ECJ: The Data Protection Authorities need to be completely independent

This article is also available in:
Deutsch: [EuGH: Datenschutzbehörden müssen vollkommen unabhängig sein | http://www.unwatched.org/node/1756]

A European Court of Justice (ECJ) decision made public on 9 March 2010 in
the case of the European Commission vs. Germany rules that the Data
Protection Authorities (DPAs) established in accordance with the Data
Protection Directive 95/46 needs to be completely independent.

In this case the German regional DPAs were considered as not independent,
since they are part of the regional administration and subject to State
scrutiny.

The ECJ decision explained that “the supervisory authorities provided for in
Article 28 of Directive 95/46 are therefore the guardians of those
fundamental rights and freedoms, and their existence in the Member States is
considered, as is stated in the 62nd recital in the preamble to Directive
95/46, as an essential component of the protection of individuals with
regard to the processing of personal data.”

On the scope of the requirements of independence of the supervisory
authorities the court concluded that these authorities “must enjoy an
independence allowing them to perform their duties free from external
influence. That independence precludes not only any influence exercised by
the supervised bodies, but also any directions or any other external
influence, whether direct or indirect, which could call into question the
performance by those authorities of their task consisting of establishing a
fair balance between the protection of the right to private life and the
free movement of personal data.”

The European Data Protection Supervisor (EDPS) who supported the
European Commission’s case in front of the ECJ was pleased with the
judgement.

“The judgement of the Court is of great importance. It strengthens and
clarifies the position of data protection authorities as part of the
fundamental right to data protection. This judgement is relevant for all
supervisory authorities in all EU Member States” said the EDPS.

The European Commission started in 2005 an infringement procedure against
Germany and Austria for not having created an adequate independence of the
Data Protection Authorities.

ECJ Decision in Case 518/07 – European Commission vs. Germany (9.03.2010)
http://curia.europa.eu/jurisp/cgi-bin/form.pl?lang=en&numaff=C-518%2F07+&Submit=Submit

EDPS welcomes Court of Justice’s ruling strengthening independent position
of data protection authorities (9.03.2010)
http://www.edps.europa.eu/EDPSWEB/webdav/site/mySite/shared/Documents/EDPS/PressNews/Press/2010/EDPS-2010-04_Independence_DPAs_EN.pdf

EDRi-gram: EC: data protection inadequate in Austria and Germany (24.08.2005)
http://www.edri.org/edrigram/number3.17/DPA