JUDGMENT OF THE COURT (Grand Chamber)
16 October 2012 (*)
(Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links)
In Case C‑614/10,
ACTION under Article 258 TFEU for failure to fulfil obligations, brought on 22 December 2010,
European Commission, represented by B. Martenczuk and B.‑R. Killmann, acting as Agents, with an address for service in Luxembourg,
applicant,
supported by:
European Data Protection Supervisor (EDPS), represented by H. Kranenborg, I. Chatelier and H. Hijmans, acting as Agents,
intervener,
v
Republic of Austria, represented by G. Hesse, acting as Agent, with an address for service in Luxembourg,
defendant,
supported by:
Federal Republic of Germany, represented by T. Henze and J. Möller, acting as Agents,
intervener,
THE COURT (Grand Chamber),
composed of V. Skouris, President, K. Lenaerts (Rapporteur), Vice-President, A. Tizzano, M. Ilešič, G. Arestis, M. Berger, E. Jarašiūnas, Presidents of Chambers, E. Juhász, A. Borg Barthet, J.‑C. Bonichot, M. Safjan, D. Šváby and A. Prechal, Judges,
Advocate General: J. Mazák,
Registrar: K. Malacek, Administrator,
having regard to the written procedure and further to the hearing on 25 April 2012,
after hearing the Opinion of the Advocate General at the sitting on 3 July 2012,
gives the following
Judgment
1 By its action, the European Commission asks the Court to declare that, by failing to take all of the measures necessary to ensure that the legislation in force in Austria meets the requirement of independence with regard to the Datenschutzkommission (Data Protection Commission; ‘the DSK’), which was established as a supervisory authority for the protection of personal data, the Republic of Austria has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
Legal context
European Union law
2 Paragraph 1 of Article 28 of Directive 95/46, which is entitled ‘Supervisory authority’, provides:
‘Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
These authorities shall act with complete independence in exercising the functions entrusted to them.’
3 Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), establishes, in Chapter V, an independent supervisory authority, namely the European Data Protection Supervisor (EDPS).
4 Article 43 of Regulation No 45/2001, which covers the regulations and general conditions governing the performance of the EDPS’s duties, provides in paragraph 3 as follows:
‘The [EDPS’s] budget shall be shown in a separate budget heading in Section VIII of the general budget of the European Union.’
Austrian law
Federal Constitutional Law
5 Article 20(2) of the Federal Constitutional Law (Bundes‑Verfassungsgesetz; ‘the BVG’), as amended on 1 January 2008, is worded as follows:
‘The law may exempt from the obligation to comply with instructions from higher bodies, bodies
…
(2) monitoring the compliance of authorities with the laws in force and in respect of public procurement procedures,
(3) adjudicating at last instance, where acting as a collegiate body and including at least one person in a judicial capacity, and the decisions of which are not subject to repeal or change by way of administrative ruling,
…
(8) to the extent necessary according to European Union law.
The constitutional law of a Land may create other independent bodies. The law shall provide for an appropriate right of supervision of the work of the independent body by higher bodies, at least the right to be informed of all aspects of the work of independent bodies, and – in so far as these are not bodies referred to in points 2, 3 and 8 – the right to remove independent bodies on serious grounds.’
The 1979 Law on the conditions of service of officials
6 Paragraph 45(1) of the 1979 Law on the conditions of service of officials (Beamten-Dienstrechtsgesetz 1979; ‘the BDG 1979’), provides as follows:
‘The hierarchical superior shall ensure that his staff carry out their tasks in accordance with the law, efficiently and economically. He shall guide them in carrying out their duties, shall give them instructions when necessary, shall rectify any faults and omissions and shall ensure that working hours are adhered to. He shall encourage the promotion of his staff in accordance with their performance and shall direct them to those tasks which correspond best to their capacities.’
The 2000 Law on data protection
7 The 2000 Law on data protection (Datenschutzgesetz 2000; ‘the DSG 2000’) is designed to implement Directive 95/46 in Austrian law.
8 Under Paragraph 36(1) of the DSG 2000, the DSK consists of six members who are appointed by the Federal President, on a proposal by the Federal Government, for a term of five years.
9 Pursuant to Paragraph 36(2) of the DSG 2000, five members of the DSK are proposed by authorities which statutorily represent various professional interests, by the Austrian Länder and by the President of the Oberster Gerichtshof (Supreme Court). Under Paragraph 36(3) of the DSG 2000, the sixth member ‘is to be proposed from among the lawyers in the federal public administration’.
10 In so far as the exercise of duties as a member of the DSK is regarded as a part-time activity, a member of the DSK may, under Paragraph 36(3a) of the DSG 2000, engage in other work at the same time.
11 Paragraph 37(1) of the DSG 2000 provides that the members of the DSK ‘shall be independent and shall not be bound by instructions of any kind in the performance of their duties’. Under Paragraph 37(2) of the DSG 2000, the officials working in the office of the DSK ‘shall be bound only by the technical instructions of the chairman and the managing member of the [DSK]’.
12 Paragraph 38(1) of the DSG 2000 provides that the DSK is to adopt internal rules entrusting the management of day-to-day business to one of its members (the ‘managing member’).
13 Paragraph 38(2) of the DSG 2000 provides:
‘In support of the work of the [DSK], the Federal Chancellor shall establish an office and shall make available the necessary equipment and staff. The Federal Chancellor shall have the right to be informed at all times by the chairman and the managing member of all aspects of the work of the [DSK].’
The internal rules of the DSK
14 Article 4(1) of the internal rules of the DSK provides that the position of managing member is to be held by the federal official appointed pursuant to Paragraph 36(3) of the DSG 2000.
15 Article 7(1) of those internal rules provides that, without prejudice to supervision by the Federal Chancellor, the officials working in the DSK office are to take instructions only from the chairman or the managing member of the DSK.
The pre-litigation procedure
16 On 5 July 2005, the Commission sent a letter of formal notice to the Republic of Austria in which it claimed that the organisation, in law and in fact, of the DSK failed to satisfy the criterion of independence set out in the second subparagraph of Article 28(1) of Directive 95/46.
17 By letter of 2 November 2005, the Republic of Austria sent to the Commission its observations in response to that letter of formal notice, submitting that the DSK did meet the requirements of that directive.
18 On 8 January 2008, the Commission sent a supplementary letter of formal notice to the Republic of Austria in which it requested the latter to provide it with more extensive information on the consequences for the DSK of the entry into force of the amendment to the BVG of 1 January 2008.
19 In its additional observations of 9 January and 7 March 2008, the Republic of Austria explained that the amended version of Article 20(2) of the BVG had no bearing on the DSK’s independence.
20 Subsequently, on 9 October 2009, the Commission sent a reasoned opinion to the Republic of Austria, reiterating the complaints made previously.
21 As the Commission was not satisfied by the Republic of Austria’s observations in its letter of 9 December 2009 in response to the reasoned opinion, it brought the present action.
22 By order of the President of the Court of 18 May 2011, the Federal Republic of Germany was granted leave to intervene in support of the form of order sought by the Republic of Austria.
23 By order of the President of the Court of 7 July 2011, the EDPS was granted leave to intervene in support of the form of order sought by the Commission.
24 By letter of 25 November 2011, the Republic of Austria requested, on the basis of the second subparagraph of Article 44(3) of the Rules of Procedure of the Court of Justice, that the case be decided by the Grand Chamber.
The action
Arguments of the parties
25 The Commission and the EDPS claim that the Republic of Austria has incorrectly transposed the second subparagraph of Article 28(1) of Directive 95/46 in so far as the national legislation in force does not allow the DSK to exercise its functions ‘with complete independence’. They refer in this respect, first, to the fact that, according to the legislation in force, the managing member of the DSK must always be an official of the Federal Chancellery. All day-to-day business of the DSK is thus de facto managed by a federal official, who remains bound by the instructions issued by his employer and is subject to supervision within the terms of Paragraph 45(1) of the BDG 1979. Paragraph 37(1) of the DSG 2000 provides only for the operational autonomy of the supervisory authority.
26 Second, the Commission and the EDPS point out that the office of the DSK is structurally integrated with the departments of the Federal Chancellery. As a result of that integration, they contend, the DSK is not independent in either organic or substantive terms. All DSK staff members are, as is apparent from Paragraph 38(2) of the DSG 2000 and from Article 7(1) of the internal rules, under the authority of the Federal Chancellery and are thus subject to its supervision.
27 Third, the Commission and the EDPS refer to the Federal Chancellor’s right to be informed pursuant to Article 20(2) of the BVG and Paragraph 38(2) of the DSG 2000.
28 The Republic of Austria and the Federal Republic of Germany claim that the action should be dismissed.
29 They note that the DSK is a ‘collegiate authority with judicial functions’ within the meaning of the BVG. Such a body, they argue, constitutes an independent court or tribunal within the terms of Article 267 TFEU and Article 6(1) of the European Convention for the Protection of Human Rights and Fundamental Freedoms, signed in Rome on 4 November 1950, which therefore also meets the requirement of independence laid down in the second subparagraph of Article 28(1) of Directive 95/46.
30 According to the Republic of Austria, the second subparagraph of Article 28(1) of Directive 95/46 relates to functional independence. The DSK has such independence since, in accordance with Paragraph 37(1) of the DSG 2000, its members are independent and are not bound by instructions of any kind in the performance of their duties.
31 None of the factors put forward by the Commission, they argue, is capable of calling into question the DSK’s independence within the meaning of the second subparagraph of Article 28(1) of Directive 95/46.
32 First, the managing member of the DSK need not necessarily be an official of the Federal Chancellery. Under Article 4(1) of the internal rules and Paragraph 36(3) of the DSG 2000, the managing member is proposed from among the lawyers in the federal public administration. Moreover, the DSK can itself freely decide whom to appoint as its managing member by amending, on an autonomous basis, its internal rules. The fact that, like any other official, the managing member depends, for purposes of promotion, on the decision of his hierarchical superior and, ultimately, of a minister does not affect his independence.
33 Second, as regards the integration of the office of the DSK with the departments of the Federal Chancellery, the Republic of Austria claims that all bodies of the federal public administration come, from the point of view of budgetary law, under a ministerial department. It is for the Government, in conjunction with the Parliament, to ensure that the various executive bodies have adequate equipment and staff. In addition, the DSK office is exclusively responsible for the management of its action programmes. The DSK office staff comply with the instructions issued by the chairman and the managing member of the DSK. The fact that the staff of the office are, in legal terms, attached to the Federal Chancellery, both in terms of hierarchy and remuneration, does not affect their independence. Supervision, in terms of disciplinary controls, ensures the effective operation of the DSK.
34 Third, as regards the ‘right to information’ of the Federal Chancellor, the Republic of Austria notes that that right seeks to ensure a certain democratic link between the autonomous bodies and the Parliament. The right to information provides no scope for the exercise of influence over the DSK’s functioning. In addition, a right to information is not contrary to the requirements of independence applicable to a court or tribunal.
35 In its statement in intervention, the Federal Republic of Germany adds that limited supervision complies with the requirements of the second subparagraph of Article 28(1) of Directive 95/46. Limited supervision ensures only that the person being supervised acts in accordance with his obligations. It does not, by contrast, adversely affect his material and personal independence and, in particular, provides no influence over that person in respect of substance. German constitutional case-law has recognised the compatibility of limited supervision in respect of courts with the principle of judicial independence.
Findings of the Court
36 The second subparagraph of Article 28(1) of Directive 95/46 requires Member States to set up one or more supervisory authorities for the protection of personal data which have complete independence in exercising the functions entrusted to them. In addition, the requirement that compliance with European Union rules on the protection of individuals with regard to the processing of personal data is subject to control by an independent authority derives from the primary law of the European Union, inter alia Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU.
37 The establishment in Member States of independent supervisory authorities is thus an essential component of the protection of individuals with regard to the processing of personal data (Case C‑518/07 Commission v Germany [2010] ECR I‑1885, paragraph 23).
38 In order to determine whether the present action is well founded, it is necessary to consider whether, as the Commission maintains, the legislation in force in Austria precludes the DSK from exercising its functions ‘with complete independence’ within the meaning of the second subparagraph of Article 28(1) of Directive 95/46.
39 In that regard, it is necessary to reject at the outset the argument put forward by the Republic of Austria and the Federal Republic of Germany that the DSK has the degree of independence required by the second subparagraph of Article 28(1) of Directive 95/46 since it satisfies the condition of independence inherent in Article 267 TFEU for it to qualify as a court or tribunal of a Member State.
40 It follows from the judgment in Commission v Germany that the words ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46 must be given an autonomous interpretation, independent of Article 267 TFEU, based on the actual wording of that provision and on the aims and scheme of Directive 95/46 (see Commission v Germany, paragraphs 17 and 29).
41 The Court has already held in its judgment in Commission v Germany, paragraph 30, that the words ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46 must be interpreted as meaning that the supervisory authorities for the protection of personal data must enjoy an independence which allows them to perform their duties free from external influence. The Court also stated in that judgment that those authorities must remain free from any external influence, direct or indirect, which is liable to have an effect on their decisions (see, to that effect, Commission v Germany, paragraphs 19, 25, 30 and 50).
42 The fact that the DSK has functional independence in so far as, in accordance with Paragraph 37(1) of the DSG 2000, its members are ‘independent and [are not] bound by instructions of any kind in the performance of their duties’ is, admittedly, an essential condition in order for that authority to satisfy the criterion of independence within the meaning of the second subparagraph of Article 28(1) of Directive 95/46. However, contrary to what the Republic of Austria maintains, such functional independence is not by itself sufficient to protect that supervisory authority from all external influence.
43 The independence required under the second subparagraph of Article 28(1) of Directive 95/46 is intended to preclude not only direct influence, in the form of instructions, but also, as noted in paragraph 41 above, any indirect influence which is liable to have an effect on the supervisory authority’s decisions.
44 However, the various aspects of the Austrian legislation referred to by the three heads of complaint contained in the Commission’s application preclude the DSK from being capable of being regarded as performing its duties free from all indirect influence.
45 So far as concerns the first head of complaint relating to the position of the managing member within the DSK, it follows from Paragraphs 36(3) and 38(1) of the DSG 2000, read in conjunction with Article 4(1) of the internal rules of the DSK, that the managing member is a federal official.
46 Next, it must be noted that, pursuant to Paragraph 38(1) of the DSG 2000, that federal official manages the day‑to‑day business of the DSK.
47 It is, admittedly, true, as the Republic of Austria points out, that the managing member of the DSK need not, under the current regulatory framework, necessarily be an official of the Federal Chancellery, even though it is not disputed that that position has always been held by such an official.
48 However, irrespective of the federal authority to which the managing member of the DSK belongs, it is common ground that there is a service-related link between the managing member and that federal authority which allows the activities of the managing member to be supervised by his hierarchical superior.
49 It should be borne in mind, in this regard, that Paragraph 45(1) of the BDG 1979 grants the hierarchical superior an extensive power of supervision over the officials in his department. That provision enables the hierarchical superior not only to ensure that his staff carry out their tasks in accordance with the law, efficiently and economically, but also to guide them in carrying out their duties, rectify any faults and omissions and ensure that working hours are adhered to, encourage the promotion of his staff in accordance with their performance and direct them to those tasks which correspond best to their capacities.
50 In the light of the position that the managing member holds within the DSK, the second subparagraph of Article 28(1) of Directive 95/46 precludes the supervision to which the managing member is subject under Paragraph 45(1) of the BDG 1979. Even if Paragraph 37(1) of the DSG 2000 is designed to prevent the hierarchical superior from issuing instructions to the managing member, the fact remains that Paragraph 45(1) of the BDG 1979 confers on the hierarchical superior a power of supervision that is liable to hinder the DSK’s operational independence.
51 Suffice it to point out, in this regard, that it is conceivable that the evaluation of the managing member of the DSK by his hierarchical superior for the purposes of encouraging his promotion could lead to a form of ‘prior compliance’ on the part of the managing member (see, to that effect, Commission v Germany, paragraph 36).
52 Moreover, by reason of the links that the managing member of the DSK has with the political body, which is subject to the supervision of the DSK, the latter is not above all suspicion of partiality. In the light of the role assumed by the supervisory authorities as guardians of the right to privacy, the second subparagraph of Article 28(1) of Directive 95/46 requires that their decisions, and therefore the authorities themselves, remain above all suspicion of partiality (see Commission v Germany, paragraph 36).
53 The Republic of Austria states in response, however, that it is under Article 4(1) of the internal rules of the DSK that the position of managing member is to be held by the federal official appointed pursuant to Paragraph 36(3) of the DSG 2000. Since the presence within the DSK of an official from the Federal Chancellery as managing member of the DSK rests on an autonomous decision taken by that authority, the independence of that supervisory authority is not affected.
54 Such an argument must be rejected.
55 As is apparent from paragraphs 48 to 52 of the present judgment, the service-related link between the managing member of the DSK and the federal authority to which that member belongs affects the DSK’s independence and, in the present case, the manner in which that member is appointed does not cast doubt on that finding. It is, however, for the Republic of Austria to adopt the legal provisions necessary to guarantee that the supervisory authority can exercise the functions entrusted to it ‘with complete independence’ within the meaning of the second subparagraph of Article 28(1) of Directive 95/46.
56 Next, so far as concerns the second head of complaint put forward by the Commission, it should be borne in mind that, pursuant to Paragraph 38(2) of the DSG 2000, the Federal Chancellery is required to make available to the DSK office the necessary equipment and staff. It is not disputed that the DSK office is composed of officials of the Federal Chancellery.
57 As the Commission maintains, the integration of the DSK office with the departments of the Federal Chancellery also does not allow the inference to be drawn that the DSK can exercise the functions entrusted to it free from all influence from the Federal Chancellery.
58 It is, admittedly, true, as the Republic of Austria emphasises, that the DSK need not be given a separate budget, such as that provided for in Article 43(3) in Regulation No 45/2001 for the EDPS, in order to be able to satisfy the criterion of independence set out in the second subparagraph of Article 28(1) of Directive 95/46. Member States are not obliged to reproduce in their national legislation provisions similar to those of Chapter V of Regulation No 45/2001 in order to ensure the total independence of their respective supervisory authorities and they can therefore provide that, from the point of view of budgetary law, the supervisory authorities are to come under a specified ministerial department. However, the attribution of the necessary equipment and staff to such authorities must not prevent them from acting ‘with complete independence’ in exercising the functions entrusted to them within the meaning of the second subparagraph of Article 28(1) of Directive 95/46.
59 The regulatory framework in force in Austria fails, however, to satisfy that last condition. The staff made available to the DSK office consists of officials of the Federal Chancellery who are subject to supervision by the Federal Chancellery within the terms of Paragraph 45(1) of the BDG 1979. As is apparent from paragraphs 49 to 52 above, however, such supervision by the State is not compatible with the requirement of independence set out in the second subparagraph of Article 28(1) of Directive 95/46, which must be satisfied by supervisory authorities for the protection of personal data.
60 The Republic of Austria’s argument that the organisation of the office cannot affect the DSK’s independence in so far as the office implements only decisions of the DSK must be rejected.
61 In view of the work-load of a supervisory authority responsible for the protection of personal data, on one hand, and of the fact that the members of the DSK exercise their duties under Paragraph 36(3a) of the DSG 2000 at the same time as engaging in other work, on the other, it must be held that the members of such an authority rely in large measure on the staff made available to them for assistance in exercising the functions entrusted to them. The fact that the office is composed of officials of the Federal Chancellery, which is itself subject to supervision by the DSK, carries a risk of influence over the decisions of the DSK. In any event, such an organisational overlap between the DSK and the Federal Chancellery prevents the DSK from being above all suspicion of partiality and is therefore incompatible with the requirement of ‘independence’ within the meaning of the second subparagraph of Article 28(1) of Directive 95/46.
62 So far as concerns the Commission’s third head of complaint, it must be held that, in accordance with Article 20(2) of the BVG and Paragraph 38(2) of the DSG 2000, the Federal Chancellor has the right to be informed at all times by the chairman and the managing member of all aspects of the work of the DSK.
63 Such a right to information is also liable to subject the DSK to indirect influence from the Federal Chancellor which is incompatible with the criterion of independence referred to in the second subparagraph of Article 28(1) of Directive 95/46. Suffice it to note in this regard, first, that the right to information is far-reaching inasmuch as it covers ‘all aspects of the work of the DSK’ and, second, that it is unconditional.
64 In those circumstances, the right to information set out in Article 20(2) of the BVG and Paragraph 38(2) of the DSG 2000 precludes the DSK from being capable of being regarded as operating, in all circumstances, above all suspicion of partiality.
65 Last, as regards the argument of the Federal Republic of Germany set out in paragraph 35 above, suffice it to point out that the managing member of the DSK is a federal official subject to supervision such that it cannot be excluded that the hierarchical superior of that member might exercise indirect influence over the DSK’s decisions (see paragraphs 48 to 52 above).
66 In the light of all of the foregoing, it must be held that, by failing to take all of the measures necessary to ensure that the legislation in force in Austria meets the requirement of independence with regard to the DSK, more specifically by laying down a regulatory framework under which
– the managing member of the DSK is a federal official subject to supervision,
– the office of the DSK is integrated with the departments of the Federal Chancellery, and
– the Federal Chancellor has an unconditional right to information covering all aspects of the work of the DSK,
the Republic of Austria has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46.
Costs
67 Under Article 69(2) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the Commission has applied for costs to be awarded against the Republic of Austria, and since it has been unsuccessful, the Republic of Austria must be ordered to pay the costs.
68 In accordance with the first and third subparagraphs of Article 69(4) of the Rules of Procedure, the Federal Republic of Germany and the EDPS, which have intervened in the proceedings, are to bear their own costs.
On those grounds, the Court (Grand Chamber) hereby:
1. Declares that, by failing to take all of the measures necessary to ensure that the legislation in force in Austria meets the requirement of independence with regard to the Datenschutzkommission (Data Protection Commission), more specifically by laying down a regulatory framework under which
– the managing member of the Datenschutzkommission is a federal official subject to supervision,
– the office of the Datenschutzkommission is integrated with the departments of the Federal Chancellery, and
– the Federal Chancellor has an unconditional right to information covering all aspects of the work of the Datenschutzkommission,
the Republic of Austria has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
2. Orders the Republic of Austria to pay the costs incurred by the European Commission;
3. Orders the Federal Republic of Germany and the European Data Protection Supervisor to bear their own respective costs.
[Signatures]