be taken into account to the same extend and balanced.<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020); see also Kühling, Buchner, Boehm, Article 51 GDPR, margin numbers 12 and 13 (C.H. Beck 2020).</ref>


</blockquote>Pursuant to Article 51(1) GDPR, each Member State must appoint at least one independent SA. This means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany or Spain) or due to the division of competence (''e.g.'' one SA competent for the private sector and another one for the public sector).<ref>See, [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012E%2FTXT Article 16 (2) TFEU] and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 Article 8 (3) CFR].</ref> The SA's main task is to monitor the correct application of the GDPR for the specific purpose of protecting the fundamental rights and freedoms of individuals. This includes, the right to fair, transparent and lawful data processing as well as the rights of access, rectification, erasure and objection. Protection also extends to all rights and freedoms guaranteed by the EU Charter of Fundamental Rights and the Treaty on the Functioning of the European Union''.''<ref>''Polenz'', in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 51 GDPR, margin numbers 11-13 (Nomos 2019).</ref> At the same time, in line with the general objectives of the GDPR (Article 1 GDPR), SAs will also be required to facilitate the free flow of information within the European Union, thus taking into account the requirements of the single market. The role of SAs is therefore twofold: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.<ref>''Schneider'', in BeckOK DatenschutzR, Article 51 GDPR, margin number 6 (Beck 2020, 38th edition).</ref>
=== (2) Consistent Application of the GDPR ===
=== (2) Consistent Application of the GDPR ===
SAs must ''contribute'' to the ''consistent application'' of the GDPR throughout the entire EU.<ref>This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, ''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).</ref> The use of the verb “''contribute''” denotes a form of proactive participation specifically aimed at (i) the “''consistent monitoring and enforcement of this Regulation''” and, according to Recital 135, (ii) the uniform application of the law.<ref>Recital 129 GDPR.</ref> Accordingly, SAs are required to identify any problems (e.g. inactivity of a data protection authority [DPA] involved in a collegial decision-making process) and act for its prompt resolution.According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. This is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. Article 51(2) GDPR confirms the “''hybrid position of DPAs between the EU and national levels. DPAs are not the only such hybrid bodies within the EU, since many EU agencies and national agencies are similarly positioned. However, the status of DPAs is specific, in view of their complete independence, which excludes any direct or indirect influence by national governments or the Commission''”.<ref>''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 870 (Oxford University Press 2020).</ref>  
SAs must contribute to the consistent application of the GDPR throughout the entire EU.<ref>This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, ''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).</ref>
=== (3) Several SAs are Established in one Member State ===
 
Where a Member State establishes several SAs, it should establish by law mechanisms for ensuring the effective participation of those SAs in the consistency mechanism. That Member State should in particular designate the SA which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other SAs, the Board and the Commission (see also Article 68(4) GDPR). Article 51(3) GDPR is particularly relevant for Member States with a federal structure. Germany, for example, consists of 16 Federal States (“''Bundesländer''”) each with its own SA (similar situation in Spain, where there are separate SAs for Catalonia and the Basque Country). Under Article 51(3) GDPR, Member States in this situation must (i) designate which of these authorities represents the Member State in the EDPB<ref>That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB. See also, Article 4(3) of the EDPB Rules of Procedure (available [https://edpb.europa.eu/sites/edpb/files/files/file1/edpb_rop_version_7_adopted_20201008_en.pdf here]).</ref> and (ii) ensure that all federal SAs accept the procedures and effects of the consistency mechanism.  
==== Contribute ====
The use of the verb “''contribute''” denotes a form of proactive participation specifically aimed at (i) the “''consistent monitoring and enforcement of this Regulation''” and, according to [[Recital 135]], (ii) the uniform application of the law.<ref>[[Recital 129 GDPR]].</ref> Accordingly, SAs are required to identify any problems (e.g. inactivity of a SA involved in a collegial decision-making process) and act for its prompt resolution.  
 
==== Consistent application ====
Consistent application means that the application and interpretation of GDPR provisions should not differ between MS and SAs. All SAs should have the same understanding of GDPR provisions and interpret and enforce them in the same manner. No matter in which country a data subject or controller or processor is located the rights and obligations should be the same.<blockquote><u>Example</u>: Lisa lives in Stockholm. Ana lives in Athens. Both are keen squash players and regularly visit their local gym to play squash. Their gyms start sending them emails about offers. They have never agreed to such use of their personal data. Consistent application of GDPR means that the outcome of their complaints procedures must be the same, even though one is conducted by the Greek SA and the other by the Swedish SA.</blockquote>
 
==== Cooperate ====
According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. Cooperation is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. Chapter VII provides rules on cooperation between SAs in cross-border cases, as well as their participation in the consistency mechanism and the European Data Protection Board. This gives SAs responsibilities on national and EU level.
 
Article 51(2) GDPR confirms the “''hybrid position of DPAs [SAs] between the EU and national levels.''"<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 870 (Oxford University Press 2020).</ref> There are several such hybrid bodies within the EU, since many EU agencies and national agencies are similarly positioned. ''"However, the status of DPAs [SAs] is specific, in view of their complete independence, which excludes any direct or indirect influence by national governments or the Commission."''<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 870 (Oxford University Press 2020).</ref>
 
=== (3) More than one SA in one Member State ===
Pursuant to Article 51(3) GDPR, Member States with several SAs must (i) designate which of these authorities represents the Member State in the EDPB<ref>That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB. See also, Article 4(3) of the EDPB Rules of Procedure (available [https://edpb.europa.eu/our-work-tools/our-documents/rules-procedure/rules-procedure-version-8_en here]).</ref> and (ii) ensure that all SAs accept the procedures and effects of the consistency mechanism.
 
In accordance with Article 51(2) GDPR there can be several SAs in one Member State, if a state appoints different SAs for different parts of its territory (territorial division of competences, e.g. see Germany or Spain) and/or for controllers from different sectors (sectorial division of competence; ''e.g.'' one SA responsible for controllers from the private sector and another one for the controllers from the public sector).<ref>See, [https://eur-lex.europa.eu/eli/treaty/tfeu_2012/oj Article 16 (2) TFEU] and [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 Article 8 (3) CFR].</ref>
 
Any Member State with several SAs should establish by law mechanisms for ensuring the effective participation of those SAs in the consistency mechanism. That Member State should in particular designate the SA which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other SAs, the Board and the Commission (see also [[Article 68 GDPR|Article 68(4) GDPR]]).
 
At the same time the Member State must ensure by national law that all SAs accept the procedures and effects of the consistency mechanism, notwithstanding if they actively participated in it or not.
 
Article 51(3) GDPR is particularly relevant for Member States with a federal structure. Germany, for example, consists of 16 Federal States (“''Bundesländer''”) each with its own SA (similar situation in Spain, where there are separate SAs for Catalonia and the Basque Country).


=== (4) Notification to the Commission ===
=== (4) Notification to the Commission ===
Member States should notify the Commission of the measures adopted to create their SAs. Non-compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A12008E258 Article 258 TFEU].  
Member States should notify the Commission of the measures adopted to create their SAs and any subsequent changes. Non-compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under [https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex%3A12008E258 Article 258 TFEU].  


==Decisions==
==Decisions==

Revision as of 15:27, 26 April 2023

Article 51 - Supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 51 - Supervisory authority

1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Recital 117: Establishment of Independent Supervisory Authorities
The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 118: Control and Monitoring of Supervisory Authorities
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Recital 119: Participation in Consistency Mechanism in Case of Multiple Supervisory Authorities
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.

Commentary

Chapter VI of the GDPR is dedicated to supervisory authorities (SAs). Chapter VI is divided into two sections. Section 1 regulates the establishment of SAs, staffing and other organizational requirements that the Member State must enforce to ensure independence and proper functioning of SAs. Section 2 defines the tasks and powers of SAs.

Article 51 GDPR marks the beginning of the more procedural part of the GDPR, where the SAs play a key role.[1] It is the core article regarding the establishment and key responsibilities of SAs. It is followed by Articles that are laying down more detailed rules on SAs and its powers. Article 51 and the related Articles provide the institutional framework for the enforcement of the data protection rules, one of the main objectives of the GDPR.[2]

Article 51 is closely connected to Article 4(21) (definition of SA), Article 52 (independence), Article 53 (General conditions for the members of SA), Article 54 (Rules on the establishment of SA), Articles 55-59 (Competence, tasks and powers), Articles 60-62 (Cooperation), Articles 63-67 (Consistency), Article 68 (European Data Protection Board).[3]

(1) Establishment of Supervisory authority (SA)

Appointment of SAs

Pursuant to Article 51(1) GDPR, each Member State must appoint one or more SAs, i.e. independent public authorities responsible to monitor the application of the GDPR. The establishment of SAs performing their tasks and powers in an independent manner, is an essential component of a data subject’s right to data protection (Recital 117).

One or more

It is sufficient if a Member State provides for one SA.[4] However also several SAs can co-exist in one Member State (see below).

Independent

For independence see commentary to Article 52.

Public

SAs must be public bodies. Member States cannot leave the control of the correct application of the GDPR to private entities.[5] The GDPR provides for some exceptions from this rule for processing for specific purposes. According to Article 85(2) GDPR states can provide for exemptions or derogations from Chapter VI (independent supervisory authorities) for processing carried out for journalistic purposes or the purpose of academic artistic or literary expression, if they are necessary to reconcile the right to the protection of personal data with the freedom of expression and information.

Monitoring the application

The SA's main task is to monitor the correct application of the GDPR. The term monitoring the application should be understood as being equal to control of compliance, which is the terminology used in Article 16(2) TFEU and Article 8(3) CFR. Control by an independent supervisory authority is one of the main elements of the EU mechanism of data protection. It is also an essential component of the right to data protection under CJEU case law.[6]

In order to

Article 51(2) specifies two aims that the SAs shall pursue when monitoring the application of the GDPR: (i) protecting the fundamental rights and freedoms of individuals and (ii) facilitating the free flow of personal data within the Union. The role of SAs is therefore twofold.[7]

Protect the fundamental rights and freedoms of natural persons in relation to processing.

Protecting the fundamental rights and freedoms of individuals includes the right to fair, transparent and lawful data processing as well as the rights of access, rectification, erasure and objection. Protection also extends to all rights and freedoms guaranteed by the EU Charter of Fundamental Rights and the Treaty on the Functioning of the European Union.[8] Protection of fundamental rights and freedoms of individuals with regard processing of personal data is the direct and actual purpose of SAs. SAs structure, tasks and powers serve this purpose.[9]

Facilitate the free flow of personal data within the Union

In line with the general objectives of the GDPR (Article 1 GDPR), SAs will also be required to facilitate the free flow of information within the European Union, thus taking into account the requirements of the single market. This means that the SAs should not apply measures that would impair or prevent the free flow of data within the EU when exercising their powers.[10]

The aim of this provision is thus not to put protection of fundamental rights and freedoms of natural persons and economic interests of controllers to free flow of personal data on equal footing but to prevent national measures on data protection and GDPR related issues that would negatively affect the free flow of personal data. Any measure adopted by a SA must be neutral with regard to the cross-border flow of data within the EU.

Such interpretation of the obligation to facilitate the free flow of personal data within the Union is also in line with the concept of the right to data privacy as a fundamental right under the CFR and the Lisbon Treaty and the more profound role of fundamental rights in the newer case law of the CJEU.[11] After the entry into force of the Lisbon Treaty the center of gravity in data protection is no longer the free flow of data but rather the protection of fundamental rights.[12]

However, also different opinions can be found. According to these opinions the right to free flow of data is understood as the right to process personal data for economic purposes, whereas both purposes, protection of fundamental rights of private persons and the right to free flow of personal data should be taken into account to the same extend and balanced.[13]

(2) Consistent Application of the GDPR

SAs must contribute to the consistent application of the GDPR throughout the entire EU.[14]

Contribute

The use of the verb “contribute” denotes a form of proactive participation specifically aimed at (i) the “consistent monitoring and enforcement of this Regulation” and, according to Recital 135, (ii) the uniform application of the law.[15] Accordingly, SAs are required to identify any problems (e.g. inactivity of a SA involved in a collegial decision-making process) and act for its prompt resolution.

Consistent application

Consistent application means that the application and interpretation of GDPR provisions should not differ between MS and SAs. All SAs should have the same understanding of GDPR provisions and interpret and enforce them in the same manner. No matter in which country a data subject or controller or processor is located the rights and obligations should be the same.

Example: Lisa lives in Stockholm. Ana lives in Athens. Both are keen squash players and regularly visit their local gym to play squash. Their gyms start sending them emails about offers. They have never agreed to such use of their personal data. Consistent application of GDPR means that the outcome of their complaints procedures must be the same, even though one is conducted by the Greek SA and the other by the Swedish SA.

Cooperate

According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. Cooperation is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. Chapter VII provides rules on cooperation between SAs in cross-border cases, as well as their participation in the consistency mechanism and the European Data Protection Board. This gives SAs responsibilities on national and EU level.

Article 51(2) GDPR confirms the “hybrid position of DPAs [SAs] between the EU and national levels."[16] There are several such hybrid bodies within the EU, since many EU agencies and national agencies are similarly positioned. "However, the status of DPAs [SAs] is specific, in view of their complete independence, which excludes any direct or indirect influence by national governments or the Commission."[17]

(3) More than one SA in one Member State

Pursuant to Article 51(3) GDPR, Member States with several SAs must (i) designate which of these authorities represents the Member State in the EDPB[18] and (ii) ensure that all SAs accept the procedures and effects of the consistency mechanism.

In accordance with Article 51(2) GDPR there can be several SAs in one Member State, if a state appoints different SAs for different parts of its territory (territorial division of competences, e.g. see Germany or Spain) and/or for controllers from different sectors (sectorial division of competence; e.g. one SA responsible for controllers from the private sector and another one for the controllers from the public sector).[19]

Any Member State with several SAs should establish by law mechanisms for ensuring the effective participation of those SAs in the consistency mechanism. That Member State should in particular designate the SA which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other SAs, the Board and the Commission (see also Article 68(4) GDPR).

At the same time the Member State must ensure by national law that all SAs accept the procedures and effects of the consistency mechanism, notwithstanding if they actively participated in it or not.

Article 51(3) GDPR is particularly relevant for Member States with a federal structure. Germany, for example, consists of 16 Federal States (“Bundesländer”) each with its own SA (similar situation in Spain, where there are separate SAs for Catalonia and the Basque Country).

(4) Notification to the Commission

Member States should notify the Commission of the measures adopted to create their SAs and any subsequent changes. Non-compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 TFEU.

Decisions

→ You can find all related decisions in Category:Article 51 GDPR

References

  1. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).
  2. A comprehensive approach on personal data protection in the European Union', Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions, (2010) COM(2010) 609 final (available here).
  3. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).
  4. Ziebarth, in Sydow, Marsch, DS-GVO/BDSG, Article 51 GDPR, margin number 6 (Nomos 2022).
  5. Ziebarth, in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 8 (Nomos 2022).
  6. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 864-868 (Oxford University Press 2020).
  7. Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6 (Beck 2020, 38th edition).
  8. Polenz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 51 GDPR, margin numbers 11-13 (Nomos 2019).
  9. Ziebarth, in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 19 (Nomos 2022).
  10. Ziebarth, in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 20 (Nomos 2022); see also Kühling, Buchner, Boehm, DS-GVO, Article 51 GDPR, margin number 13 (C.H. Beck 2020).
  11. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).
  12. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).
  13. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020); see also Kühling, Buchner, Boehm, Article 51 GDPR, margin numbers 12 and 13 (C.H. Beck 2020).
  14. This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).
  15. Recital 129 GDPR.
  16. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 870 (Oxford University Press 2020).
  17. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 870 (Oxford University Press 2020).
  18. That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB. See also, Article 4(3) of the EDPB Rules of Procedure (available here).
  19. See, Article 16 (2) TFEU and Article 8 (3) CFR.