Article 51 GDPR

From GDPRhub
Revision as of 15:46, 28 April 2022 by SR (talk | contribs) (→‎Commentary)
Article 51 - Supervisory authority
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 51 - Supervisory authority

1. Each Member State shall provide for one or more independent public authorities to be responsible for monitoring the application of this Regulation, in order to protect the fundamental rights and freedoms of natural persons in relation to processing and to facilitate the free flow of personal data within the Union (‘supervisory authority’).

2. Each supervisory authority shall contribute to the consistent application of this Regulation throughout the Union. For that purpose, the supervisory authorities shall cooperate with each other and the Commission in accordance with Chapter VII.

3. Where more than one supervisory authority is established in a Member State, that Member State shall designate the supervisory authority which is to represent those authorities in the Board and shall set out the mechanism to ensure compliance by the other authorities with the rules relating to the consistency mechanism referred to in Article 63.

4. Each Member State shall notify to the Commission the provisions of its law which it adopts pursuant to this Chapter, by 25 May 2018 and, without delay, any subsequent amendment affecting them.

Relevant Recitals

Recital 117: Establishment of Independent Supervisory Authorities
The establishment of supervisory authorities in Member States, empowered to perform their tasks and exercise their powers with complete independence, is an essential component of the protection of natural persons with regard to the processing of their personal data. Member States should be able to establish more than one supervisory authority, to reflect their constitutional, organisational and administrative structure.

Recital 118: Control and Monitoring of Supervisory Authorities
The independence of supervisory authorities should not mean that the supervisory authorities cannot be subject to control or monitoring mechanisms regarding their financial expenditure or to judicial review.

Recital 119: Participation in Consistency Mechanism in Case of Multiple Supervisory Authorities
Where a Member State establishes several supervisory authorities, it should establish by law mechanisms for ensuring the effective participation of those supervisory authorities in the consistency mechanism. That Member State should in particular designate the supervisory authority which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other supervisory authorities, the Board and the Commission.

Commentary

Chapter VI of the GDPR is dedicated to supervisory authorities. Section 1 regulates the establishment of supervisory authorities (SAs) and the requirements that the Member State must enforce to ensure their independence and proper functioning. Section 2 defines the tasks and powers of SAs.

(1) Establishment of One or More Competent Authorities

Pursuant to Article 51(1) GDPR, each Member State must appoint at least one independent SA. This means that several SAs can co-exist in one Member State due to their constitutional organisation (e.g. see Germany or Spain) or due to the division of competence (e.g. one SA competent for the private sector and another one for the public sector).[1] The SA's main task is to monitor the correct application of the GDPR for the specific purpose of protecting the fundamental rights and freedoms of individuals. This includes, the right to fair, transparent and lawful data processing as well as the rights of access, rectification, erasure and objection. Protection also extends to all rights and freedoms guaranteed by the EU Charter of Fundamental Rights and the Treaty on the Functioning of the European Union.[2] At the same time, in line with the general objectives of the GDPR (Article 1 GDPR), SAs will also be required to facilitate the free flow of information within the European Union, thus taking into account the requirements of the single market. The role of SAs is therefore twofold: not only protecting personal data as a fundamental right, but also facilitating the free flow of personal data within the Union.[3]

(2) Consistent Application of the GDPR

SAs must contribute to the consistent application of the GDPR throughout the entire EU.[4] The use of the verb “contribute” denotes a form of proactive participation specifically aimed at (i) the “consistent monitoring and enforcement of this Regulation” and, according to Recital 135, (ii) the uniform application of the law.[5] Accordingly, SAs are required to identify any problems (e.g. inactivity of a data protection authority [DPA] involved in a collegial decision-making process) and act for its prompt resolution.According to the second sentence of Article 51(2) GDPR, SAs must cooperate with each other and the Commission in accordance with Chapter VII of the GDPR. This is an essential feature of the SAs' action, considered as one of the tools for fostering “contribution” to the consistent application of the GDPR. Article 51(2) GDPR confirms the “hybrid position of DPAs between the EU and national levels. DPAs are not the only such hybrid bodies within the EU, since many EU agencies and national agencies are similarly positioned. However, the status of DPAs is specific, in view of their complete independence, which excludes any direct or indirect influence by national governments or the Commission”.[6]

(3) Several SAs are Established in one Member State

Where a Member State establishes several SAs, it should establish by law mechanisms for ensuring the effective participation of those SAs in the consistency mechanism. That Member State should in particular designate the SA which functions as a single contact point for the effective participation of those authorities in the mechanism, to ensure swift and smooth cooperation with other SAs, the Board and the Commission (see also Article 68(4) GDPR). Article 51(3) GDPR is particularly relevant for Member States with a federal structure. Germany, for example, consists of 16 Federal States (“Bundesländer”) each with its own SA (similar situation in Spain, where there are separate SAs for Catalonia and the Basque Country). Under Article 51(3) GDPR, Member States in this situation must (i) designate which of these authorities represents the Member State in the EDPB[7] and (ii) ensure that all federal SAs accept the procedures and effects of the consistency mechanism.

(4) Notification to the Commission

Member States should notify the Commission of the measures adopted to create their SAs. Non-compliance with the requirements of the GDPR relating to the establishment of an independent SA can lead to an infringement procedure under Article 258 TFEU.

Decisions

→ You can find all related decisions in Category:Article 51 GDPR

References

  1. See, Article 16 (2) TFEU and Article 8 (3) CFR.
  2. Polenz, in Simitis, Hornung, Spiecker gen. Döhmann, Datenschutzrecht, Article 51 GDPR, margin numbers 11-13 (Nomos 2019).
  3. Schneider, in BeckOK DatenschutzR, Article 51 GDPR, margin number 6 (Beck 2020, 38th edition).
  4. This is an additional obligation to the primary one linked to the application of the GDPR on the territory of one's own Member State, reflecting a certain “Europeanisation” of the action of independent authorities. See, Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 869 (Oxford University Press 2020).
  5. Recital 129 GDPR.
  6. Hijmans, in Kuner, Bygrave, Docksey, The EU General Data Protection Regulation (GDPR): A Commentary, Article 51 GDPR, p. 870 (Oxford University Press 2020).
  7. That implies that each member State can only send one representative to the EDPB, as reflected in the Rules of Procedure of the EDPB. See also, Article 4(3) of the EDPB Rules of Procedure (available here).