Article 53 — General conditions for the members of the supervisory authority

Article 53 GDPR deals with the people who lead or constitute a national data protection supervisory authority. It establishes minimum safeguards governing how they are appointed, what competence they must possess, when their office normally ends and when they may be dismissed early.

The provision may look administrative, but it is closely connected to regulatory independence. A supervisory authority cannot be genuinely independent if governments can appoint unqualified loyalists through secret procedures or remove members whenever their decisions become politically inconvenient. Article 53 therefore creates a basic life cycle for membership of a supervisory authority, from appointment to departure.

1. The purpose and structure of Article 53

Article 53 must be read together with Articles 51, 52 and 54:

• Article 51 requires every Member State to establish one or more independent supervisory authorities.
• Article 52 requires those authorities and their members to act with complete independence.
• Article 53 regulates the appointment, competence, ordinary departure and dismissal of members.
• Article 54 requires Member States to place detailed institutional rules in national legislation.

Article 53 addresses four stages:

1. Entry into office: a member must be appointed transparently by one of the permitted public bodies.
2. Fitness for office: the member must have adequate qualifications, experience and skills.
3. Ordinary end of office: the mandate ends through expiry, resignation or compulsory retirement under national law.
4. Exceptional early removal: dismissal is allowed only for serious misconduct or loss of the conditions required for office.

Recital 121 adds that the general conditions governing members should be established by law and links transparent appointment, integrity, avoidance of incompatible occupations and control over staff to the authority’s independence.

The provision seeks to balance two risks:

• Insufficient accountability, where an unsuitable or corrupt member cannot be removed; and
• Insufficient independence, where a member can be removed merely because the government dislikes the authority’s decisions.

Article 53 does not give members personal immunity. It gives them secure but conditional tenure.

2. Who is a “member” of a supervisory authority?

The term “member” does not ordinarily mean every employee of the authority. It refers to the senior officeholder or officeholders appointed under the Member State’s institutional structure.

Depending on national law, a supervisory authority may consist of:

• one commissioner;
• a president and several commissioners;
• a collegiate board;
• several legally designated members who decide matters collectively.

Ordinary investigators, lawyers, technologists and administrative employees are generally the authority’s staff, not its “members.” Staff are addressed particularly by Article 52(5), which requires them to remain under the exclusive direction of the authority’s member or members.

Illustration

A national authority has:

• one chairperson;
• four commissioners;
• 200 employees. If national law designates the chairperson and commissioners as the decision-making body, those five individuals are the members for Article 53. The 200 employees are staff. Their hiring and management are important to independence, but they are not appointed and removed under Article 53 merely because they work for the authority. This distinction matters because members exercise the highest statutory responsibilities. They may determine enforcement policy, adopt final decisions, impose fines, approve regulatory instruments and represent the authority in the European Data Protection Board.

3. Article 53(1): Appointment through a transparent procedure

Article 53(1) requires each member to be appointed through a transparent procedure by:

• the national parliament;
• the national government;
• the head of State; or
• an independent body entrusted with appointment under national law.

The GDPR permits Member States to choose among different constitutional approaches. It does not impose one identical appointment model across Europe.

A parliamentary republic may rely on parliament. Another state may use a government nomination followed by formal appointment by the head of State. A federal system may establish an independent selection commission. These variations are lawful if the procedure meets Article 53 and preserves the authority’s independence.

3.1 Appointment by a political body is not automatically unlawful

The fact that a government or parliament appoints the member does not itself destroy independence. Article 53 expressly permits those bodies to make the appointment.

The legal design separates:

• democratic selection of the officeholder, from
• control over the officeholder’s later decisions.

Illustration

Parliament appoints a data protection commissioner after a public competition and hearing. Once appointed, the commissioner receives a fixed term and cannot be instructed or arbitrarily removed. That structure can preserve both democratic legitimacy and operational independence. The position would be different if parliament could appoint the commissioner and then repeatedly threaten removal whenever it disagreed with an enforcement decision.

4. What does a “transparent procedure” require?

The GDPR does not provide a detailed checklist. Transparency must therefore be understood in light of the provision’s objectives:

• enabling public scrutiny;
• discouraging secret political patronage;
• allowing candidates to be evaluated against objective criteria;
• promoting confidence in the successful candidate;
• reinforcing independence.

A credible transparent procedure would commonly disclose:

• the legal basis for the appointment;
• the available position;
• eligibility and competence requirements;
• the application or nomination process;
• the selection timetable;
• the identity or composition of the selection body;
• the evaluation method;
• relevant conflict-of-interest requirements;
• the principal stages of the process;
• the final appointment and reasons, at least to an appropriate extent.

Transparency does not necessarily require publication of every confidential document or every candidate’s personal information. The candidates themselves have privacy and data protection rights. There must be a balance between public accountability and legitimate confidentiality.

Example

of a transparent process

A Member State:

1. publishes the vacancy;
2. specifies that applicants require senior legal, regulatory or technological experience;
3. appoints a diverse expert panel;
4. shortlists candidates against published criteria;
5. conducts parliamentary hearings;
6. publishes the successful candidate’s relevant qualifications;
7. records the final appointment through an official decision.

This gives the public a meaningful basis for understanding how the choice was made.

Example

of a doubtful process The government announces, without prior notice, that a political adviser has been appointed commissioner. No vacancy, criteria, shortlist, evaluation or explanation is published. Even if the adviser happens to be competent, the secrecy of the procedure creates a substantial Article 53(1) concern.

5. Must there always be an open competition and several candidates?

Article 53 does not expressly require:

• an open public competition;
• a written examination;
• a particular number of candidates;
• a public interview;
• a parliamentary confirmation hearing;
• publication of all candidate scores.

These may be excellent safeguards, but they are not stated as uniform mandatory steps in Article 53.

A nomination-based process could still be transparent if:

• the nomination power is legally defined;
• selection criteria are public;
• the candidate’s qualifications are scrutinised;
• conflicts are examined;
• the appointment decision is publicly recorded.

Conversely, a nominally open competition may still be non-transparent if the criteria are secretly changed or the panel has already decided whom to appoint.

The correct question is substantive:

Can the public understand the applicable process, the essential criteria and the institutional basis upon which the appointment was made?

6. The permitted appointing bodies

6.1 Parliament

Appointment by parliament can provide democratic visibility, especially where hearings and cross-party deliberation occur.

However, parliamentary appointment can become problematic if:

• the process is purely partisan;
• no competence assessment occurs;
• one party appoints a political loyalist without scrutiny;
• members are expected to follow party instructions after appointment.

A parliamentary vote by a simple majority is not automatically unlawful. The GDPR does not prescribe a supermajority. Nevertheless, a broader majority or cross-party process may strengthen public confidence and reduce political dependence.

6.2 Government

A government may appoint members, but must respect transparency and subsequent independence.

The government may not reason:

“Because we appointed the commissioner, the commissioner must apply our policy.”

The power to appoint does not create a power to instruct.

6.3 Head of State

Appointment by a monarch or president may be formal or substantive, depending on national constitutional law. The head of State may act upon a proposal made by another public authority.

Recital 121 expressly contemplates appointment by the parliament, government or head of State, including appointment based on proposals from specified state institutions.

6.4 Independent body

A Member State may entrust appointment to an independent body established by law.

That body must itself possess sufficient independence and legal authority. Calling a committee “independent” is not enough if government ministers secretly control its membership and decisions.

Illustration

A statutory appointments commission comprises judges, technical experts and representatives selected through objective procedures. It evaluates candidates against published criteria and appoints the commissioner. That can satisfy Article 53(1). A temporary committee created privately by the minister, whose members can be replaced at will, is much less convincing.

7. Joint or multi-stage appointment procedures

The Commentary suggests that a joint appointment involving several branches of government is not expressly described but is not necessarily prohibited.

That is a sensible reading, provided the final procedure fits within the bodies permitted by Article 53.

Illustration

The government conducts an open selection and nominates three candidates. Parliament holds hearings and selects one. The head of State formally appoints the successful candidate. This multi-stage process can be compatible with Article 53 because parliament, government and head of State are all expressly recognised. The important matters are:

• responsibility must be legally clear;
• no hidden actor should determine the result;
• the process must remain transparent;
• the arrangement must not compromise post-appointment independence.

8. Transparency does not itself guarantee independence

A procedure may be completely visible but still politically manipulative.

Illustration

A government openly states: “We will appoint only someone who promises never to fine public authorities.” The process is transparent in the literal sense, but the criterion is incompatible with the independence required by Article 52. Article 53(1) should therefore be read together with Article 52. Transparency concerns how the appointment is made. Independence concerns whether the resulting officeholder can act impartially and free from influence. A sound appointment system ideally combines:

• transparency;
• objective competence criteria;
• conflict-of-interest checks;
• secure tenure;
• protection against instructions;
• restricted dismissal grounds.

9. Article 53(2): Qualifications, experience and skills

Every member must possess the qualifications, experience and skills required to perform the authority’s tasks and exercise its powers, particularly in personal-data protection.

The words “in particular” are important. Data protection expertise is central, but it is not necessarily the only relevant competence.

A modern supervisory authority deals with:

• legal interpretation;
• public administration;
• information security;
• digital platforms;
• artificial intelligence;
• online advertising;
• biometric technologies;
• cross-border investigations;
• evidence assessment;
• litigation;
• organisational management;
• public communication.

The member need not personally be the leading expert in every field. The authority will have specialist staff. Nevertheless, the member must possess sufficient competence to direct work, evaluate advice and make informed decisions.

10. The distinction among qualifications, experience and skills

These concepts overlap but are not identical.

10.1 Qualifications

Qualifications usually refer to formally demonstrated knowledge or professional attainment, such as:

• a university degree;
• admission to a legal profession;
• technical certification;
• public-administration training;
• postgraduate specialisation;
• recognised professional credentials.

Article 53 does not expressly require every member to be a lawyer. A Member State may prescribe legal qualifications in national law, but the GDPR itself leaves room for different professional backgrounds.

10.2 Experience

Experience means practical exposure to relevant responsibilities.

This may include work in:

• privacy law;
• regulation;
• courts;
• information security;
• public administration;
• consumer protection;
• technology governance;
• compliance;
• academic research;
• management of complex investigations.

Illustration

Candidate A has a doctorate in privacy law but no experience managing staff or deciding contested cases. Candidate B has fifteen years of regulatory experience and substantial data protection work but no privacy-specific doctorate. Article 53 does not automatically prefer Candidate A. Appointment must consider the complete combination of qualifications, experience and skills required for the particular role.

10.3 Skills

Skills concern what the candidate is able to do. Relevant skills may include:

• legal reasoning;
• technological understanding;
• impartial decision-making;
• strategic leadership;
• evidence evaluation;
• communication;
• negotiation;
• crisis management;
• financial and organisational oversight;
• cross-border cooperation.

A formal degree does not prove every necessary skill. Equally, practical expertise may not be captured by academic credentials alone.

11. Must every member possess the same expertise?

Where an authority has several members, a difficult issue arises: can expertise be assessed collectively?

Article 53(2) says“each member” must possess the qualifications, experience and skills required for the role. Therefore, no member may be wholly unqualified merely because other members are experts.

However, this does not require identical professional profiles.

Illustration

A five-member authority may include:

• a data protection lawyer;
• a cybersecurity specialist;
• a public-administration expert;
• a digital-economy specialist;
• an experienced judge. Each must be capable of performing the duties of office. Their different expertise may strengthen the authority collectively. The national law should define the minimum competence expected from every member while permitting complementary specialisation.

12. How specific should national competence requirements be?

Article 54(1)(b) requires Member States to establish the qualifications and eligibility conditions for members by law.

Requirements that are too vague create a risk of political appointments. For example:

“The government may appoint any suitable person.”

This gives little assurance of objective competence.

Requirements that are too narrow may also be problematic. If national law says only career officials from one ministry can qualify, the appointment pool may become politically dependent and exclude capable specialists.

A balanced law might require:

• substantial relevant professional experience;
• demonstrated knowledge of data protection;
• integrity and independence;
• competence in law, technology, regulation or administration;
• absence of disqualifying conflicts.

12.1 No mandatory examination

The GDPR does not require a written test or professional examination. Competence may be assessed through:

• credentials;
• employment history;
• publications;
• interviews;
• hearings;
• references;
• practical achievements.

Still, a Member State must be able to show that the statutory requirements were genuinely applied. Article 53(2) should not become a box-ticking exercise.

13. Political experience and political appointments

A person with a political background is not automatically disqualified. Former ministers, legislators or political advisers may possess relevant experience.

The real questions are:

• Does the individual possess the required competence?
• Has the individual ended incompatible political roles?
• Can the individual act without party instructions?
• Are there unresolved conflicts or dependencies?
• Does the appointment procedure demonstrate genuine scrutiny?

Illustration

A former minister with substantial digital-policy expertise resigns from all party offices, completes a transparent hearing and receives a secure fixed term. That background does not necessarily violate Article 53. By contrast, a serving party official appointed without privacy expertise and expected to coordinate decisions with party leadership would create serious concerns under Articles 52 and 53.

14. Article 53(3): The ordinary end of duties

Paragraph 3 identifies three ordinary ways in which a member’s duties end:

1. expiry of the term of office;
2. resignation;
3. compulsory retirement under national law.

These are different from dismissal under paragraph 4. Paragraph 3 concerns normal or legally predetermined cessation. Paragraph 4 concerns involuntary early removal for exceptional reasons.

15. Expiry of the term of office

A member’s mandate normally ends when the legally established term expires.

Article 54 requires national law to specify:

• the duration of the term;
• whether it is renewable;
• any limits on renewal.

A fixed term promotes independence because the member knows in advance how long the office lasts. However, the design of renewal may create subtle pressure.

Illustration

A commissioner has a two-year term that may be renewed repeatedly at the government’s complete discretion. Even if lawful on paper, the commissioner may hesitate to investigate the government shortly before seeking renewal. Longer terms or carefully limited renewal mechanisms may provide stronger independence. Article 54 requires a term of at least four years, subject to transitional arrangements for initial appointments. Article 53 must consequently be read with that minimum.

15.1 Holding office after expiry

National law should address what happens if a successor has not been appointed when the term expires. Possible arrangements include:

• temporary continuation until a successor takes office;
• appointment of an acting member;
• transfer of functions to another existing member.

Any arrangement should prevent both an institutional vacuum and indefinite extension without lawful appointment.

16. Resignation

A member may voluntarily leave office before the term expires.

A genuine resignation should be:

• freely made;
• clear;
• informed;
• formally communicated;
• effective according to national law.

A resignation obtained through threats is not truly voluntary.

Illustration

A minister tells the commissioner: “Resign today, or we will publicly accuse your family of misconduct and cut the authority’s budget.” A signed resignation following that threat should not automatically be treated as an ordinary voluntary departure. It may represent disguised dismissal or unlawful interference. National law should specify:

• to whom resignation is submitted;
• whether notice is required;
• when it becomes effective;
• whether it may be withdrawn;
• how continuity is maintained.

17. Compulsory retirement

Compulsory retirement may end the mandate where national law establishes a predetermined retirement rule.

The key safeguards are foreseeability and objectivity. The rule should exist before appointment and should not be invented or altered to target a particular member.

Illustration

When a commissioner is appointed, legislation provides that all comparable officeholders retire at age 70. The commissioner reaches that age during the term. Retirement under that pre-existing general rule may fall within Article 53(3). Suppose instead that the government suddenly reduces the retirement age from 70 to 62 immediately after the commissioner begins investigating government surveillance. The rule may be general in wording but targeted in effect. That would raise a serious independence concern.

17.1 Retirement is not identical to incapacity

The supplied Commentary suggests that retirement may occur because of age or illness. That needs care.

• A predetermined compulsory retirement age may fall under paragraph 3.
• Permanent medical incapacity may instead mean that the member no longer fulfils the conditions required to perform the duties under paragraph 4.
• Temporary illness should not automatically justify retirement or dismissal.

Any medical process must respect confidentiality, non-discrimination and procedural fairness.

18. Are the paragraph 3 grounds strictly exhaustive?

The Commentary describes expiry, resignation and compulsory retirement as an exhaustive list. That is broadly useful in showing that governments cannot invent convenient grounds for ending a mandate.

However, “exhaustive” should not be taken with absolute literalism. For example, the death of a member necessarily ends the office even though death is not expressly listed. National law must also address legal impossibility and succession arrangements.

The better interpretation is:

Apart from unavoidable events and dismissal under paragraph 4, a Member State may not create discretionary early-termination routes that circumvent Article 53.

“Administrative reorganisation,” “loss of political confidence” or “policy disagreement” cannot ordinarily be used as convenient substitutes for the protected grounds.

19. Institutional restructuring and premature termination

The leading authority is Commission v Hungary. Hungary replaced the existing data protection supervisory structure and prematurely ended the serving supervisor’s six-year term. On 8 April 2014, the CJEU held that Hungary had failed to comply with the EU-law independence requirement by bringing the mandate to an early end.

The important principle is not that Member States can never reform a regulator. They may:

• merge institutions;
• redistribute administrative functions;
• rename an authority;
• change internal structures;
• modernise procedures.

But reform must respect the independence and protected tenure of serving members.

Illustration

A government wants to combine the privacy authority with a freedom-of-information authority. It could potentially:

• allow the current privacy commissioner to complete the existing term;
• transfer the commissioner to an equivalent protected role;
• create transitional safeguards preserving tenure. It should not simply abolish the office overnight, remove the commissioner and appoint a politically preferred replacement. The Garai case concerned an electronic communications regulator rather than a GDPR supervisory authority. It is therefore analogous rather than directly controlling for Article 53. The CJEU held that regulatory restructuring was not automatically prohibited, but early removal based solely on institutional reform was incompatible with independence where adequate safeguards were absent.

20. Article 53(4): Exceptional dismissal

A member may be dismissed only where:

1. the member has committed serious misconduct; or
2. the member no longer fulfils the conditions required for performance of the duties.

The word “only” is crucial. It prevents dismissal because of:

• political disagreement;
• unpopular enforcement decisions;
• refusal to follow government instructions;
• criticism of public bodies;
• lawful participation in EDPB proceedings;
• change of government;
• mere institutional restructuring;
• ordinary errors of judgment.

Paragraph 4 must be interpreted restrictively because dismissal directly threatens independence.

21. Serious misconduct

Not every mistake is serious misconduct.

The misconduct must be sufficiently grave to justify the exceptional step of involuntary removal before the normal end of the term.

Potential examples include:

• corruption or bribery;
• deliberate disclosure of confidential case information;
• serious abuse of office;
• manipulation of enforcement for personal or political purposes;
• knowingly taking instructions from a regulated company;
• serious criminal conduct affecting fitness for office;
• maintaining a prohibited incompatible occupation;
• deliberate falsification of official records;
• severe, repeated breaches of statutory duties.

Illustration

A commissioner accepts money from a technology company in exchange for closing an investigation. This is a clear case of serious misconduct. By contrast, a commissioner adopts a complex legal interpretation that a court later rejects. That is not, by itself, serious misconduct. Independent regulators must be able to make good-faith legal judgments without fear that every judicial reversal will cost them their office.

21.1 Negligence and repeated failure

A single minor error will ordinarily be insufficient. Serious or repeated negligence may be different.

Suppose a member repeatedly:

• ignores mandatory conflict rules;
• leaves highly confidential records unsecured;
• refuses to perform statutory duties;
• disregards binding court orders.

The cumulative conduct may reach the seriousness threshold, particularly after warnings and fair process.

22. No longer fulfilling the conditions of office

The second ground concerns loss of an essential condition required to perform the duties.

Possible examples include:

• permanent incapacity;
• loss of a legally required professional qualification;
• loss of an eligibility condition established by valid national law;
• acceptance of an office legally incompatible with membership;
• a permanent conflict that cannot be cured;
• legal disqualification from holding public office.

This ground must not be manipulated.

Illustration

National law requires members to retain judicial qualifications. A member is lawfully disbarred for serious professional dishonesty after a fair process. The member may no longer satisfy the statutory eligibility condition. By contrast, the government cannot add a new qualification during the member’s term solely to disqualify that individual.

22.1 Temporary inability versus permanent inability

A temporary health problem or short absence should not automatically mean that the member no longer fulfils the conditions for office.

The assessment should consider:

• likely duration;
• reasonable accommodation;
• availability of deputies;
• impact on performance;
• medical evidence;
• proportionality.

Dismissal should be a last resort where the inability is sufficiently serious and enduring.

23. Who may decide dismissal?

The GDPR does not expressly identify the dismissing authority. National law must establish the competent body and procedure under Article 54.

Possible models include:

• a court deciding dismissal;
• a court confirming a proposal by another institution;
• parliament acting under a specially protected procedure;
• an independent tribunal;
• the appointing body acting on objectively proven statutory grounds with judicial review.

The supplied Commentary suggests that parliament may not decide dismissal because a simple-majority decision would be political. That conclusion is too categorical. Article 53 does not expressly prohibit parliamentary dismissal mechanisms.

The real legal question is whether the procedure sufficiently protects against arbitrary political removal.

Relevant safeguards may include:

• precise statutory grounds;
• an independent investigation;
• a heightened voting threshold;
• a right to be heard;
• disclosure of allegations and evidence;
• a reasoned decision;
• impartial decision-makers;
• effective judicial review;
• interim protection against retaliatory suspension.

A simple vote based on “loss of confidence” would be difficult to reconcile with Article 53(4). A parliamentary decision based on proven serious misconduct under strict legal and procedural safeguards is not necessarily unlawful.

24. Procedural fairness in dismissal

Article 53 states substantive grounds but does not detail procedure. General principles of EU law, the Charter and national administrative or constitutional law may require procedural protections.

A fair dismissal process should normally provide:

• clear notice of allegations;
• adequate time to respond;
• access to relevant evidence;
• an opportunity to be heard;
• impartial assessment;
• a reasoned outcome;
• a right to challenge the decision before an independent court.

Illustration

The government dismisses a commissioner for “serious misconduct” in a one-line decree, gives no particulars and offers no appeal. Even if misconduct actually occurred, the absence of a fair and reviewable procedure would create serious legal concerns.

24.1 Suspension pending investigation

National law may permit temporary suspension in genuinely serious cases, but suspension itself can be abused as a disguised dismissal.

Safeguards should address:

• the threshold for suspension;
• who decides it;
• maximum duration;
• salary and status;
• periodic review;
• whether the authority can continue functioning;
• access to judicial challenge.

An indefinite suspension imposed whenever a member investigates the government would defeat Article 53.

25. Relationship with integrity and incompatible occupations

Recital 121 and Article 52(3) require members to act with integrity and avoid incompatible actions and occupations.

A breach may lead to different consequences depending on seriousness:

• disclosure and recusal;
• cessation of the outside activity;
• disciplinary action;
• dismissal for serious misconduct.

Illustration

A member unknowingly holds a small financial interest in a company involved in a case and promptly discloses and divests it. Proper recusal may resolve the issue. If the member deliberately conceals a major ownership interest and repeatedly manipulates decisions for that company, dismissal may be justified. Not every conflict results in dismissal. Proportionality and seriousness remain important.

26. The central grey areas

Article 53 leaves several matters primarily to national law:

• what level of publicity makes appointment transparent;
• what qualifications are sufficient;
• how experience is assessed;
• whether terms are renewable;
• detailed retirement conditions;
• the definition of serious misconduct;
• the authority competent to dismiss;
• procedural protections;
• temporary suspension;
• succession and acting appointments.

This national discretion is not unlimited. Domestic rules must preserve the effectiveness of Articles 52 and 53.

A useful test is:

Could this rule reasonably be used to reward loyalty, punish independent enforcement or replace a member for political reasons?

If the answer is yes, stronger safeguards are likely required.

27. Final interpretation

Article 53 builds the human foundation of an independent supervisory authority.

A compliant system should ensure that:

• members are selected through a publicly understandable procedure;
• appointments are based on relevant competence, not merely political loyalty;
• each member can actually perform the authority’s demanding legal, technical and regulatory functions;
• the term of office is established and respected;
• resignation is genuinely voluntary;
• retirement rules are objective and predetermined;
• institutional reform is not used to purge serving members;
• dismissal occurs only for grave and legally established reasons;
• dismissal procedures are fair, reasoned and reviewable.

In the simplest terms, Article 53 says:

Choose the regulator openly, choose someone capable, respect the promised term and remove the person early only for a genuinely serious and legally proven reason.

Its deeper purpose is to prevent two forms of regulatory capture.

The first is capture at entry, where a government secretly installs an unsuitable loyalist. The second is capture through fear, where a competent member knows that an unpopular decision could result in removal.

Transparent appointment addresses the first risk. Secure tenure and narrow dismissal grounds address the second.

Article 53 therefore does much more than regulate employment conditions. It ensures that the individuals entrusted with enforcing the GDPR are both fit to exercise public power and sufficiently protected to exercise it independently.