In European Commission, supported by the European Data Protection Supervisor v Federal Republic of Germany Case C-518/07, the European Court of Justice has emphasised that the European Data Protection Directive requires that the work of data protection supervisors should be completely independent of state control.
In the judgment, issued on 9 March, the ECJ has effectively forced Germany to change the structure of its DPA system and the judgment could well have ramifications throughout the EU.
The ECJ held ‘that, by making the authorities responsible for monitoring the processing of personal data by non-public bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen) in the different Länder subject to State scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions ‘with complete independence’, the Federal Republic of Germany failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data’.
Article 28 of Directive 95/46 (Supervisory authority) provides as follows:
‘(1) Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
These authorities shall act with complete independence in exercising the functions entrusted to them.’
It was accepted that the German system allowed the State only to seek to guarantee that acts of the supervisory authorities comply with the applicable national and European Community provisions, and that it did not aim to oblige those authorities to pursue political objectives inconsistent with the protection of individuals in relation to personal data or their fundamental rights. Nevertheless, the ECJ considered that the phrase ‘complete independence’ could not be clearer and that it ‘implies a decision-making power independent of any direct or indirect external influence on the supervisory authority’.
