menu MENU
arrow_back Back to the list of all Articles
Change country (Currently : Poland) language
Contact our local member in Poland mail_outline
Visit the website of GKR Legal account_balance

arrow_backPrevious Article
Article 54
Next Articlearrow_forward

Rules on the establishment of the supervisory authority

Official
Texts Guidelines Caselaw Review of
EU Regulation Review of
Nat. Regulation
Show key term(s) and Article(s) related to article 54 of the Regulation keyboard_arrow_down Hide key term(s) and Article(s) related to article 54 keyboard_arrow_up

Key words related to article 54

Show the recitals of the Regulation related to article 54 keyboard_arrow_down Hide the recitals of the Regulation related to article 54 keyboard_arrow_up

(121) The general conditions for the member or members of the supervisory authority should be laid down by law in each Member State and should in particular provide that those members are to be appointed, by means of a transparent procedure, either by the parliament, government or the head of State of the Member State on the basis of a proposal from the government, a member of the government, the parliament or a chamber of the parliament, or by an independent body entrusted under Member State law. In order to ensure the independence of the supervisory authority, the member or members should act with integrity, refrain from any action that is incompatible with their duties and should not, during their term of office, engage in any incompatible occupation, whether gainful or not. The supervisory authority should have its own staff, chosen by the supervisory authority or an independent body established by Member State law, which should be subject to the exclusive direction of the member or members of the supervisory authority.

Show the recitals of the Directive related to article 54 keyboard_arrow_down Hide the recitals of the Directive related to article 54 keyboard_arrow_up

(62) Whereas the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of personal data;

The GDPR

Article 54 requires that Member States provide by law the conditions of establishment of the supervisory authorities. Each Member State sets the terms of appointment of the members both in regards to the appointment procedure and to the skills required, the term of office, and the prohibitions of employment or activities.

Thus, each Member State must provide by law (Art. 54 (1)):

- the establishment of each supervisory authority (a);

- the qualifications and eligibility conditions required to be appointed as member of each supervisory authority (b);

- the rules and procedures for the appointment of the member or members of each supervisory authority (c);

- the duration of the term of the member or members of each supervisory authority (that cannot be less than four years) and whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment (e); The duration of the first appointment after the entry of the Regulation in force may be less than 4 years where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure (d);

- the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment (f).

Finally, the last paragraph of Article 54 imposes that the member or members and the staff of each supervisory authority shall be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers as already provided by the Directive in its Article 28 (7).  This duty of professional secrecy is applied in particular with respect to reporting by natural persons of infringements of this Regulation (paragraph 2).

The Directive

As already indicated, the Directive says very little about the terms of appointment and the status applicable to the members of the supervisory authority as well as the modes for establishment of the supervisory authorities; at most, Article 28 (7) of the Directive imposed an obligation on the Member States to ensure that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.

Potential issues

We do not see a priori any specific implementation difficulties.

arrow_back Previous Article • Article 54 • Next Article arrow_forward
arrow_back Previous Article • Article 54 Next Article arrow_forward

Summary

European Union

European Union

Retour au sommaire

Article 29 Working Party

Guidelines on the Lead Supervisory Authority - wp244rev.01 (5 April 2017)

(Endorsed by the EDPB)

Identifying a lead supervisory authority is only relevant where a controller or processor is carrying out the cross-border processing of personal data. Article 4(23) of the General Data Protection Regulation (GDPR) defines ‘cross-border processing’ as either the:

- processing of personal data which takes place in the context of the activities of establishments in more than one Member State of a controller or processor in the Union where the controller or processor is established in more than one Member State; or the

- processing of personal data which takes place in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

This means that where an organisation has establishments in France and Romania, for example, and the processing of personal data takes place in the context of their activities, then this will constitute cross-border processing.

Alternatively, the organisation may only carry out processing activity in the context of its establishment in France. However, if the activity substantially affects – or is likely to substantially affect - data subjects in France and Romania then this will also constitute crossborder processing.

Link

Retour au sommaire
arrow_back Previous Article • Article 54 Next Article arrow_forward

Summary

European Union

European Union

CJEU caselaw

C-518/07 (9 March 2010) - Commission v Germany

1.      Declares that, by making the authorities responsible for monitoring the processing of personal data by non-public bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen) in the different Länder subject to State scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions ‘with complete independence’, the Federal Republic of Germany failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

2.      Orders the Federal Republic of Germany to pay the costs of the Commission;

3.      Orders the European Data Protection Supervisor (EDPS) to bear his own costs.

Opinion of Advocate general 

Judgment of the Court

C-614/10 (16 October 2012) -  Commission v Austria

1.      Declares that, by failing to take all of the measures necessary to ensure that the legislation in force in Austria meets the requirement of independence with regard to the Datenschutzkommission (Data Protection Commission), more specifically by laying down a regulatory framework under which

–        the managing member of the Datenschutzkommission is a federal official subject to supervision,

–        the office of the Datenschutzkommission is integrated with the departments of the Federal Chancellery, and

–        the Federal Chancellor has an unconditional right to information covering all aspects of the work of the Datenschutzkommission,

the Republic of Austria has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

2.      Orders the Republic of Austria to pay the costs incurred by the European Commission;

3.      Orders the Federal Republic of Germany and the European Data Protection Supervisor to bear their own respective costs.

Opinion of Advocate general 

Judgment of the Court

C-230/14 (1 October 2015) - Weltimmo

1.      Article 4(1)(a) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data must be interpreted as permitting the application of the law on the protection of personal data of a Member State other than the Member State in which the controller with respect to the processing of those data is registered, in so far as that controller exercises, through stable arrangements in the territory of that Member State, a real and effective activity — even a minimal one — in the context of which that processing is carried out.

In order to ascertain, in circumstances such as those at issue in the main proceedings, whether that is the case, the referring court may, in particular, take account of the fact (i) that the activity of the controller in respect of that processing, in the context of which that processing takes place, consists of the running of property dealing websites concerning properties situated in the territory of that Member State and written in that Member State’s language and that it is, as a consequence, mainly or entirely directed at that Member State, and (ii) that that controller has a representative in that Member State, who is responsible for recovering the debts resulting from that activity and for representing the controller in the administrative and judicial proceedings relating to the processing of the data concerned.

By contrast, the issue of the nationality of the persons concerned by such data processing is irrelevant.

2.      Where the supervisory authority of a Member State, to which complaints have been submitted in accordance with Article 28(4) of Directive 95/46, reaches the conclusion that the law applicable to the processing of the personal data concerned is not the law of that Member State, but the law of another Member State, Article 28(1), (3) and (6) of that directive must be interpreted as meaning that that supervisory authority will be able to exercise the effective powers of intervention conferred on it in accordance with Article 28(3) of that directive only within the territory of its own Member State. Accordingly, it cannot impose penalties on the basis of the law of that Member State on the controller with respect to the processing of those data who is not established in that territory, but should, in accordance with Article 28(6) of that directive, request the supervisory authority within the Member State whose law is applicable to act.

3.      Directive 95/46 must be interpreted as meaning that the term ‘adatfeldolgozás’ (technical manipulation of data), used in the Hungarian version of that directive, in particular in Articles 4(1)(a) and 28(6) thereof, must be understood as having the same meaning as that of the term ‘adatkezelés’ (data processing).

Opinion of Advocate general 

Judgment of the Court

Retour au sommaire Retour au sommaire
arrow_back Previous Article • Article 54 Next Article arrow_forward
Regulation
1e 2e

Art. 54

1.   Each Member State shall provide by law for all of the following:

a) the establishment of each supervisory authority;

b) the qualifications and eligibility conditions required to be appointed as member of each supervisory authority;

c) the rules and procedures for the appointment of the member or members of each supervisory authority;

d) the duration of the term of the member or members of each supervisory authority of no less than four years, except for the first appointment after 24 May 2016, part of which may take place for a shorter period where that is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;

e) whether and, if so, for how many terms the member or members of each supervisory authority is eligible for reappointment;

f) the conditions governing the obligations of the member or members and staff of each supervisory authority, prohibitions on actions, occupations and benefits incompatible therewith during and after the term of office and rules governing the cessation of employment.

2.   The member or members and the staff of each supervisory authority shall, in accordance with Union or Member State law, be subject to a duty of professional secrecy both during and after their term of office, with regard to any confidential information which has come to their knowledge in the course of the performance of their tasks or exercise of their powers. During their term of office, that duty of professional secrecy shall in particular apply to reporting by natural persons of infringements of this Regulation.
1st proposal close

Art. 49

Each Member State shall provide by law within the limits of this Regulation:

(a)     the establishment and status of the supervisory authority;

(b)     the qualifications, experience and skills required to perform the duties of the members of the supervisory authority;

(c)     the rules and procedures for the appointment of the members of the supervisory authority, as well the rules on actions or occupations incompatible with the duties of the office;

(d)     the duration of the term of the members of the supervisory authority which shall be no less than four years, except for the first appointment after entry into force of this Regulation, part of which may take place for a shorter period where this is necessary to protect the independence of the supervisory authority by means of a staggered appointment procedure;

(e)     whether the members of the supervisory authority shall be eligible for reappointment;

(f)      the regulations and common conditions governing the duties of the members and staff of the supervisory authority;

(g)     the rules and procedures on the termination of the duties of the members of the supervisory authority, including in case that they no longer fulfil the conditions required for the performance of their duties or if they are guilty of serious misconduct.
2nd proposal close

1. Chaque État membre prévoit, par voie législative:

a) la création (…) de chaque autorité de contrôle;

b) les qualifications (...) requises pour exercer les fonctions de membre de l'autorité de contrôle;

c) les règles et les procédures pour la nomination du membre ou des membres de chaque autorité de contrôle (…);

d) la durée du mandat du membre ou des membres de chaque autorité de contrôle, qui ne doit pas être (…) inférieure à quatre ans, sauf pour le premier mandat suivant l'entrée en vigueur du présent règlement, qui peut être d'une durée plus courte lorsque cela est nécessaire pour protéger l'indépendance de l'autorité de contrôle au moyen d'une procédure de nominations échelonnées;

e) le caractère renouvelable ou non renouvelable du mandat du membre ou des membres de chaque autorité de contrôle et, dans l'affirmative, pour combien de mandats;

f) (...) les conditions régissant les obligations du membre ou des membres et des agents de chaque autorité de contrôle, les interdictions d'activités ou d'emplois incompatibles avec celles-ci, y compris après la cessation de leurs activités, et les règles régissant la cessation de l'emploi;

g) (…).

2. Le membre ou les membres et les agents de chaque autorité de contrôle sont soumis, conformément au droit de l'Union ou à la législation nationale, au secret professionnel concernant toute information confidentielle dont ils ont eu connaissance dans l'exercice de leurs fonctions (…) ou de leurs pouvoirs, y compris après la cessation de leurs activités.
Directive close

Art. 28

1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.

3. Each authority shall in particular be endowed with:

- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

5. Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

6. Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

7. Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.
Poland
compare_arrows
visibility Old law

Entered into force on May 25, 2018:

The Act of May 10, 2018 on Personal Data Protection

 

Art. 34. 1. The President of the Office is the competent authority for the protection of personal data.
[...]

3. The President of the Office shall be appointed and recalled by the Sejm of the Republic of Poland (the lower house of the Polish parliament) with the consent of the Senate of the Republic of Poland.

4. A person may be appointed as the President of the Office who:

  1. is a Polish citizen;
  2. has a university degree;
  3. is distinguished by legal knowledge and experience in the field of personal data protection;
  4. enjoys full public rights;
  5. has not been convicted by a valid sentence for intentional crime or intentional fiscal offense;
  6. has a good reputation.

5. With regard to the performance of the duties entrusted to the President of the Office, he shall be solely subject to the provisions governed only by the Act

6. The term of office of the President of the Office lasts 4 years, counting from the date of taking the oath. The President of the Office shall, after the expiry of his term of office, perform his duties until a new President of the Office takes up his position.

7. The same person cannot be the President of the Office for more than two terms.

8. The term of office of the President of the Office expires upon his death, revocation or loss of Polish citizenship.

9. The President of the Office may be dismissed before the end of the term of office only if:

  1. he resigned his position;
  2. he became permanently unable to perform his duties as a result of illness confirmed by a medical certificate;
  3. he broke off his oath;
  4. he was sentenced by a valid court sentence for committing a deliberate crime or intentional fiscal offense;
  5. he was deprived of public rights.

10. In the event of expiry of the term of office of the President of the Office, his duties are performed by the Deputy President of the Office indicated by the Marshal of the Sejm.
Old law close

In force until May 25, 2018:

The Act on Personal Data Protection (please see Art. 53)
Bulgaria close

Personal Data Protection Act

Article 7.

(1) The Commission is a collegial body, consisting of a chairman and four members.

(2) (Last Amendment, SG No. 91/2006) The members of the Commission and its chairman are elected by the National Assembly upon proposal of the Council of Ministers for a five-year term and they may be re-elected for one more term of office.

[…]

Article 8. (Last Amendment - SG No. 97/2010 in force as of 1012.2010)

(1) Eligible members of the Commission may be Bulgarian citizens who:

1. have a university degree in Informatics, Law or are Masters in Information Technology

2. have at least ten years of service in their subject;

3. (Last Amendment, SG No. 103/2005) have not been convicted to imprisonment for premeditated crimes regardless they have been rehabilitated.

(2) Members of the Commission may not:

1. (Last Amendment, SG No. 103/2005) be persons who are sole traders, managers/procurators or members of management or supervisory bodies of commercial undertakings, cooperatives or personal data controllers in the meaning of this Act;

2. occupy other paid jobs, except for scientific or teaching activity;

3. (New, SG No42/2009) be persons who are spouses or are in factual living together, relatives of a direct line of descent, collateral line of descent to the fourth line inclusive, or by marriage up to second line inclusive with another member of the Commission.

(3) As a Chairman of the Commission is elected a qualified lawyer who meets the requirements of Para 1 and 2.

(4) The term of office of the chairman or of a member of the Commission is terminated earlier in any of the following cases:

1. death or legal incapacity;

2. upon a decision of the National Assembly, where:

(a) an application for exemption from duties has been filed;

(b) the person has committed a gross violation of this Act;

(c) the person has committed a premeditated crime for which a final verdict has been issued;

(d) impossibility to perform his/her duties for more than six months.

(e) (Last Amendment - SG No. 97/12010 in force as of 1012.2010) there is an act entered into force which has established a conflict of interest under the Prevention and Identification of Conflicts of Interests Act.

(5) (Last Amendment, SG No. 103/2005) In the cases referred to in Para 4, the Council of Ministers proposes to the National Assembly to elect a new member for the period until the end of the initial term of office of the respective member of the Commission.
arrow_back Previous Article • Article 54 Next Article arrow_forward
close

2016 - www.itiplaw.eu.