C-288/12 - European Commission v Hungary

Facts — On 29 September 2008, Mr Jori was appointed Data Protection Supervisor for a 6 year term, which would terminate around the end of September 2014. However, Mr Jori was asked to vacate the office on 31 December 2011. Upon proposal by the Hungarian Prime Minister, Mr Peterfalvi was appointed as Head Authority for a term of nine years. Advocate General Opinion — The AG considers that the European Commission does not dispute in any way the right of Hungary to modify its institutional set up for its data protection authority. The issue disputed is that, in changing the institutional set up, Hungary failed to fulfil its obligation to respect the independence of their supervisor by terminating its employment before the beginning of their term. Article 28(1) Dir.95/46 puts forward the need for supervision of the personal data protection by an independent authority as an essential component of the protection of individual in personal data processing.

As found by the CJEU in C-518/07, the term “with complete independence” is interpreted broadly and autonomously in light of the objective to ensure the effectiveness and reliability of the supervision of data protection compliance. Moreover, the guarantee of independence is established not to grant a special status to those authorities themselves as well as their agents but rather to strengthen the protection of individuals and bodies affected by their decisions. Still from CJEU in C-518/07, the CJEU held that actions that may lead to “prior compliance” would not be consistent with the requirement of “complete independence” which Member States must guarantee their supervisory authority. The AG shares the European Commission’s view that independence of an authority must involve a term of office of predetermined duration and that his tenure must be assured until that term of office expires, unless this is precluded for overriding reasons, pre-determined by law and objectively verifiable.

Such an intrinsic link between security of tenure throughout the term of office and the “complete independence” requirement is indisputable. Similarly, the independence of a judge cannot be said to be respected if their duties are prematurely terminated under cover of the dismantling of the court in which he sits and its replacement by another court, even if such court is accorded independence. The mere risk that an authority may be compelled to vacate office may expose the authority to which Article 28(1) Dir.95/46 refers to “undue intervention or pressure” and led to a form of “prior compliance” on its part. So, even if Member States have a measure of discretion to establish their institutional structure, it cannot be denied that “complete independence” as required under EU law is predicated under the existence and observance of specific and detailed rules which dispel any reasonable doubt as to the imperviousness of that authority to external factors that, directly or indirectly, may influence the authority’s decisions.

Even if the Authority has a different legal status from the Supervisor and operates in accordance with different rules, it has succeeded the Supervisor in the exercise of the tasks attributed to the supervisory authority under Article 28 Dir.95/46. In relation to the claim that institutional change was decided by the constitutional authority, it is clear from the documents before the court that the Authority itself was created by “organic law”. Moreover, institutional changes cannot compromise the effectiveness of the higher obligations imposed by EU law as regards the guarantee of “complete independence”, since the primacy of EU law applied whatever the nature of the national rule at stake. Such changes cannot justify compelling the data protection Supervisor to vacate office before serving his full term. The AG thus concludes its analysis, by claiming that, by prematurely bringing to an end the term to be served by the data protection supervisory authority, Hungary failed to fulfil the obligations of Article 28 Dir.95/46.

Holding — The CJEU started its analysis by stating that Article 28(1) Dir.95/46 requires Member States to set up one or more supervisory authorities with complete independence in the exercise of the duties entrusted to them. The obligation to have an independent Supervisory Authority to ensure compliance with data protection law stems directly from primary law of the EU, i.e. Article 8(3) CFR and Article 16(2) TFEU. Having an independent supervisory authority is thus an essential protection of individuals, as confirmed in C-518/07 Commission v Germany. The CJEU decided that the relevant aspect to be examined whether the requirements of Article 28(1) Dir.95/46 to ensure that each supervisory authority is able to carry out the tasks entrusted to it in complete independence entails an obligation for the Member States concerned to allow that authority to serve its full term in office. This provision shall be interpreted as meaning that supervisory authority responsible for supervising the processing of personal data must enjoy an independence allowing them to perform their duties free from external influence.

The CJEU previously held that the risk that a Member States’ scrutinizing authorities could exercise a political influence over the decisions of the supervisory authorities is enough to hinder the latter in the independent performance of their tasks due to the following. First, those authorities could exercise “prior compliance”. Second, Article 28(1) Dir.95/46 requires that the supervisory authority’s decisions remain above each suspicion of partiality. In fact, if it was permitted for all Member States to compel a supervisory authority to vacate office before serving its full term, the threat of such premature termination to which that authority would be exposed throughout its term of office could lead it to enter into a form of prior compliance with the political authority, which would completely undermine the requirement of independence. In such a situation, the supervisory authority cannot be regarded as being able to operate impartially.

In fact, Article 28(1) Dir.95/46 entails that the independence requirement shall be construed so that the supervisory authority can operate above all suspicions of partiality. Thus, the CJEU highlighted that the independence requirement shall cover the obligation to allow the supervisory authority to serve their full time in office and to have them vacate the office before expiry of the full term only in accordance with the rules and safeguards established by the applicable legislation. As per Article 15(1) Law of 1993, the Supervisor can be called to resign from office only if their term expire, upon death, resignation, declaration of a conflict of interest, compulsory retirement or resignation. These last grounds require a Parliament decision adopted by a two-thirds majority. The CJEU clearly stated that none of these grounds apply to the disputed dismissal and that Hungary obliged the Supervisor to vacate office in contravention of the safeguards established to protect his term of office, consequently compromising their independence as per Article 28(1) Dir.95/46.

The claim advanced by Hungary that this dismissal related to an institutional change is also not applicable to the case at hand, according to the CJEU. More specifically, the CJEU considered that, when Member States implement institutional changes, they must ensure that the independence of the supervisory authority under Article 28(1) GDPR is not compromised. This holds particularly true due to the fact that the Supervisor and the subsequently-established Authority are entrusted with identical tasks. Thus, by prematurely ending to end the term served by the supervisory authority for the protection of personal data, Hungary failed to fulfil its obligations under Dir.95/46/EC on the protection of individuals with regards to the processing of personal data on the free movement of such data. Holding — The CJEU started its analysis by stating that Article 28(1) Dir.95/46 requires Member States to set up one or more supervisory authorities with complete independence in the exercise of the duties entrusted to them.

The obligation to have an independent Supervisory Authority to ensure compliance with data protection law stems directly from primary law of the EU, i.e. Article 8(3) CFR and Article 16(2) TFEU. Having an independent supervisory authority is thus an essential protection of individuals, as confirmed in C-518/07 Commission v Germany. The CJEU decided that the relevant aspect to be examined whether the requirements of Article 28(1) Dir.95/46 to ensure that each supervisory authority is able to carry out the tasks entrusted to it in complete independence entails an obligation for the Member States concerned to allow that authority to serve its full term in office. This provision shall be interpreted as meaning that supervisory authority responsible for supervising the processing of personal data must enjoy an independence allowing them to perform their duties free from external influence. The CJEU previously held that the risk that a Member States’ scrutinizing authorities could exercise a political influence over the decisions of the supervisory authorities is enough to hinder the latter in the independent performance of their tasks due to the following.

First, those authorities could exercise “prior compliance”. Second, Article 28(1) Dir.95/46 requires that the supervisory authority’s decisions remain above each suspicion of partiality. In fact, if it was permitted for all Member States to compel a supervisory authority to vacate office before serving its full term, the threat of such premature termination to which that authority would be exposed throughout its term of office could lead it to enter into a form of prior compliance with the political authority, which would completely undermine the requirement of independence. In such a situation, the supervisory authority cannot be regarded as being able to operate impartially. In fact, Article 28(1) Dir.95/46 entails that the independence requirement shall be construed so that the supervisory authority can operate above all suspicions of partiality. Thus, the CJEU highlighted that the independence requirement shall cover the obligation to allow the supervisory authority to serve their full time in office and to have them vacate the office before expiry of the full term only in accordance with the rules and safeguards established by the applicable legislation.

As per Article 15(1) Law of 1993, the Supervisor can be called to resign from office only if their term expire, upon death, resignation, declaration of a conflict of interest, compulsory retirement or resignation. These last grounds require a Parliament decision adopted by a two-thirds majority. The CJEU clearly stated that none of these grounds apply to the disputed dismissal and that Hungary obliged the Supervisor to vacate office in contravention of the safeguards established to protect his term of office, consequently compromising their independence as per Article 28(1) Dir.95/46. The claim advanced by Hungary that this dismissal related to an institutional change is also not applicable to the case at hand, according to the CJEU. More specifically, the CJEU considered that, when Member States implement institutional changes, they must ensure that the independence of the supervisory authority under Article 28(1) GDPR is not compromised.

This holds particularly true due to the fact that the Supervisor and the subsequently-established Authority are entrusted with identical tasks. Thus, by prematurely ending to end the term served by the supervisory authority for the protection of personal data, Hungary failed to fulfil its obligations under Dir.95/46/EC on the protection of individuals with regards to the processing of personal data on the free movement of such data. Comment — Share your comments here!