Αuthor: Stephanie Schiedermair

 

1. The Board shall have a secretariat, which shall be provided by the European Data Protection Supervisor.
2. The secretariat shall perform its tasks exclusively under the instructions of the Chair of the Board.
3. The staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation shall be subject to separate reporting lines from the staff involved in carrying out tasks conferred on the European Data Protection Supervisor.
4. Where appropriate, the Board and the European Data Protection Supervisor shall establish and publish a Memorandum of Understanding implementing this Article, determining the terms of their cooperation, and applicable to the staff of the European Data Protection Supervisor involved in carrying out the tasks conferred on the Board by this Regulation.
5. The secretariat shall provide analytical, administrative and logistical support to the Board.
6. The secretariat shall be responsible in particular for:

(a) the day-to-day business of the Board;

(b) communication between the members of the Board, its Chair and the Commission;

(c) communication with other institutions and the public;

(d) the use of electronic means for the internal and external communication;

(e) the translation of relevant information;

(f) the preparation and follow-up of the meetings of the Board;

(g) the preparation, drafting and publication of opinions, decisions on the settlement of disputes between supervisory authorities and other texts adopted by the Board.

 

I. Introduction

In light of the need for independence and efficiency of the EDPB, Art. 75 GDPR guarantees synergies via the provision of the secretariat by the EDPS. In this context, Art. 75 para. 4 GDPR requires (where appropriate) the creation of a Memorandum of Understanding determining the terms of their cooperation and applicable to the staff of the EDPS. This was indeed signed on 25 May 2018.

II. Legal background

Art. 29 para. 5 DPD demanded that the secretariat of the Art. 29 WP be provided by the Comm; and Art. 29 para. 6 DPD required the Art. 29 WP to implement its own rules of procedure. It is added that the proposal made by the Art. 29 WP for the Board to be equipped with its own administrative organisation had been rejected during the legislative process. If the secretariat performs tasks for the Board, it is subject exclusively to the instructions of the Chair of the Board.

The CJEU has addressed the composition of staff of the Austrian SA, as well as its budget and the way both may affect its independence in European Commission v Republic of Austria. First, it held that independence could be prejudiced, in light of the fact that the managing member of the SA (the Commissioner) was supervised by its hierarchical (administrative) superior. In the same vein, the CJEU found there could be partiality due to the subjection of the staff of the SA to the supervision of the executive. Second, despite the absence of its own budget within the administrative organization of the executive, the Court still found a sufficient level of independence. Last, the CJEU stressed that independence can be seriously affected by the right of the head of the executive to be informed on any issue and at any time about the tasks carried out by the SA.

III. Analysis

Art. 75 para. 1 demands that the secretariat of the EDPB be provided by the EDPS (contrary to the DPD requiring the Comm provide the Art. 29 WP’s secretariat). This demonstrates the GDPR’s aim to grant the EDPB’s secretariat a broader role, since the EDPS is an independent entity (both supervisory authority and EU institution) with skills and knowledge on data protection-related matters. The secretariat being provided by the EDPS further means that the EDPS, which to a considerable extent enjoys budgetary and administrative independence, is authorised to administer the budget of the secretariat.

Moreover, the staff of the secretariat is provided by the EDPS. It is noted that the GDPR does not refer to staff belonging to the EDPB or the EDPS; rather Art. 75 para. 3 refers to staff of the EDPS ‘involved in carrying out the tasks conferred on the Board’, as well as the (EDPS) staff ‘involved in carrying out tasks conferred on the European Data Protection Supervisor’. In this regard, under the Memorandum of Understanding between the EDPB and the EDPS, staff can be: persons working for the EDPS and carrying out its key activities (‘EDPS staff’); persons employed in the fields of budget, human resources and administration (‘EDPS staff’ working for both the EDPS and the EDPB); and persons responsible for other activities (administrative or logistical, for example), who work for the EDPB (‘Secretariat staff’).

 

 

 

[…]