# COMMISSION V. GERMANY, 9.Mar.2010 (“GERMANY”)

- Type: Case Law
- Source: CJEU
- Date: 2010-03-09
- Original: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62007CJ0518
- Canonical: https://overview.legal/posts/5978
- Topics: Processing, Personal Data, Supervision, Supervisory Authorities, Public Authority, Human Resources, Public Sector, GDPR Subject-Matter and Objectives, Lawful Basis, Processing Agreement

## Summary

Independence of Supervisory Authorities: Independence means a status which ensures that the body concerned can act completely freely, without taking any instructions or being put under any pressure. The requirement of independence does not only concern the relationship between the supervisory authorities and the bodies subject to that supervision. The adjective “complete” implies a decision-making power independent of any direct or indirect external influence on the supervisory authority. DPAs m

## Sections (7)

### ¶18

With regard, in the first place, to the wording of the second subparagraph of Article 28(1) of Directive 95/46, because the words ‘with complete independence’ are not defined by that directive, it is necessary to take their usual meaning into account. In relation to a public body, the term ‘independence’ normally means a status which ensures that the body concerned can act completely freely, without taking any instructions or being put under any pressure.

> Topics: Public Authority · Applies: gdpr-art-28-par-1-en

### ¶19

Contrary to the position taken by the Federal Republic of Germany, there is nothing to indicate that the requirement of independence concerns exclusively the relationship between the supervisory authorities and the bodies subject to that supervision. On the contrary, the concept of ‘independence’ is complemented by the adjective ‘complete’, which implies a decision-making power independent of any direct or indirect external influence on the supervisory authority.

> Topics: Supervisory Authorities, Supervision

### ¶44

Thus, first, the management of the supervisory authorities may be appointed by the parliament or the government. Secondly, the legislator may define the powers of those authorities.

> Topics: Supervision

### ¶45

Furthermore, the legislator may impose an obligation on the supervisory authorities to report their activities to the parliament. In that regard, a comparison may be made with Article 28(5) of Directive 95/46 which provides that each supervisory authority is to draw up a report on its activities at regular intervals which will then be made public.

> Topics: Supervisory Authorities, Supervision · Applies: gdpr-art-28-par-5-en

### ¶46

In view of the foregoing, conferring a status independent of the general administration on the supervisory authorities responsible for the protection of individuals with regard to the processing of personal data outside the public sector does not in itself deprive those authorities of their democratic legitimacy.

> Topics: Public Authority, Public Sector, Supervision, Personal Data

### ¶47

Secondly, the principle of conferred powers enshrined in the first paragraph of Article

### ¶5

EC, also pleaded by the Federal Republic of Germany, obliges the Community to act within the limits of the powers conferred on it and of the objectives assigned to it by the EC Treaty.

## Cited law provisions (3)

### GDPR — gdpr-art-28-par-1-en

Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of this Regulation and ensure the protection of the rights of the data subject.

### GDPR — gdpr-art-28-par-5-en

Adherence of a processor to an approved code of conduct as referred to in Article 40 or an approved certification mechanism as referred to in Article 42 may be used as an element by which to demonstrate sufficient guarantees as referred to in paragraphs 1 and 4 of this Article.

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

---
Generated by overview.legal · https://overview.legal/posts/5978 · 2026-08-22