European Commission v Republic of Austria

1.

The present action ( 2 ) under Article 258 TFEU has been brought by the European Commission, which seeks a ruling by the Court that the Republic of Austria has failed in its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, ( 3 ) because the legislation in force in Austria does not meet the requirement of complete independence with regard to the Datenschutzkommission (Data Protection Commission; ‘the DSK’), which was established as a supervisory authority for the protection of personal data.

2.

The present case, like the case which led to the judgment of 9 March 2010 in Case C-518/07 Commission v Germany, ( 4 ) raises the question of the extent of the independence of the supervisory authority required by Article 28(1) of Directive 95/46.

3.

Consequently, the interpretation given by the Court in its judgment in Commission v Germany will be decisive in assessing the merits of the Commission’s application, which is supported by the European Data Protection Supervisor (EDPS).

4.

The Federal Republic of Germany has intervened in the present proceedings in support of the form of order sought by the Republic of Austria.

5.

In accordance with Article 1(1) of Directive 95/46, the object of that directive is to protect, at the level of the Member States, the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data. However, under Article 1(2), such protection cannot justify any restriction or prohibition of the free flow of personal data between Member States. It follows that Directive 95/46 seeks to establish a balance between, on the one hand, the protection of the fundamental freedoms and rights of natural persons with respect to the processing of personal data and, on the other hand, the free flow of such data.

6.

As follows from recital 62 in the preamble to Directive 95/46, the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the abovementioned protection of individuals. For that reason, Article 28 of Directive 95/46, entitled ‘Supervisory authority’, provides in paragraph 1 as follows:

‘Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.’

7.

With regard to European Union institutions and bodies, the protection of natural persons with respect to the processing of personal data is governed by Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data, ( 5 ) which was adopted on the basis of Article 286 EC. In a manner similar to that which Article 28 of Directive 95/46 requires of the Member States, Regulation No 45/2001 set up an independent supervisory authority, called the EDPS. With regard to the independence of that authority, Article 44 of Regulation No 45/2001 is worded as follows:

‘1.   The European Data Protection Supervisor shall act in complete independence in the performance of his or her duties.

2.   The European Data Protection Supervisor shall, in the performance of his or her duties, neither seek nor take instructions from anybody.

3.   The European Data Protection Supervisor shall refrain from any action incompatible with his or her duties and shall not, during his or her term of office, engage in any other occupation, whether gainful or not.

4.   The European Data Protection Supervisor shall, after his or her term of office, behave with integrity and discretion as regards the acceptance of appointments and benefits.’

8.

Directive 95/46 was implemented in Austrian law by the 2000 Law on data protection (Datenschutzgesetz 2000; ‘the DSG 2000’).

9.

Paragraph 35 et seq. of the DSG 2000 provide for the establishment of the DSK as a supervisory authority pursuant to Article 28(1) of Directive 95/46. ( 6 )

10.

Under Paragraph 36(1) of the DSG 2000, the DSK consists of six members who are appointed by the Federal President, on a proposal by the Federal Government, for a term of five years.

11.

Under Paragraph 36(3) of the DSG 2000, one of the six members of the DSK must be a lawyer from the federal public administration.

12.

Under Paragraph 36(3a) of the DSG 2000, a member of the DSK may engage in other work at the same time, with the result that the exercise of duties as a member of the DSK is regarded as a part-time activity.

13.

Making use of the possibility under Article 20(2) of the Bundes-Verfassungsgesetz (Federal Constitutional Law, ‘the B-VG’) of exempting bodies from the obligation to comply with instructions from higher bodies, Paragraph 37(1) of the DSG 2000 provides that the members of the DSK ‘shall be independent and shall not be bound by instructions of any kind in the performance of their duties’.

14.

Paragraph 38(1) of the DSG 2000 provides that the DSK is to adopt internal rules entrusting the management of day-to-day business to one of its members (‘managing member’). Article 4(1) of the internal rules of the DSK provides that the position of managing member is to be held by the federal official appointed pursuant to Paragraph 36(3) of the DSG 2000.

15.

Paragraph 38(2) of the DSG 2000 provides as follows:

‘In support of the work of the [DSK], the Federal Chancellor shall establish an office and shall make available the necessary equipment and staff. The Federal Chancellor shall have the right to be informed at all times by the chairman and the managing member of all aspects of the work of the [DSK].’

16.

The Federal Chancellor’s right under Paragraph 38(2) of the DSG 2000 to be informed of all aspects of the work of the DSK reflects the provisions of Article 20(2) of the B-VG, the relevant part of which is worded as follows:

‘…

The law shall provide for an appropriate right of supervision of the work of the independent body by higher bodies, at least the right to be informed of all aspects of the work of independent bodies, and – in so far as these are not bodies referred to in points 2, 3 and 8 – the right to remove independent bodies on serious grounds.’

17.

Paragraph 45(1) of the 1979 Law on the conditions of service of officials (Beamten-Dienstrechtsgesetz 1979) provides as follows:

‘The hierarchical superior shall ensure that his staff carry out their tasks in accordance with the law, efficiently and economically. He shall guide them in carrying out their duties, shall give them instructions when necessary, shall rectify any faults and omissions and shall ensure that working hours are adhered to. He shall encourage the promotion of his staff in accordance with their performance and shall direct them to those tasks which correspond best to their capacities.’

18.

The Commission, supported by the EDPS, criticises the Republic of Austria on the ground that its legislation does not satisfy the requirement of complete independence of the supervisory authority within the meaning of Article 28(1) of Directive 95/46. According to the Commission, the difficulty arises from the fact that, first, the position of managing member of the DSK is held by an official of the Federal Chancellery; second, the DSK office is integrated with the Federal Chancellery; and, third, the Federal Chancellor has an unfettered right to obtain information from the DSK.

19.

To assess the merits of the Commission’s application, it is necessary first to define the content of the phrase ‘with complete independence’ in Article 28(1) of Directive 95/46 in respect of the supervisory authority. I shall then consider whether all the Commission’s complaints addressed to the Republic of Austria could have the consequence that the DSK, as a supervisory authority, is unable to perform its duties with complete independence in accordance with Article 28(1) of Directive 95/46.

20.

The Commission and the Republic of Austria disagree as to the content of the phrase ‘with complete independence’.

21.

According to the Commission, which bases itself on the judgment in Commission v Germany, this phrase means not only functional independence, but also organic and substantive independence. That finding, it submits, is confirmed by the purpose of Article 28(1) of Directive 95/46, which is to ensure the effectiveness and reliability of the supervision of the provisions on the protection of data, and is also confirmed by the way in which the function of the EDPS is conceived in Regulation No 45/2001, which provides for maximum independence of the EDPS in organic and substantive respects. Furthermore, the Commission draws attention to point 17 of the Council of Europe’s Explanatory report on the additional protocol to the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data regarding supervisory authorities and transborder data flows, which lists the factors contributing to ensuring the independence of the supervisory authority, which include the composition of the authority, the method of appointing its members, the duration of exercise and conditions of cessation of their functions, the allocation of sufficient resources to the authority or the adoption of decisions without being subject to external orders or injunctions.

22.

By contrast, the Republic of Austria takes the view that it cannot be inferred from the judgment in Commission v Germany that supervisory authorities must have organic and substantive independence. The independence of a supervisory authority within the meaning of Article 28(1) of Directive 95/46 must, it argues, be subject to its functional independence, which means that the authority is free to act without having to comply with instructions from the supervised bodies and that it has sufficient independence and impartiality in relation to private individuals.

23.

The Republic of Austria points out that the interpretation of the phrase ‘with complete independence’ makes reference necessary to the Court’s case-law on the independence of a court or tribunal within the meaning of Article 267 TFEU. The Republic of Austria observes that the DSK was conceived as a collegiate authority with judicial functions. References for preliminary rulings submitted by Austrian authorities of that kind on the basis of Article 267 TFEU are deemed admissible by the Court of Justice and the latter has consequently recognised the judicial nature of such authorities ( 7 ) and thus, also, their independence, which is one of the factors taken into account in determining the judicial nature of a national authority in the context of Article 267 TFEU. The Republic of Austria concludes from this that the DSK is independent within the meaning of the Court’s case-law on Article 267 TFEU and that, consequently, it must also be regarded as an independent supervisory authority for the purposes of Article 28(1) of Directive 95/46.

24.

Given the opposing views of the parties concerning the judgment in Commission v Germany, it will be useful to go back to that case. On the basis of the wording of Article 28(1) of Directive 95/46 and the objectives and general scheme of that directive, the Court gave a broad, independent interpretation to the phrase ‘with complete independence’. According to the Court, supervisory authorities ( 8 )‘must enjoy an independence allowing them to perform their duties free from external influence. That independence precludes not only any influence exercised by the supervised bodies, but also any directions or any other external influence, whether direct or indirect, which could call into question the performance by those authorities of their task consisting of establishing a fair balance between the protection of the right to private life and the free movement of personal data’. ( 9 )

25.

I should like to stress two conclusions which follow from that interpretation. First, the Court does not base its interpretation of the expression ‘with complete independence’ on the criteria for independence of a court or tribunal within the meaning of Article 267 TFEU. This leads me to the conclusion that the Court conceives the independence of supervisory authorities as being separate vis-à-vis the independence of courts or tribunals within the terms of Article 267 TFEU, which means that the Republic of Austria’s argument that the DSK is an authority fulfilling the conditions of independence defined by the Court’s case-law on the definition of ‘court or tribunal’ within the meaning of Article 267 TFEU is not relevant in the present case. ( 10 )

26.

Second, in the judgment in Commission v Germany the Court avoided using terms such as ‘functional, organic or substantive independence’ even though, as in the present case, both the Commission and the Federal Republic of Germany used them in the course of their submissions.

27.

In view of the broad interpretation of the phrase ‘with complete independence’ accepted by the Court, it may be asked whether the Court understood by this an independence of supervisory authorities in all conceivable dimensions. I think the reply to that question must be in the negative. The Court’s interpretation has left the field open to a case-by-case assessment as to whether a measure which is the subject of a complaint against a Member State is such as to represent an external influence, whether direct or indirect, over the work of the supervisory authority.

28.

The Court has not specified all the factors that are necessary in order that the performance of the tasks of supervisory authorities can be guaranteed ‘with complete independence’. As I have already stated in my Opinion in Commission v Germany, ( 11 ) it appears difficult to do so and it seems more appropriate to adopt a negative approach, that is to say, to examine the influence of specific factors or a number of certain factors on the independence of the supervisory authority in question. That was the approach taken by the Court in the abovementioned judgment when it examined the influence of State supervision on the independence of the supervisory authority.

29.

According to the Commission, it follows from Article 4(1) of the internal rules of the DSK that the managing member of the DSK, who manages its day-to-day business and who, consequently, has a pre-eminent role within the DSK, must always be an official of the Federal Chancellery. As the position of member of the DSK is conceived as a part-time activity carried on concurrently with other professional activities, the managing member remains bound by the instructions of the Federal Chancellor and is subject to administrative supervision. There is, the Commission submits, a service-related link between the managing member and the Federal Chancellery which is not removed by Paragraph 37(1) of the DSG 2000 in relation to the independence of DSK members. For that reason, the Commission takes the view that combining the position of managing member of the DSK with that of an official of the Federal Chancellery is not compatible with the requirement of independence laid down by Article 28(1) of Directive 95/46 and demonstrates that the DSK lacks organic independence.

30.

In its defence, the Republic of Austria submits that it does not follow from Article 4(1) of the internal rules of the DSK, read in conjunction with Paragraph 36(3) of the DSG 2000, that the managing member of the DSK must always be an official of the Federal Chancellery. The effect of those provisions, it contends, is that the managing member must be a lawyer from the federal public administration, which covers all lawyers working within a federal authority, but that category is not limited exclusively to officials of the Federal Chancellery. Furthermore, under Paragraph 38(1) of the DSG 2000, the appointment of the managing member depends on an independent decision of the DSK itself. If an official of the Federal Chancellery were appointed as the managing member of the DSK, Paragraph 37(1) of the DSG 2000, which prohibits the Federal Chancellery from issuing technical or substantive instructions to the managing member, would, it is claimed, prevent conflicts of loyalty and of interest.

31.

In my view, it must be acknowledged that it does not follow from the Austrian legislation that the managing member of the DSK must necessarily be an official of the Federal Chancellery. According to Article 4(1) of the internal rules of the DSK, read in conjunction with Paragraph 36(3) of the DSG 2000, the position of managing member is reserved for an official of the federal administration who is a lawyer, which means that the managing member may, but must not necessarily, be an official of the Federal Chancellery. However, the fact none the less remains that there is always a service-related link between the managing member and the federal authority to which he belongs.

32.

In view of this service-related link, the possibility that the higher federal authority may exercise an influence over the managing member’s work cannot be ruled out. Obviously, this would not be a direct influence, because that is prohibited by Paragraph 37(1) of the DSG 2000. Rather, combining the position of managing member of the DSK with that of a federal official entails a risk ( 12 ) of indirect influence of the higher federal authority over the work of the managing member of the DSK, thereby calling into question the DSK’s independence as required by Article 28(1) of Directive 95/46.

33.

I wish to mention that such influence could also originate from the employers of the other members of the DSK, in view of the fact that duties resulting from membership of the DSK are conceived as constituting a part-time activity which is concurrent with other professional activities. If the Court were to confirm its approach of interpreting Directive 95/46 in the light of Regulation No 45/2001, ( 13 ) it could then be concluded that the prohibition of any other professional activity is one of the conditions required for the purpose of the independence of supervisory authorities laid down by Article 28(1) of Directive 95/46, since Article 44(3) of Regulation No 45/2001 lays down a similar condition with regard to the independence of the EDPS.

34.

The Commission considers that the structural integration of the DSK office with the departments of the Federal Chancellery is not compatible with Article 28(1) of Directive 95/46 as it follows that the DSK is not independent in the organic or substantive respect. DSK staff members are, it argues, under the authority of the Federal Chancellery and are subject to its administrative supervision. It follows that the DSK office is exposed to potential influence by the Federal Chancellery. That is all the more serious in so far as the Federal Chancellery is, as a public authority, subject to the supervision deemed to be exercised by the DSK.

35.

On that point, the EDPS adds that the possibility of the Federal Chancellery influencing the work of the DSK is increased by the fact that there is no separate budget line for the DSK and that the DSK’s budget forms part of the Federal Chancellery budget.

36.

The Republic of Austria has acknowledged that the DSK office, as an auxiliary bureaucratic apparatus of the DSK, was integrated with the Federal Chancellery and that the staff of the office are, in legal terms, attached to the Federal Chancellery, which retains administrative supervision. However, it contends, that does not affect the assessment of the DSK’s independence in view of the distinction that must be made between the DSK as a body and its office.

37.

With regard to the DSK’s budget, the Republic of Austria argues that, under Austrian budgetary law, the question as to which ministerial department a federal institution comes under for budgetary purposes is secondary and, in itself, indicates nothing as to the independence of that institution.

38.

As the respective submissions of the Commission and the Republic of Austria in the present case demonstrate, it is common ground that the DSK office is integrated with the Federal Chancellery and that, for that reason, DSK staff are subject to the administrative supervision of the latter.

39.

In that connection, the argument that a distinction should be made between the DSK as a body and its office seems to me somewhat feeble. I take the view that the office and the office staff constitute an essential element of the status of the supervisory authority. This is borne out by, for example, recital 11 in the preamble to Directive 2002/21/EC of the European Parliament and of the Council of 7 March 2002 on a common regulatory framework for electronic communications networks and services (Framework Directive), ( 14 ) which states that, with a view to the independence of national regulatory authorities, these should be in possession of all the necessary resources, in terms of staffing, expertise, and financial means, for the performance of their tasks. ( 15 )

40.

It follows that if a person or entity exercises influence over the office and the staff of the supervisory authority, which is unquestionably the case here, that person or entity consequently exercises influence over the authority as such, a situation which is not compatible with the requirement that the supervisory authority be independent.

41.

The Commission takes the view that the Federal Chancellor’s unlimited right to information under Article 20(2) of the B-VG compromises the DSK’s independence inasmuch as there is a risk that that right might be used to exercise political influence over the DSK. On that point, the Commission again observes that the Federal Chancellor is himself subject to supervision by the DSK.

42.

The Republic of Austria does not deny the existence of the Federal Chancellor’s right to obtain information on all aspects of the work of the DSK, which was established as an autonomous body within the meaning of Article 20(2) of the B-VG. The Republic of Austria explains that such a right represents an absolute minimum with regard to the right of supervision required by constitutional law in relations between higher bodies and independent bodies which are exempted from the obligation to comply with instructions issued by higher bodies. The right to information, it argues, gives the Federal Chancellor no influence over the DSK’s functioning. The Republic of Austria draws attention to the fact that the Ministry of Justice has a similar right to information concerning the ordinary courts which is not regarded as being contrary to the requirement of judicial independence.

43.

As I have already stated, in the judgment in Commission v Germany the Court gave an independent interpretation of the independence of the supervisory authority vis-à-vis that of a court or tribunal within the meaning of Article 267 TFEU. For that reason, the Republic of Austria’s argument that there is a similar right to information concerning the ordinary courts is irrelevant in the present case.

44.

In my view, two factors demonstrate that the right to information in question could have harmful consequences for the independence of the DSK. First, the right in question is unlimited and unconditional. Second, the Federal Chancellor, who has that right, is himself subject to the DSK’s supervisory power, with the result that any exercise by him of the right to information could amount to influence by the body being supervised.

45.

In conclusion, I take the view, first, that, by providing for the functions of managing member of the DSK and federal official to be held concurrently; second, by integrating the DSK office within the Federal Chancellery; and, third, by granting the Federal Chancellor a right to information concerning the DSK, the Republic of Austria has incorrectly transposed the requirement laid down by Article 28(1) of Directive 95/46 that the functions entrusted to supervisory authorities be exercised ‘with complete independence’.

46.

Having regard to the foregoing, I propose that the Court should: