Article 68 GDPR: Difference between revisions

From GDPRhub
m (1 revision imported)
 
mNo edit summary
 
(27 intermediate revisions by 5 users not shown)
Line 185: Line 185:


== Legal Text ==
== Legal Text ==
<br /><center>'''Article 68 - European Data Protection Board'''</center><br />
<br /><center>'''Article 68 - European Data Protection Board'''</center>


<span id="1">1.  The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality.</span>
<span id="1">1.  The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality.</span>
Line 200: Line 200:


== Relevant Recitals==
== Relevant Recitals==
''You can help us fill this section!''
{{Recital/139 GDPR}}


== Commentary ==
== Commentary ==
Article 68 GDPR addresses the nature, legal status, and internal composition of the European Data Protection Board (“''EDPB''”). The EDPB replaces the Article 29 Working Party (“''WP29''”), the former advisory body established under Directive 95/46/EC. Notably, the powers granted to the EDPB are far grater than those afforded to its predecessor. The WP29 was constrained to a purely advisory role. However, the EDPB in contrast, has been afforded a wide array duties, including the power to adopt binding decisions pursuant to Article 65 GDPR (Article 70(1)(t) GDPR).<ref>''Schiedermair'', in Spiecker gen. Döhmann et al., General Data Protection Regulation, Article 68 GDPR, margin number 3 (C.H. Beck 2023, 1st edition).  </ref> Article 68 GDPR is the first of nine Articles (Articles 68-76 GDPR) governing the EDPB set forth in Section 3 of Chapter VII GDPR.


''You can help us fill this section!''
===(1) Legal personality===
Article 68(1) GDPR, in addition to Recital 139 GDPR, establish the EDPB as a body of the Union with legal personality. The objectives behind granting the EDPB legal personality were rooted in the perceived defficiencies of the WP29. The WP29, likewise acted as an independent body, but as noted, was not granted legal personality.<ref>''Albrecht'' in Ehmann, Selmayr, Article 68 GDPR, margin number 1 (C.H. C.H. Beck 2018, 2nd  edition).</ref> The WP29's lack of legal personality contributed to what was generally seen as a fragmented application and interpretation of Directive 95/46/EC by supervisory authorities (“''SA''”).<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).</ref> As Docksey notes, imbuing the EDPB with legal personality serves to “''strengthen[s] [its] nature […] as a governing body in its own right, deriving its legitimacy directly from legislation rather than by delegation from the Commission. In practical terms it means that the Board may take action before the Courts''.”<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).</ref>
 
Having legal personality allows for the Board to make legally binding decisions, pursuant to Articles 65 and 70 GDPR.<ref>''Schiedermair'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 68 GDPR, margin number 5 (C.H. Beck 2019, 1st  edition).</ref> The EDPB’s status as an Union body is significant in terms of political  and legal accountability, as consequently, it is subject to the oversight of various bodies in the European Union's regulatory framework. These include the following, regarding legal accountability, under Article 263 TFEU, the decisions of the Board may be appealed to the General Court, and under Article 41 CFR the Board is accountable to the European Ombudsman. In terms of political accountability, the EDPB's monetary and administrative decisions are subject to the Court of Auditors pursuant to Article 287 TFEU. More generally, it is accountable to the European Parliament and its committees, in particular, the Committee on Budgetary Control and the Committee on Civil Liberties, Justice and Home Affairs.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020); Article 263 TFEU.</ref> The independent nature of the EDPB is addressed further in the commentary on Article 69 GDPR.
===(2) Chair===
The second paragraph of Article 68 establishes that the Board will be represented by a Chair. The Chair fulfils both a public and formal role. The former consists of representing the Board and its supervisory authorities at conferences, press meetings and so forth. The latter establishes the Chair as the Board's formal legal representative whose responsibilities include authorising decisions of the Board and representing the Board before the European Courts.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).</ref> The Chair's formal capacity acts in stark contrast to the WP29, which acted only in a public capacity. Articles 73 and 74 GDPR further outline the appointment and tasks of the Chair.
 
===(3) National supervisory authorities===
The WP29 was comprised of members from national supervisory authorities. However, Article 68(3) GDPR requires the Board to be composed of the heads of the national supervisory authorities. As noted by Docksey, this prerequisite “''emphasizes that the Board is intended to be a high-level body''” and “''significantly increases the ‘self-binding’ effect on national authorities of discussions and decisions by their heads at the Board''.”<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).</ref> Beyond necessitating that only the heads of national supervisory authorities may act as Board members, the GDPR does not establish further eligibility criteria for Board members. Nonetheless, the GDPR does lay down criteria regulating the eligibility of supervisory authority members in Article 53 GDPR.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).</ref> While not explicitly stated, it can be inferred from Article 68(5) GDPR that all Board members have the right to vote. Article 68(5) GDPR outlines that the Commission shall participate in the Board’s activities and meetings, without voting rights, suggesting that Board members in contrast, do have voting rights.<ref>''Albrecht'' in Ehmann, Selmayr, Article 68 GDPR, margin number 7 (C.H. Beck 2018, 2nd  edition).</ref> The supervisory authorities heads of EEA/EFTA States are members of the EDPB, but are resticted in their functions. They generally have the same obligations to the Board as the supervisory authorities of Member States, but notably, do not hold voting rights and may not stand for election as deputy chairs.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).</ref>
===(4) Joint representative===
The fourth paragraph of Article 68 GDPR provides that where a Member State has multiple supervisory authorities, a joint representative, appointed in accordance with that Member State’s law, must act as representative to the Board.<ref>''Schiedermair'', in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 68 GDPR, margin number 8 (C.H. Beck 2019, 1st  edition).</ref> 
 
===(5) European Commission===
While the Commission may participate in the EDPB’s meetings and activities, it is not a member and does not enjoy voting rights. Docksey notes that this right to participation is somewhat “''remarkable'',” and undermines the EDPB’s independent nature.<ref>''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1050 (Oxford University Press 2020).</ref> This point is discussed further in the commentary on Article 69 GDPR.
 
===(6) EDPS===
The European Data Protection Supervisor ('EDPS') holds limited voting rights in the Board on issues of dispute resolution pursuant to Article 65 GDPR. These issues concern the principles and rules applicable to the Union institutions, bodies, offices and agencies established under Regulation (EU) 2018/1725. This arrangement acts as a compromise between two opposing understandings of the EDPS' function. The first notes that the EDPS should not be entitled to vote on decisions that are not of its concern, and the second understanding, which argues that the EDPS should be treated the same as any other supervisory authority.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 68 GDPR, margin number 12 (C.H. Beck 2020, 3rd  edition); ''Docksey'', in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).</ref> Arguably, in practice the outcome of any such debate makes little difference, given that the principles and rules under Regulation 2018/1725 materially correspond to those of the GDPR. Thus, regarless the EDPS is likely to be eligible to vote in many cases.<ref>''Dix'', in Kühling, Buchner, DS-GVO BDSG, Article 68 GDPR, margin number 12 (C.H. Beck 2020, 3rd  edition).</ref>


== Decisions ==
== Decisions ==
Line 212: Line 229:
<references />
<references />


[[Category:Article 68 GDPR]] [[Category:GDPR]]
[[Category:Article 68 GDPR]] [[Category:GDPR Articles]]

Latest revision as of 10:01, 11 October 2023

Article 68 - European Data Protection Board
Gdpricon.png
Chapter 10: Delegated and implementing acts

Legal Text


Article 68 - European Data Protection Board

1. The European Data Protection Board (the ‘Board’) is hereby established as a body of the Union and shall have legal personality.

2. The Board shall be represented by its Chair.

3. The Board shall be composed of the head of one supervisory authority of each Member State and of the European Data Protection Supervisor, or their respective representatives.

4. Where in a Member State more than one supervisory authority is responsible for monitoring the application of the provisions pursuant to this Regulation, a joint representative shall be appointed in accordance with that Member State's law.

5. The Commission shall have the right to participate in the activities and meetings of the Board without voting right. The Commission shall designate a representative. The Chair of the Board shall communicate to the Commission the activities of the Board.

6. In the cases referred to in Article 65, the European Data Protection Supervisor shall have voting rights only on decisions which concern principles and rules applicable to the Union institutions, bodies, offices and agencies which correspond in substance to those of this Regulation.

Relevant Recitals

Recital 139: EDPB
In order to promote the consistent application of this Regulation, the Board should be set up as an independent body of the Union. To fulfil its objectives, the Board should have legal personality. The Board should be represented by its Chair. It should replace the Working Party on the Protection of Individuals with Regard to the Processing of Personal Data established by Directive 95/46/EC. It should consist of the head of a supervisory authority of each Member State and the European Data Protection Supervisor or their respective representatives. The Commission should participate in the Board's activities without voting rights and the European Data Protection Supervisor should have specific voting rights. The Board should contribute to the consistent application of this Regulation throughout the Union, including by advising the Commission, in particular on the level of protection in third countries or international organisations, and promoting cooperation of the supervisory authorities throughout the Union. The Board should act independently when performing its tasks.

Commentary

Article 68 GDPR addresses the nature, legal status, and internal composition of the European Data Protection Board (“EDPB”). The EDPB replaces the Article 29 Working Party (“WP29”), the former advisory body established under Directive 95/46/EC. Notably, the powers granted to the EDPB are far grater than those afforded to its predecessor. The WP29 was constrained to a purely advisory role. However, the EDPB in contrast, has been afforded a wide array duties, including the power to adopt binding decisions pursuant to Article 65 GDPR (Article 70(1)(t) GDPR).[1] Article 68 GDPR is the first of nine Articles (Articles 68-76 GDPR) governing the EDPB set forth in Section 3 of Chapter VII GDPR.

(1) Legal personality

Article 68(1) GDPR, in addition to Recital 139 GDPR, establish the EDPB as a body of the Union with legal personality. The objectives behind granting the EDPB legal personality were rooted in the perceived defficiencies of the WP29. The WP29, likewise acted as an independent body, but as noted, was not granted legal personality.[2] The WP29's lack of legal personality contributed to what was generally seen as a fragmented application and interpretation of Directive 95/46/EC by supervisory authorities (“SA”).[3] As Docksey notes, imbuing the EDPB with legal personality serves to “strengthen[s] [its] nature […] as a governing body in its own right, deriving its legitimacy directly from legislation rather than by delegation from the Commission. In practical terms it means that the Board may take action before the Courts.”[4]

Having legal personality allows for the Board to make legally binding decisions, pursuant to Articles 65 and 70 GDPR.[5] The EDPB’s status as an Union body is significant in terms of political and legal accountability, as consequently, it is subject to the oversight of various bodies in the European Union's regulatory framework. These include the following, regarding legal accountability, under Article 263 TFEU, the decisions of the Board may be appealed to the General Court, and under Article 41 CFR the Board is accountable to the European Ombudsman. In terms of political accountability, the EDPB's monetary and administrative decisions are subject to the Court of Auditors pursuant to Article 287 TFEU. More generally, it is accountable to the European Parliament and its committees, in particular, the Committee on Budgetary Control and the Committee on Civil Liberties, Justice and Home Affairs.[6] The independent nature of the EDPB is addressed further in the commentary on Article 69 GDPR.

(2) Chair

The second paragraph of Article 68 establishes that the Board will be represented by a Chair. The Chair fulfils both a public and formal role. The former consists of representing the Board and its supervisory authorities at conferences, press meetings and so forth. The latter establishes the Chair as the Board's formal legal representative whose responsibilities include authorising decisions of the Board and representing the Board before the European Courts.[7] The Chair's formal capacity acts in stark contrast to the WP29, which acted only in a public capacity. Articles 73 and 74 GDPR further outline the appointment and tasks of the Chair.

(3) National supervisory authorities

The WP29 was comprised of members from national supervisory authorities. However, Article 68(3) GDPR requires the Board to be composed of the heads of the national supervisory authorities. As noted by Docksey, this prerequisite “emphasizes that the Board is intended to be a high-level body” and “significantly increases the ‘self-binding’ effect on national authorities of discussions and decisions by their heads at the Board.”[8] Beyond necessitating that only the heads of national supervisory authorities may act as Board members, the GDPR does not establish further eligibility criteria for Board members. Nonetheless, the GDPR does lay down criteria regulating the eligibility of supervisory authority members in Article 53 GDPR.[9] While not explicitly stated, it can be inferred from Article 68(5) GDPR that all Board members have the right to vote. Article 68(5) GDPR outlines that the Commission shall participate in the Board’s activities and meetings, without voting rights, suggesting that Board members in contrast, do have voting rights.[10] The supervisory authorities heads of EEA/EFTA States are members of the EDPB, but are resticted in their functions. They generally have the same obligations to the Board as the supervisory authorities of Member States, but notably, do not hold voting rights and may not stand for election as deputy chairs.[11]

(4) Joint representative

The fourth paragraph of Article 68 GDPR provides that where a Member State has multiple supervisory authorities, a joint representative, appointed in accordance with that Member State’s law, must act as representative to the Board.[12]

(5) European Commission

While the Commission may participate in the EDPB’s meetings and activities, it is not a member and does not enjoy voting rights. Docksey notes that this right to participation is somewhat “remarkable,” and undermines the EDPB’s independent nature.[13] This point is discussed further in the commentary on Article 69 GDPR.

(6) EDPS

The European Data Protection Supervisor ('EDPS') holds limited voting rights in the Board on issues of dispute resolution pursuant to Article 65 GDPR. These issues concern the principles and rules applicable to the Union institutions, bodies, offices and agencies established under Regulation (EU) 2018/1725. This arrangement acts as a compromise between two opposing understandings of the EDPS' function. The first notes that the EDPS should not be entitled to vote on decisions that are not of its concern, and the second understanding, which argues that the EDPS should be treated the same as any other supervisory authority.[14] Arguably, in practice the outcome of any such debate makes little difference, given that the principles and rules under Regulation 2018/1725 materially correspond to those of the GDPR. Thus, regarless the EDPS is likely to be eligible to vote in many cases.[15]

Decisions

→ You can find all related decisions in Category:Article 68 GDPR

References

  1. Schiedermair, in Spiecker gen. Döhmann et al., General Data Protection Regulation, Article 68 GDPR, margin number 3 (C.H. Beck 2023, 1st edition).
  2. Albrecht in Ehmann, Selmayr, Article 68 GDPR, margin number 1 (C.H. C.H. Beck 2018, 2nd edition).
  3. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).
  4. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020).
  5. Schiedermair, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 68 GDPR, margin number 5 (C.H. Beck 2019, 1st edition).
  6. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1046 (Oxford University Press 2020); Article 263 TFEU.
  7. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).
  8. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).
  9. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1047 (Oxford University Press 2020).
  10. Albrecht in Ehmann, Selmayr, Article 68 GDPR, margin number 7 (C.H. Beck 2018, 2nd edition).
  11. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).
  12. Schiedermair, in Simitis, Hornung, Spiecker, Datenschutzrecht, Article 68 GDPR, margin number 8 (C.H. Beck 2019, 1st edition).
  13. Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1050 (Oxford University Press 2020).
  14. Dix, in Kühling, Buchner, DS-GVO BDSG, Article 68 GDPR, margin number 12 (C.H. Beck 2020, 3rd edition); Docksey, in Kuner et al., The EU General Data Protection Regulation (GDPR), Article 68 GDPR, p. 1049 (Oxford University Press 2020).
  15. Dix, in Kühling, Buchner, DS-GVO BDSG, Article 68 GDPR, margin number 12 (C.H. Beck 2020, 3rd edition).