Article 51 GDPR

From GDPRhub
Revision as of 15:30, 16 April 2021 by Robertr (talk | contribs)
Article 51 - Supervisory authority
Chapter 10: Delegated and implementing acts

Legal Text

Article 51 - Supervisory authority

1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Recital 117:

The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 118:
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Recital r119:

Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.


(1) Establishment of one or more competent authorities

Each Member State should appoint at least one supervisory authority (SA) to monitor and enforce the GDPR. That means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany of Spain ) or due to the division of competence (e.g. one SA competent for private sector and another one for the public sector).

The control of the compliance to EU law concerning personal by independent supervisory authority is already enshrined in Article 16 (2) of the TFEU and Article 8 (3) of the CFR.

The role of SAs is however therefore double: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.

Criteria on the independence of SAs are further elaborated in Articles 52 and Article 53 of the GDPR.

(2) Cooperation between SAs

The independence of the SAs is somehow encroached by the cooperation mechanism as set up by Chapter VII of the GDPR: SAs have to cooperate and their decisions/investigation and all other actions should take into account the cooperation and consistency mechanism (also called "one stop shop") and the decisions of the EDPB in the cases mentioned under Article 65 GDPR.

(3) Several SAs are etsablished in one Member State

Where in a Member State more than one supervisory authority is responsible for monitoring the application of the GDPR, a joint representative shall be appointed in accordance with that Member State's law (see also Article 68(4) of the GDPR.

That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB (See Article 4(3)).

Moreover, the cooperation and consistency mechanism should mare sure to have one contact point or authority in each Member State with whom cooperation will take place. As an illustration, in, where Germany where the SAs include the data protection supervisory authorities of the Federal Government and of the 16 Länder (Federal States), a single contact (ZASt) point coordinates the cross-border cooperation with the other Member States of the European Union, the European Data Protection Board (EDPB) and the European Commission.

(4) Notification to the Commission

Member States should notify the Commission of the measures adopted to create their SAs. Non compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 of the TFEU.


→ You can find all related decisions in Category:Article 51 GDPR