Public Authority

Legal Framework

The GDPR treats public authorities as a distinct category of controller, subject to specific obligations and exemptions. Article 4(7) defines a controller broadly to include any "natural or legal person, public authority, agency or other body," meaning government bodies at every level fall within scope. Article 37(1)(a) mandates that public authorities designate a Data Protection Officer, with one notable carve-out:

"the processing is carried out by a public authority or body, except for courts acting in their judicial capacity"
— GDPR Art. 37(1)(a)

Article 37(3) further permits a single DPO to serve multiple public authorities, reflecting the practical reality of governmental organisational structures. Article 27(2)(b) exempts public authorities from the requirement to designate an EU representative when they are established outside the Union — a recognition that sovereign functions differ from commercial data processing. Article 86 provides the critical reconciliation mechanism between transparency obligations and data protection rights, allowing disclosure of personal data in official documents where Union or Member State law permits public access.

Key Developments

The Court of Justice has begun shaping the boundaries of Article 86, particularly in L. H. v Ministerstvo zdravotnictví, where the Court addressed whether public authorities must inform and consult data subjects before disclosing official documents containing personal data. The Court held that such a prior consultation obligation is compatible with the GDPR, provided it does not impose disproportionate burdens:

"Article 6(1)(c) and (e) of the GDPR does not preclude, in principle, national case-law which lays down an obligation to inform and consult the data subject before any disclosure of personal data concerning him or her"
— L. H. v Ministerstvo zdravotnictví ¶45

The Court further specified that this obligation must be implementable and must not result in a disproportionate restriction on public access (¶48). This establishes a proportionality test that public authorities must apply on a case-by-case basis.

On the enforcement side, the Dutch DPA (AP) has acted decisively against municipalities that processed special category data without a legal basis. In the Municipality of Ede, Gooise Meren, Haarlemmermeer, and Hilversum cases, the AP found that force field analysis methods mapping social structures and key figures constituted unlawful processing of religious and political beliefs under Article 9 without an adequate legal basis under Article 6(1).

Status of the Debate

This topic is actively contested. The GDPR provides no definition of "public authority or body," leaving the concept to be determined under Member State law — a gap the EDPB has acknowledged. The boundaries are particularly unclear for hybrid entities that exercise public authority functions while operating with private-law characteristics, as illustrated by the Dutch Waterschapsbedrijf Limburg case involving a public body with tax-collection powers. The Article 86 reconciliation mechanism remains underdeveloped: courts have established a proportionality framework for pre-disclosure consultation, but the specific thresholds — when consultation becomes "impossible to implement" or requires "disproportionate effort" — await further judicial clarification. No court split is on record yet, but the tension between national transparency regimes and GDPR data subject rights will generate continued litigation.

Practical Guidance

• Mandatory DPO designation: Every public authority must appoint a DPO under Article 37(1)(a); leverage the shared-DPO mechanism in Article 37(3) for smaller or structurally linked bodies.
• Article 86 disclosure protocol: Before disclosing official documents containing personal data, implement a proportionality assessment — inform and consult the data subject unless doing so is impossible or requires disproportionate effort, per L. H. v Ministerstvo zdravotnictví.
• Special category data prohibition: Do not use analytical methods (such as force field analysis) that infer religious, political, or other special category data without an explicit Article 9 legal basis — the AP has enforced this against multiple municipalities.
• Legal basis specificity: Ensure each processing activity by a public authority is anchored in a specific Member State law authorising the processing under Article 6(1)(c) or (e), not merely a general institutional mandate.
• Hybrid entity classification: For entities exercising delegated public authority (e.g., water boards, quasi-governmental bodies), document the legal basis for "public authority" status under national law, as this determines DPO obligations, representative exemptions, and applicable transparency rules.