C-614/10 - Commission v. Austria

They argued that this was contrary to the criterion of independence set out in the second subparagraph of Article 28(1) Directive 95/46/EC, as staff members were subject to the supervision of the Chancellery. The Republic of Austria argued that the requirement of set by the second subparagraph of Article 28(1) Directive 95/46/EC relates to “functional independence” and that the DSK had such independence, since § 37(1) of the then-in force Austrian Data Protection Code (Datenschutzgesetz - DSG 2000) provided for its members to be independent and not to be bound by instructions given by the government. It pointed out that the managing member did not necessarily need to be a member of the Chancellery and could be chosen among lawyers working in the federal public administration. Holding — Firstly, the court noted that Article 8(3) CFR, Article 16(2) TFEU and Article 28(1) Directive 95/46/EC require Member States to have a supervisory authority which have complete independence.

The court found that the independence of the supervisory authority is an essential component of the protection of individuals with regard to the processing of personal data. Secondly, the court set aside the argument of the Republic of Austria that the DSK has a sufficient degree of independence since it satisfied the condition of independence inherent in Article 267 TFEU for it to qualify as a court or tribunal of a Member State. The court held that the notion of “complete independence” under data protection law is autonomous and independent from the one under Article 267 TFEU. Thirdly, the court gave its interpretation of the concept of “complete independence” set by Article 28(1) Directive 95/46/EC. To do that, the court referred to its previous judgement C-518/07, Commission v. Germany. In this judgement, it had held that this concept should be interpreted as meaning that the supervisory authorities must enjoy an independence which allows them to perform their duties free from any external influence, direct or indirect, which is liable to have an effect on their decisions.

Applying this principle to the case at hand, the court found that the requisite of functional independence, like the one accorded to the DSK, is a condition which is essential to have a “complete independence”. However, this condition by itself is not sufficient to protect that supervisory authority from all external influence. On the contrary, according to the court, some pieces of Austrian legislation did not allow the DSK to be completely free from any indirect influence. For example, according to § 36(3) and § 38(1) DSG 2000 the managing member of the DSK is a federal official. Moreover, § 45(1) of the 1979 Law on the conditions of service of officials (Beamten-Dienstrechtsgesetz 1979 - BDG 1979) grants the hierarchical superior an extensive power of supervision over their officials and to encourage the promotion of their staff. Furthermore, the court held that the fact that the staff of the DSK was composed by federal officials was not compliant with the independence requirement, given that these officials are subject to supervision by the Federal Chancellery within the terms of § 45(1) BDG 1979.

Finally, the court noted that the Federal Chancellor has the right to be informed at all times by the chairman and the managing member of all aspects of the work of the DSK, according to Article 20(2) of the Federal Constitutional Law (Bundes Verfassungsgesetz – BVG) and § 38(2) DSG 2000. On this matter, the court ruled that such a right to information is also liable to subject the DSK to indirect influence, given that it is far-reaching as it covers “all aspects of the work of the DSK” and that it is unconditional. On these grounds, the CJEU held that, by failing to take all of the measures necessary to ensure that the legislation in force in Austria meets the requirement of independence, the Republic of Austria has failed to fulfil its obligations under Article 28(1) Directive 95/46/EC. Holding — Firstly, the court noted that Article 8(3) CFR, Article 16(2) TFEU and Article 28(1) Directive 95/46/EC require Member States to have a supervisory authority which have complete independence.

The court found that the independence of the supervisory authority is an essential component of the protection of individuals with regard to the processing of personal data. Secondly, the court set aside the argument of the Republic of Austria that the DSK has a sufficient degree of independence since it satisfied the condition of independence inherent in Article 267 TFEU for it to qualify as a court or tribunal of a Member State. The court held that the notion of “complete independence” under data protection law is autonomous and independent from the one under Article 267 TFEU. Thirdly, the court gave its interpretation of the concept of “complete independence” set by Article 28(1) Directive 95/46/EC. To do that, the court referred to its previous judgement C-518/07, Commission v. Germany. In this judgement, it had held that this concept should be interpreted as meaning that the supervisory authorities must enjoy an independence which allows them to perform their duties free from any external influence, direct or indirect, which is liable to have an effect on their decisions.

Applying this principle to the case at hand, the court found that the requisite of functional independence, like the one accorded to the DSK, is a condition which is essential to have a “complete independence”. However, this condition by itself is not sufficient to protect that supervisory authority from all external influence. On the contrary, according to the court, some pieces of Austrian legislation did not allow the DSK to be completely free from any indirect influence. For example, according to § 36(3) and § 38(1) DSG 2000 the managing member of the DSK is a federal official. Moreover, § 45(1) of the 1979 Law on the conditions of service of officials (Beamten-Dienstrechtsgesetz 1979 - BDG 1979) grants the hierarchical superior an extensive power of supervision over their officials and to encourage the promotion of their staff. Furthermore, the court held that the fact that the staff of the DSK was composed by federal officials was not compliant with the independence requirement, given that these officials are subject to supervision by the Federal Chancellery within the terms of § 45(1) BDG 1979.

Finally, the court noted that the Federal Chancellor has the right to be informed at all times by the chairman and the managing member of all aspects of the work of the DSK, according to Article 20(2) of the Federal Constitutional Law (Bundes Verfassungsgesetz – BVG) and § 38(2) DSG 2000. On this matter, the court ruled that such a right to information is also liable to subject the DSK to indirect influence, given that it is far-reaching as it covers “all aspects of the work of the DSK” and that it is unconditional. On these grounds, the CJEU held that, by failing to take all of the measures necessary to ensure that the legislation in force in Austria meets the requirement of independence, the Republic of Austria has failed to fulfil its obligations under Article 28(1) Directive 95/46/EC. Comment — Share your comments here!