The Court of Justice of the European Union has ruled that the independence of the authorities responsible for the protection of personal data requires Member States to allow those authorities to serve their full term of office.
In 2008, András Jóri was appointed as the Hungarian Data Protection Supervisor for a term of six years. However, with effect from 1 January 2012, the Hungarian Parliament decided to reform the data protection system and replace the Supervisor with a national authority for data protection and freedom of information. Accordingly, Mr Jóri had to vacate office before his full term had expired and was replaced by Mr Attila Péterfalvi, who was appointed as Head of the new Authority for a term of nine years. The Hungarian legislation in force before 1 January 2012 allowed for the premature bringing to an end of the term served by the Supervisor for the protection of personal data inter alia only if the Supervisor was incapable of carrying out his duties for an extended period, he failed to meet his obligation to declare his assets, he was found guilty of an offence by a final judgment of a criminal court or there was a declaration of a conflict of interest.
Taking the view that to compel Mr Jóri to vacate office before serving his full term was in breach of Directive 95/46 (under which the independence of the authorities responsible for the protection of personal data is to be guaranteed), the Commission brought an action against Hungary for failure to fulfil its obligations. The European Data Protection Supervisor was granted leave to intervene in support of the form of order sought by the Commission.
In its judgment the CJEU points out that the supervisory authorities established in accordance with Directive 95/46 must be allowed to perform their duties free from external influence. That requirement implies, on the one hand, that those authorities must not be bound by instructions of any kind in the performance of their duties and, on the other, that their decision-taking process must be free from political influence, it being necessary to dispel even the risk of such influence. If it were permissible for a Member State to compel a supervisory authority to vacate office before serving its full term, in contravention of the rules and safeguards established in that regard by the legislation applicable2, that authority might be prompted to enter into a form of prior compliance with political powers. Consequently, the independence of supervisory authorities necessarily covers the obligation to allow them to serve their full term of office and to cause them to vacate office before expiry of the full term only in accordance with the applicable legislation.
That interpretation is supported, moreover, by the rules applicable to the circumstances in which the term served by the European Data Protection Supervisor may be prematurely brought to an end. The term served by the European Data Protection Supervisor may not be prematurely brought to an end unless there are overriding and objectively verifiable grounds for doing so. In that regard, the Court states that the provisions of the Hungarian legislation in force before 1 January 2012 also provided that only such grounds3 could justify the premature bringing to an end of the term served by the Data Protection Supervisor. The Court finds, however, that Mr Jóri was not compelled to vacate office pursuant to such provisions.
Accordingly, the Court holds that, by prematurely bringing to an end the term served by the supervisory authority for the protection of personal data, Hungary has failed to fulfil its obligations under Directive 95/46.
.
