Article 51 GDPR: Difference between revisions

From GDPRhub
Line 222: Line 222:


==== In order to ====
==== In order to ====
Article 51(2) GDPR specifies that the role of SAs is twofold.<ref>''Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6'' (Beck 2020, 38th edition)''.''</ref> The first is to protect the fundamental rights and freedoms of individuals, and the second is to facilitate the free flow of personal data within the Union.  
Article 51(1) GDPR specifies that the role of SAs is twofold.<ref>''Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6'' (Beck 2020, 38th edition)''.''</ref> The first is to protect the fundamental rights and freedoms of individuals, and the second is to facilitate the free flow of personal data within the Union.  


===== Protect the fundamental rights and freedoms of natural persons in relation to processing =====
===== Protect the fundamental rights and freedoms of natural persons in relation to processing =====
Line 232: Line 232:
In line with the general objectives of the GDPR, as outlined in [[Article 1 GDPR]], SAs are also required to facilitate the free flow of personal data within the Union, taking into account the requirements of the single market. This requirement necessitates that SAs may not impose measures that have the capacity to impair or prevent the free flow of data within the Union, as to do so would be to undermine the objective outlined in Article 1 GDPR.<ref>''Ziebarth,'' in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 20 (Nomos 2022); see also Kühling, Buchner, Boehm, DS-GVO, Article 51 GDPR, margin number 13 (C.H. Beck 2020).</ref>
In line with the general objectives of the GDPR, as outlined in [[Article 1 GDPR]], SAs are also required to facilitate the free flow of personal data within the Union, taking into account the requirements of the single market. This requirement necessitates that SAs may not impose measures that have the capacity to impair or prevent the free flow of data within the Union, as to do so would be to undermine the objective outlined in Article 1 GDPR.<ref>''Ziebarth,'' in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 20 (Nomos 2022); see also Kühling, Buchner, Boehm, DS-GVO, Article 51 GDPR, margin number 13 (C.H. Beck 2020).</ref>


The aim of this provision should not be understood as an attempt to place the fundamental right to data protection on equal footing with the economic interests of controllers, which are rooted in the free flow of personal data within the common market. Instead the provision should be understood more as an aim to prevent the implementation of national measures relating to data protection, in a manner that would negatively affect the free flow of personal data. Nonetheless, the right to data protection is inevitably weighed up against economic interests through this provision, as it requires that any measure adopted by a SA may not undermine the cross-border flow of data within the EU.
The aim of this provision should not be understood as an attempt to place the fundamental right to data protection on equal footing with the economic interests of controllers, which are rooted in the free flow of personal data within the common market. Instead the provision should be understood more as an aim to prevent the implementation of national measures relating to data protection, in a manner that would negatively affect the free flow of personal data. Nonetheless, the right to data protection is inevitably weighed up against economic interests through this provision, as it requires that any measures adopted by SAs do not unduly undermine the cross-border flow of data within the EU. Hijmans notes though, that after the entry into force of the Lisbon Treaty, "''the centre of gravity in data protection is no longer the free flow of data but rather the protection of fundamental rights''."<ref>''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).</ref> This shift is reflective of a wider trend in the CJEU's case law, in which fundamental rights have begun to take a more dominant position.


Such interpretation of the obligation to facilitate the free flow of personal data within the Union is also in line with the concept of the right to data privacy as a fundamental right under the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT#d1e189-393-1 CFR] and the [https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:12007L/TXT Lisbon Treaty] and the more profound role of fundamental rights in the newer case law of the CJEU.<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).</ref> After the entry into force of the Lisbon Treaty the centre of gravity in data protection is no longer the free flow of data but rather the protection of fundamental rights.<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).</ref>
However, Boehm has taken a different reading of Article 51(1) GDPR's reconciliation of the right to data protection and the free flow of data within the internal market. She notes that this provision should be read as establishing a dual objective, in which one aim should not take priority over the other. The right to data protection and the right to free flow of personal data should be taken into account to the same extend and balanced equally.<ref>''Boehm'' in Kühling, Buchner, Article 51 GDPR, margin numbers 12 and 13 (C.H. Beck 2020).</ref>
 
However, also different opinions can be found. According to these opinions the right to free flow of data is understood as the right to process personal data for economic purposes, whereas both purposes, protection of fundamental rights of private persons and the right to free flow of personal data should be taken into account to the same extend and balanced.<ref>Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020); see also Kühling, Buchner, Boehm, Article 51 GDPR, margin numbers 12 and 13 (C.H. Beck 2020).</ref>


=== (2) Consistent application of the GDPR ===
=== (2) Consistent application of the GDPR ===


==== Shall ====
==== Shall ====
SAs must ("''shall''") contribute to the consistent application of the GDPR throughout the entire EU.<ref>This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, ''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).</ref> This forms a positive obligation on the side of the SAs.
The use of the imperative "''shall''" imposes a positive legal obligation upon SAs to facilitate the consistent application of the Regulation throughout the Union.<ref>This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, ''Hijmans'', in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).</ref>  


==== Contribute ====
==== Contribute ====
The use of the verb “''contribute''” denotes a form of proactive participation specifically aimed at (i) the “''consistent monitoring and enforcement of this Regulation''” and, according to Recital 135, (ii) the uniform application of the law.<ref>[[Recitals GDPR|Recital 129 GDPR]].</ref> Accordingly, SAs are required to identify any problems (e.g. inactivity of a SA involved in a collegial decision-making process) and act for its prompt resolution.  
The use of the verb “''contribute''” denotes a form of proactive participation specifically aimed at the “''consistent monitoring and enforcement of this Regulation''” and, according to Recital 135, the uniform application of the law. Accordingly, SAs are required to identify any problems and act for their prompt resolution.  


==== Consistent application ====
==== Consistent application ====
Consistent application means that the application and interpretation of GDPR provisions should not differ between MS and SAs. All SAs should have the same understanding of GDPR provisions and interpret and enforce them in the same manner. No matter in which country a data subject or controller or processor is located the rights and obligations should be the same.<blockquote><u>Example</u>: Lisa lives in Stockholm. Anna lives in Athens. Both love to go to the gym. Many gyms in Europe start the same unlawful practice. Consistent application of GDPR means various SAs in Europe should cooperate on the matter, maybe issue EDPB guidelines and alike. In the end, the outcome of their complaints procedures should be the same, so that controllers cannot avoid compliance with the GDPR via 'forum shopping' and data subjects enjoy a consistent level of protection.</blockquote>
The use of the term "''consistent application''" mandates that the application and interpretation of GDPR provisions should not differ between Member States' respective SAs. All SAs should have the same understanding of GDPR provisions and interpret and enforce the law in the same vein. The GDPR's predecessor, Directive 95/46/EC (''"DPD"''), was criticised for its fragmented enforcement of the right to data protection, which differed significantly from Member State to Member States, this was something that the GDPR sought to remedy by legislating for the consistent application of its provisions.  
 
==== Cooperation ====
==== Cooperation ====
According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. Cooperation is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. It can be seen as specific provision that implements the general duty of sincere cooperation among EU member states under Article 4(3) TEU.
According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. Cooperation is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. It can be seen as specific provision that implements the general duty of sincere cooperation among EU member states under Article 4(3) TEU.
Under the DPD, there was limited cooperation between supervisory authorities,<ref>''Boehm'' in Kühling, Buchner, Article 51 GDPR, margin number 14 (C.H. Beck 2020).</ref>


Chapter VII provides rules on cooperation between SAs in cross-border cases, as well as their participation in the consistency mechanism and the European Data Protection Board. This gives SAs responsibilities on national and EU level.  
Chapter VII provides rules on cooperation between SAs in cross-border cases, as well as their participation in the consistency mechanism and the European Data Protection Board. This gives SAs responsibilities on national and EU level.  

Revision as of 12:29, 19 October 2023

Article 51 - Supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 51 - Supervisory authority

1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Recital 117: Establishment of Independent Supervisory Authorities
The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 118: Control and Monitoring of Supervisory Authorities
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Recital 119: Participation in Consistency Mechanism in Case of Multiple Supervisory Authorities
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.

Commentary

Chapter VI of the GDPR is dedicated to supervisory authorities ("SAs"). SA is defined in Article 4(21) GDPR as an independent public authority which is established by a member state pursuant to Article 51 GDPR. Chapter VI is divided into two sections. The first section regulates SAs' establishment, staffing and other organizational requirements that the member state must enforce to ensure their independent and proper functioning. The second section defines the tasks and powers of SAs.

Article 51 GDPR marks the beginning of the Regulation's administrative framework, wherein SAs play a crucial role.[1] The provision is fundamental to the establishment of SAs as independent bodies. It is followed by Articles that provide for more detailed rules on the duties and powers afforded to SAs. Article 51 and its related Articles provide the institutional framework for the regulation and enforcement of data protection laws, fulfilling one of the Regulation's main objectives.[2]

Article 51 is closely connected to Article 4(21) (definition of SA), Article 52 (independence), Article 53 (General conditions for the members of SA), Article 54 (Rules on the establishment of SA), Articles 55-59 (Competence, tasks and powers), Articles 60-62 (Cooperation), Articles 63-67 (Consistency) and Article 68-76 (European Data Protection Board).[3]

(1) Establishment of a supervisory authority (SA)

Establishment of SAs

Recital 117 notes that the effective and independent functioning of SAs constitutes an essential element of the fundamental right to data protection. It is also an essential component of the right to data protection under CJEU case law.[4] Consequently, pursuant to Article 51(1) GDPR, each member state must appoint one or more supervisory authority, which are to be independent public authorities.

Independent

Article 8(3) Charter of Fundamental Rights of the European Union ("CFR") and Article 16(2) Treaty on the Functioning of the European Union ("TFEU") require the independence of SAs. Both Articles provide that compliance with data protection law shall be subject to "control by an independent authority."[5]

The Regulation provides for some exceptions to the principle of independence, in instances where the right to the protection of personal data must be reconciled with other rights and freedoms of data subjects. For instance, Article 85(2) GDPR provides that Member States shall provide for exemptions or derogations from Chapter VI (independent supervisory authorities) for processing carried out for journalistic purposes or the purpose of academic artistic or literary expression. In practice, these derogations have resulted in the establishment of sector specific SAs, where provided for by the Regulation. For example, under Article 85(2) GDPR, some German states have established separate SAs for broadcasting companies. Furthermore, Article 91(2) GDPR allows for the establishment of separate SAs for religious groups. This provision has also been relied upon in Germany, where SAs are partly incorporated within the Catholic and Protestant churches. While the independence of these 'special' SAs are partly compromised due to their interdependence with other bodies, they are still subject to the same oversight and procedural rules governing public bodies.

Public

By definition, SAs must be public bodies (see Article 4(21) GDPR). Member states cannot outsource the enforcement of the GDPR to private entities.[6]

Monitoring the application

A supervisory authority's main task is to monitor the correct application of the GDPR. This aim should be understood in line with the wording used by Article 16(2) TFEU and Article 8(3) CFR, which provides that enforcement of the Regulation itself, is something that must be managed by "an independent authority."

In order to

Article 51(1) GDPR specifies that the role of SAs is twofold.[7] The first is to protect the fundamental rights and freedoms of individuals, and the second is to facilitate the free flow of personal data within the Union.

Protect the fundamental rights and freedoms of natural persons in relation to processing

Protecting the fundamental rights and freedoms of individuals includes monitoring the application of all elements of the Regulation, not only those relating to data subject rights, SAs' structure, tasks and powers serve this purpose.[8]

In addition, SAs' protectionist function extends to all rights and freedoms guaranteed by the CFR.[9] Other laws and regulations are not outside of the SAs' jurisdiction, as to correctly apply the GDPR, SA's must regularly determine provisions in light of other laws.

Example: A SA must determine the necessity of processing personal data under applicable tax laws. In this instance, record keeping requirements under other laws become relevant for the purposes of Article 5(1)(e) GDPR when determining the duration for which data must be stored. Any such laws would also be relevant for determining whether the processing is necessary for complying with a legal obligation to which the controller is subject, under Article 6(1)(c) GDPR.

Facilitate the free flow of personal data within the Union

In line with the general objectives of the GDPR, as outlined in Article 1 GDPR, SAs are also required to facilitate the free flow of personal data within the Union, taking into account the requirements of the single market. This requirement necessitates that SAs may not impose measures that have the capacity to impair or prevent the free flow of data within the Union, as to do so would be to undermine the objective outlined in Article 1 GDPR.[10]

The aim of this provision should not be understood as an attempt to place the fundamental right to data protection on equal footing with the economic interests of controllers, which are rooted in the free flow of personal data within the common market. Instead the provision should be understood more as an aim to prevent the implementation of national measures relating to data protection, in a manner that would negatively affect the free flow of personal data. Nonetheless, the right to data protection is inevitably weighed up against economic interests through this provision, as it requires that any measures adopted by SAs do not unduly undermine the cross-border flow of data within the EU. Hijmans notes though, that after the entry into force of the Lisbon Treaty, "the centre of gravity in data protection is no longer the free flow of data but rather the protection of fundamental rights."[11] This shift is reflective of a wider trend in the CJEU's case law, in which fundamental rights have begun to take a more dominant position.

However, Boehm has taken a different reading of Article 51(1) GDPR's reconciliation of the right to data protection and the free flow of data within the internal market. She notes that this provision should be read as establishing a dual objective, in which one aim should not take priority over the other. The right to data protection and the right to free flow of personal data should be taken into account to the same extend and balanced equally.[12]

(2) Consistent application of the GDPR

Shall

The use of the imperative "shall" imposes a positive legal obligation upon SAs to facilitate the consistent application of the Regulation throughout the Union.[13]

Contribute

The use of the verb “contribute” denotes a form of proactive participation specifically aimed at the “consistent monitoring and enforcement of this Regulation” and, according to Recital 135, the uniform application of the law. Accordingly, SAs are required to identify any problems and act for their prompt resolution.

Consistent application

The use of the term "consistent application" mandates that the application and interpretation of GDPR provisions should not differ between Member States' respective SAs. All SAs should have the same understanding of GDPR provisions and interpret and enforce the law in the same vein. The GDPR's predecessor, Directive 95/46/EC ("DPD"), was criticised for its fragmented enforcement of the right to data protection, which differed significantly from Member State to Member States, this was something that the GDPR sought to remedy by legislating for the consistent application of its provisions.

Cooperation

According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. Cooperation is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. It can be seen as specific provision that implements the general duty of sincere cooperation among EU member states under Article 4(3) TEU.

Under the DPD, there was limited cooperation between supervisory authorities,[14]


Chapter VII provides rules on cooperation between SAs in cross-border cases, as well as their participation in the consistency mechanism and the European Data Protection Board. This gives SAs responsibilities on national and EU level.

When cooperation takes place with other 'independent' SAs, there seems to be no issue with respect the the treaty law in Article 8(3) CFR and Article 16(2) TFEU. However, there may be a certain tension with the concept of 'independence' when SAs have to cooperate with the European Commission. It must be noted that the European Commission is a political body and Article 8(3) CFR and Article 16(2) TFEU require complete independence.

(3) More than one SA in one member state

It is sufficient if a member state provides for one SA.[15] However also several SAs can co-exist in one member state. Pursuant to Article 51(3) GDPR, member states with several SAs must (i) designate which of these authorities represents the member state in the EDPB[16] and (ii) ensure that all SAs accept the procedures and effects of the consistency mechanism.

In accordance with Article 51(2) GDPR there can be several SAs in one member state, if a state appoints different SAs for different parts of its territory (territorial division of competences, e.g. see Germany or Spain) and/or for controllers from different sectors (sectorial division of competence; e.g. one SA responsible for controllers from the private sector and another one for the controllers from the public sector).[17]

Any member state with several SAs should establish by law mechanisms for ensuring the effective participation of those SAs in the consistency mechanism. That member state should in particular designate the SA which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other SAs, the Board and the Commission (see also Article 68(4) GDPR).

At the same time the member state must ensure by national law that all SAs accept the procedures and effects of the consistency mechanism, notwithstanding if they actively participated in it or not.

Article 51(3) GDPR is particularly relevant for member states with a federal structure. Germany, for example, consists of 16 Federal States (“Bundesländer”) each with its own SA (similar situation in Spain, where there are separate SAs for Catalonia and the Basque Country). Currently the German SAs are represented by the German Federal SA ("BfDI").

(4) Notification to the Commission

Member states should notify the Commission of the measures adopted to create their SAs and any subsequent changes. Non-compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 TFEU.

Decisions

→ You can find all related decisions in Category:Article 51 GDPR

References

  1. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).
  2. A comprehensive approach on personal data protection in the European Union', Communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions, (2010) COM(2010) 609 final (available here).
  3. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 867 (Oxford University Press 2020).
  4. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 864-868 (Oxford University Press 2020).
  5. For further analysis on independence, refer to the Commentary onArticle 52 GDPR.
  6. Ziebarth, in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 8 (Nomos 2022).
  7. Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6 (Beck 2020, 38th edition).
  8. Ziebarth, in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 19 (Nomos 2022).
  9. Polenz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 51 GDPR, margin numbers 11-13 (Nomos 2019).
  10. Ziebarth, in Sydow, Marsch DS-GVO/BDSG, Article 51 GDPR, margin number 20 (Nomos 2022); see also Kühling, Buchner, Boehm, DS-GVO, Article 51 GDPR, margin number 13 (C.H. Beck 2020).
  11. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 868 (Oxford University Press 2020).
  12. Boehm in Kühling, Buchner, Article 51 GDPR, margin numbers 12 and 13 (C.H. Beck 2020).
  13. This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).
  14. Boehm in Kühling, Buchner, Article 51 GDPR, margin number 14 (C.H. Beck 2020).
  15. Ziebarth, in Sydow, Marsch, DS-GVO/BDSG, Article 51 GDPR, margin number 6 (Nomos 2022).
  16. That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB. See also, Article 4(3) of the EDPB Rules of Procedure (available here).
  17. See, Article 16 (2) TFEU and Article 8 (3) CFR.