OPINION OF ADVOCATE GENERAL
WATHELET
delivered on 10 December 2013 (1)
Case C‑288/12
European Commission
v
Hungary
(Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — National legislation prematurely bringing to an end the six-year term to be served by the data protection supervisor — Creation of a national authority for data protection and freedom of information, and the appointment for a nine-year term of a person other than the data protection supervisor as head of that authority)
I – Introduction
1. By its application of 24 May 2012, the European Commission claims that the Court should declare that, by prematurely bringing to an end the term served by the supervisory authority for the protection of data, Hungary has failed to fulfil its obligations under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. (2) In that regard, the Commission submits that Hungary compromised the independence of the data protection supervisory authority, required under the second subparagraph of Article 28(1) of that directive.
2. In common with the cases which gave rise to the judgments in Commission v Germany (3) and Commission v Austria, (4) the present case concerns the scope of the obligation, imposed on Member States under the second subparagraph of Article 28(1) of Directive 95/46, to set up one or more supervisory authorities for the protection of personal data ‘which shall act with complete independence in exercising the functions entrusted to them’.
II – European Union (‘EU’) law
3. Directive 95/46 was adopted on the basis of Article 100a of the EC Treaty (subsequently, after amendment, Article 95 EC, now Article 114 TFEU) and its aim is to harmonise the national legislation on the processing of personal data.
4. Recital 62 in the preamble to Directive 95/46 states:
‘… the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of personal data.’
5. Paragraph 1 of Article 28 of Directive 95/46, which is entitled ‘Supervisory authority’, provides:
‘Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
These authorities shall act with complete independence in exercising the functions entrusted to them.’
III – The Hungarian legal context and the facts
6. Until 31 December 2011 and in accordance with Law LXIII of 1992 on the Protection of Personal Data and Access to Data of Public Interest (‘the Law of 1992’), the data protection supervisory authority in Hungary, required under Article 28 of Directive 95/46, was the data protection supervisor (5) (‘the Supervisor’). Article 23 of the Law of 1992 provided that the Supervisor was to be elected by the Hungarian Parliament, and Articles 24 and 25 of that Law set out his tasks. The duration and the termination of the Supervisor’s term in office were governed by Law LIX of 1993 on the Parliamentary Commissioner for Civil Rights (‘the Law of 1993’). Article 4(5) of the Law of 1993, as last amended — a version which remained in force until 31 December 2011 — provided that the Supervisor was to be elected for a six-year term and could be re-elected once. Article 15 of that law governed the termination of his term in office.
7. On the basis of the Law of 1992, Mr Jóri was elected Supervisor and he took up his duties on 29 September 2008. He was appointed for a six-year term and should therefore have remained in office until September 2014.
8. Under Article VI(3) of the Fundamental Law of Hungary, which entered into force on 1 January 2012 (‘the Fundamental Law’), ‘[e]xercise of the right to the protection of personal data and access to data of public interest shall be supervised by an independent authority established by statute’.
9. On 1 January 2012, Law CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information (‘the Law of 2011’) entered into force. That law repeals the Law of 1992 and, at the same time, establishes the National Authority for Data Protection and Freedom of Information (‘the Authority’). The Law of 2011 transferred the tasks of the Supervisor to the Authority. Under Article 40(1) and (3) of the Law of 2011, the Head of the Authority is to be appointed by the President of the Republic, upon the recommendation of the Prime Minister, for a term of nine years.
10. The Authority commenced operation on 1 January 2012.
11. Mr Jóri’s term of office was due to expire in September 2014, but he had to leave office on 31 December 2011 pursuant to Article 16 of the transitional provisions of the Fundamental Law, under which ‘[t]he term of office of the incumbent [Supervisor] shall end upon the entry into force of the present Fundamental Law’.
12. Mr Jóri was not chosen to be Head of the Authority. On a proposal from the Prime Minister, the President of the Republic appointed Mr Péterfalvi as Head of the Authority for a term of nine years.
IV – Pre-litigation procedure and proceedings before the Court of Justice
13. On 17 January 2012, the Commission sent Hungary a letter of formal notice. In that letter, the Commission expressed the view that Hungary had infringed Article 28(1) and (2) of Directive 95/46 in three respects: (i) Hungary had compelled the Supervisor to vacate office before his full term had expired; (ii) Hungary had failed to consult the Supervisor regarding the draft of the new law on data protection, as required; and (iii) the Law of 2011 offers too many opportunities for ending prematurely the term to be served by the Head of the Authority, and the role attributed to the President of the Republic and the Prime Minister in that connection enables the country’s executive power to exert influence over the Head of the Authority.
14. The Commission called upon Hungary to send its reply within one month.
15. In its reply of 17 February 2012, Hungary denied the infringement imputed to it in relation to the premature ending of the term to be served by the Supervisor, maintaining that this had been brought about by the change in the Hungarian model. Hungary stated that, according to statements made by the Supervisor and published in the press, he did not wish to be appointed as Head of the Authority. Moreover, since an appointment had meanwhile been made, it was no longer possible for the Supervisor to occupy that post, as to compel the current Head to vacate office before his term expired would be in breach of the rules of law guaranteeing his independence.
16. As regards consultation of the Supervisor, Hungary stated that consultations had indeed taken place and provided the Commission with documents in that regard.
17. As for the possible grounds for ending prematurely the term to be served by the Head of the Authority, Hungary denied the alleged infringement but proposed amending the Law of 2011 in order to meet the concerns expressed by the Commission in that regard and, more specifically, to remove the provisions providing for the compulsory retirement or resignation of the Head of the Authority and to make available a judicial remedy for all cases in which the Head of the Authority disputed the decision of the President of the Republic, on the proposal of the Prime Minister, to end his term in office.
18. On 7 March 2012, the Commission sent Hungary a reasoned opinion, repeating its concerns regarding the premature termination of the Supervisor’s term in office and asking Hungary to take the necessary measures to comply with that opinion within a month of its notification. On the other hand, the Commission withdrew its reservations concerning the prior consultation of the Supervisor on the draft for the new statute. Lastly, as regards the possible grounds for compelling the Head of the Authority to vacate office, the Commission stated that if, by the deadline set by the reasoned opinion, Hungary had adopted the legislative amendments proposed in its reply to the letter of formal notice, the Commission would consider that the infringement in that regard had come to an end.
19. On 30 March 2012, Hungary replied to the Commission’s reasoned opinion, maintaining its point of view in relation to the ending of the Supervisor’s term in office, a position which prompted the Commission to bring the present action.
20. By order of the President of the Court of 8 January 2013, the European Data Protection Supervisor (EDPS) was granted leave to intervene in support of the form of order sought by the Commission.
21. At the hearing of 15 October 2013, oral argument was presented by the Commission, by Hungary and by the EDPS.
V – The action
A – Admissibility
1. Arguments of the parties
22. Hungary maintains that the present action is inadmissible.
23. According to Hungary, the only conceivable way of rectifying the alleged illegality would be to compel the current Head of the Authority to vacate office before serving his full term and to replace him with the Supervisor, which would amount in substance to committing the infringement alleged. Hungary argues that the Commission cannot apply to the Court for a judgment declaring a failure to fulfil obligations when the only way in which the Member State in question can comply with such a judgment is by infringing EU law. Moreover, the adoption of such a measure would give rise to an unconstitutional situation because it would be in breach of the principle of the independence of the Authority, established by the Fundamental Law.
24. Hungary also argues that the change in the framework governing the institutions responsible for the protection of personal data in Hungary meant that it was necessary, since the role of Supervisor was to be discontinued, also to remove from office the person who exercised that role. According to Hungary, to compel the current Head of the Authority to vacate office, in the absence of any institutional change, cannot be justified on similar legislative grounds.
25. Hungary also maintains that the Law of 2011 fully guarantees the independence of the Head of the Authority and thus meets the relevant requirements under Directive 95/46. It argues that, even if ending the Supervisor’s term in office prematurely constitutes a failure to respect the requirement of independence, that failure has had no effect on the Supervisor’s activity, any more than it prevents the Head of the Authority from carrying out his duties free from any external influence. In accordance with the aim of Directive 95/46, the right to personal data protection has been guaranteed continuously and at all times in Hungary, both before and after 1 January 2012. Hungary notes with satisfaction that the Commission itself acknowledges this, since it points out that the Hungarian legislation has ensured legal continuity by entrusting to the Authority the cases that were pending before the Supervisor. Consequently, Hungary maintains that, if ever there was any infringement, it has not, in any event, given rise to legal consequences that need to be rectified.
26. Hungary also argues that the alleged infringement had already produced all its effects by the deadline set in the Commission’s reasoned opinion and that it has had no impact, after 1 January 2012, on the operation of the Authority, especially on its independence. Consequently, the Commission’s action is devoid of purpose and therefore inadmissible.
27. Hungary contends that endorsement of the Commission’s arguments would mean that any acts carried out by the current Head of the Authority since 1 January 2012 are incompatible with EU law, entailing breach of the principle of legal certainty.
28. Hungary adds that — contrary to the Commission’s arguments set out in point 33 below and despite the fact that the words ‘limitation of temporal effects’ do not appear in the defence — it has clearly expressed, in the present proceedings before the Court, its hope that, if an infringement is established, that would not affect the term of office of the incumbent Head of the Authority.
29. The Commission submits that the present action is admissible.
30. The Commission contends that it is by no means impossible to rectify the infringement and Hungary must take the requisite measures enabling Mr Jóri to take up again the post provided for in Article 28 of Directive 95/46 and to serve his full term of office, that is to say, until September 2014. According to the Commission, the manner in which Hungary rectifies the infringement falls within the competence of that Member State and is irrelevant in the context of the present action. The Commission argues, moreover, that Hungary cannot invoke the independence of the Head of the Authority as grounds for not reinstating Mr Jóri. By so doing, it is relying on its own infringement as a defence.
31. According to the Commission, the question whether a Member State has failed to fulfil its obligations must be determined by reference to the situation prevailing in the Member State at the end of the period laid down in the reasoned opinion. On the basis of the Court’s case-law, the infringement accordingly continues if the effects of the measures taken in breach of EU law persist after that deadline. In the present case, the failure to fulfil obligations consists in the premature ending of the Supervisor’s term in office and persists owing to the fact that Mr Jóri was not reinstated upon expiry of the deadline.
32. As for Hungary’s argument, set out in point 23 above, that accepting the Commission’s action as admissible would mean compelling the Head of the Authority to vacate office without serving his full term, which could also lead to a situation contrary to the Fundamental Law, the Commission states that, in accordance with the principle of the primacy of EU law, EU law takes precedence over the constitutional provisions of the Member States. Furthermore, according to the Commission, the reform of the data protection supervisory authority by no means justified the premature termination of the Supervisor’s term in office. The Commission adds — and Hungary has not contested this in its defence — that it would have been quite possible to adopt a provision of national law either to the effect that the new system was to apply only upon expiry of the Supervisor’s term of office, or to the effect that the first Head of the Authority was to act as Supervisor for the remainder of that term of office.
33. The Commission maintains that Hungary’s argument, set out in point 28 above, that the establishment of an infringement in the present case would also have the effect of rendering the measures adopted by the Authority since 1 January 2012 incompatible with EU law should not be examined by the Court in conjunction with the admissibility of the action. That argument raises in reality the question whether or not the temporal scope of a judgment establishing an infringement covers the period preceding delivery of the judgment. According to the Commission, it is only exceptionally that the Court has been moved, in application of the general principle of legal certainty, to restrict for any person concerned the possibility of relying upon a provision that the Court has interpreted, with a view to calling in question legal relationships established in good faith. The Commission maintains that, in its defence, Hungary did not ask the Court to limit the temporal effects of a judgment establishing an infringement in the present case. Moreover, according to the Commission, Hungary has not established that the conditions required by the case-law in that regard have been met.
34. According to the Commission, the reinstatement of the Supervisor or his appointment as Head of the Authority would not mean that the decisions taken by the latter after 1 January 2012 were incompatible with EU law.
35. The EDPS has expressed no view on the admissibility of the action.
2. Assessment
36. I find myself unable to agree with Hungary’s argument that it would be impossible to comply with a judgment establishing the alleged infringement. There are two threads to that argument.
37. In the first place, Hungary asserts that the alleged infringement had already produced its effects by the end of the period set in the Commission’s reasoned opinion. I do not think so.
38. It is settled law that the question whether a Member State has failed to fulfil its obligations must be determined by reference to the situation of the Member State prevailing at the end of that period. (6)
39. Given that, under the Law of 1993, (7) the Supervisor’s term of office was not due to end until September 2014, I believe that the alleged infringement had not exhausted all its effects by the deadline set in the Commission’s reasoned opinion (8) and that to this day it continues to produce legal effects.
40. In the second place, Hungary objects that the Commission’s action is inadmissible because it would be impossible to comply with a judgment establishing an infringement without committing the same illegality found in the judgment. I do not agree with that argument either.
41. Where there is a finding of infringement, Article 260 TFEU requires the Member State concerned to take the measures necessary to comply with the judgment.
42. Even though the Court cannot, by its purely declaratory ruling, order the Member State found to have failed to fulfil its obligations to take specific measures, (9) all the institutions of that Member State, including the legislative, judicial and administrative authorities, must ensure, within their respective areas of competence, that the Court’s judgment is complied with, (10) which entails, inter alia, the duty not to apply legislation which is incompatible with EU law and the obligation to take all appropriate measures to facilitate the full application of EU law. (11)
43. Furthermore, the extension of a regime declared by a judgment of the Court to be contrary to EU law constitutes a serious infringement of the Member States’ obligation under Article 4(3) TEU to cooperate in good faith, which entails inter alia the obligation to refrain from any measures liable to jeopardise the attainment of the objectives of the European Union. (12)
44. Consequently, the establishment of an infringement in the present case would, in spite of its declaratory nature, carry significant legal implications which would necessarily affect the status of the current Head of the Authority — as Hungary itself points out (even though it does so in order to challenge any possible finding of an infringement).
45. In the light of the Hungarian legal and factual background described in points 6 to 12 above, the premature termination, on 31 December 2011, of the Supervisor’s term in office was intrinsically linked to the appointment of the Head of the Authority on 1 January 2012. Accordingly, if the Court were to find that, by compelling the Supervisor to vacate office before serving his full term, Hungary infringed the second subparagraph of Article 28(1) of Directive 95/46, it would follow that the appointment of the Head of the Authority is also, as the Commission maintains, unlawful. In fact, since 1 January 2012, the current Head of the Authority would have held office in breach of EU law.
46. I therefore reject as unfounded the arguments that it would be impossible to comply with a judgment establishing an infringement, because, as the Commission points out, such compliance could be achieved either by reinstating Mr Jóri as Supervisor for the remainder of his original term of office or by appointing him Head of the Authority.
47. Moreover, neither the question whether the Law of 2011 meets the criteria laid down in Directive 95/46 or whether the Authority acts independently nor the question whether compliance with a judgment establishing the infringement necessarily involves committing the same infringement found (13) has any bearing on the question whether the premature termination of the Supervisor’s term in office was in breach of the second subparagraph of Article 28(1) of that directive. (14)
48. To conclude otherwise would make it possible for a Member State to avoid any finding that some of its decisions were incompatible with EU law by relying on the pretext that other, subsequent decisions, which it was only possible to take following the infringement, are consistent with EU law and can be amended only by committing the same infringement again.
49. Nor am I persuaded by Hungary’s argument that the principle of legal certainty means that the present action cannot be admissible because establishment of the infringement alleged in the present case would render all acts accomplished by the Head of the Authority since 1 January 2012 incompatible with EU law.
50. The principle of legal certainty is a principle, common to all the legal orders of the Member States, which forms part of the legal order of the European Union and must, in any event, be observed by the bodies of the Member State concerned which are to ensure compliance with a judgment finding that that Member State has infringed EU law. However, without expressing an opinion regarding the merits of the argument that establishment of the alleged infringement would invalidate the acts carried out by the authority since 1 January 2012, it need only be pointed out that it is not for the Court, (15) but for the Hungarian national courts, to judge whether that principle has been infringed in specific cases and to take the appropriate measures, without compromising effective compliance with the Court’s judgment.
51. I would add, in passing, that the Court found that the Federal Republic of Germany (16) and the Republic of Austria (17) had failed to fulfil their obligations under the second subparagraph of Article 28(1) of Directive 95/46 notwithstanding the possible legal implications that those findings might entail for the measures adopted by the authorities in question.
52. In the section of my Opinion devoted to the substance of the action, (18) I shall examine Hungary’s application for the limitation in time of the effects of a judgment establishing the alleged failure to fulfil obligations.
53. I therefore propose that the action be held admissible.
B – Substance
1. Arguments of the parties
54. The Commission does not dispute that Hungary has the right to amend its supervisory system for the protection of personal data provided that it guarantees the complete independence of the authority which exercises that supervision, which, as the case-law shows, (19) goes beyond mere functional independence to entail the exclusion of any form of constraint, whether institutional, personal or physical.
55. According to the Commission, supported by the EDPS, it is essential that, once the Member State has established the authority’s term of office, it must respect that term and must not compel the authority to vacate office before serving its full term, except for overriding and objectively verifiable reasons. Premature termination of the term in office creates the risk of undue influence on the supervisory authority in the exercise of its tasks, which would compromise its independence. The Commission argues that this interpretation is borne out by a comparison with the rules relating to the EDPS laid down in Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data. (20)
56. The Commission submits that the reform of the Hungarian supervisory authority did not justify prematurely bringing to an end the Supervisor’s term in office. It would have been quite possible for Hungary to provide in its domestic law either that the new model was not to apply until the term of office of the Supervisor had expired or that the first Head of the Authority was to be none other than the person holding the office of supervisor, who would continue to serve for the remaining period of his term of office: either approach would have preserved the independence of the supervisory authority for data protection. The Commission points out that, in other respects, Hungary ensured continuity between the old and the new supervisory authority, especially with regard to pending cases and data-processing.
57. However, according to the Commission, to accept that it was necessary to terminate the Supervisor’s term in office, because his post ‘no longer existed’, would mean that every supervisory authority in the European Union would constantly be under threat of having its term of office interrupted by a legislative measure removing the existing authority and creating in its place a new authority entrusted with the same tasks, such as those defined in Article 28 of Directive 95/46. It is always conceivable that the political powers might use such reforms to control and impose sanctions on supervisory authorities with whom they are in disagreement. The Commission points out that, according to the Court’s case-law, the mere risk of such influence is incompatible with the requirement that the supervisory authorities should have complete independence. (21)
58. The Commission submits that Hungary has not established that the Supervisor had refused to be Head of the Authority and that statements made by the Supervisor during interviews published in the Hungarian press are irrelevant. The Commission points out that, under Article 15(3) of the Law of 1993, the Supervisor’s resignation had to be notified in writing to the President of the Hungarian Parliament. As there had been no such notification, Hungary could not assume, on the strength of vague statements in the press, that the Supervisor was no longer prepared to carry out his tasks as laid down in Article 28 of Directive 95/46. The Commission adds that Hungary never offered the new role to Mr Jóri and never assured him that transitional rules would be adopted in order to enable him to serve his full term of office.
59. Hungary contends that, since the premature termination of the Supervisor’s term in office was linked to a change of institutional model, it does not constitute an infringement of the second subparagraph of Article 28(1) of Directive 95/46. It is clear from the relevant case-law that both Article 28 of that directive and Article 44 of Regulation No 45/2001 require personal data protection authorities, both national and European, to be guaranteed complete independence ‘in exercising [their] functions’ — that is to say, from a functional point of view. According to Hungary, that ‘functional independence’ covers everything that goes to ensure that the supervisory authority exercises the tasks entrusted to it without suffering any direct or indirect external influence, which includes the elements ensuring the organisational, budgetary and personal independence that the authority must enjoy in the accomplishment of its tasks.
60. Hungary points out that it is not disputed, in the present case, that the Authority operates, as did its predecessor, in a legal environment which protects it from any external influence in the exercise of its supervision of data protection and that, in every respect, it meets the requirement of independence laid down in Article 28 of Directive 95/46. In that regard, Hungary contends that no parallel can be drawn between the situation in the present case and the circumstances of the cases that led to the judgments in Case C‑518/07 Commission v Germany and Commission v Austria. Hungary argues that, by contrast, neither the German nor the Austrian legislation had set up a legal mechanism to guard against the risk that the independence of the national authority responsible for supervising data protection might be affected in the exercise of the ‘functions entrusted to it’.
61. According to Hungary, the rationale underlying the requirement of independence laid down in Article 28 of Directive 95/46 is that, in each Member State, there should always be an authority responsible for supervising data protection which carries out its tasks free of external influence. Hungary argues that the notion of independence does not vest in the head of that authority a right, accruing to that individual person, to carry out that task. In the light of the institutional change introduced, it is not justifiable to expect the new legislation automatically to entrust the Supervisor with the role of Head of the Authority. Since the functional independence of the supervisory authority is intact, it is of little importance that a change has occurred regarding the person in charge of that authority even before the incumbent has served his full term of office.
62. Hungary contends that it is for the Member States to define the organisational structure of the national authorities responsible for protecting personal data. That means that the choice of entity or person entrusted with the exercise of the Authority’s powers within the organisational model selected and the replacement of that entity or person at the same time as a change in the organisational model also fall within the competence of the Member States. Hungary points out that the legislation relating to the Supervisor was completely replaced — on the basis of the new provisions of the Fundamental Law — by new legislation which transferred the tasks formerly accomplished by the Supervisor to a new data protection authority. Despite similarities between the rights and duties of the Supervisor and those of the Head of the Authority, which are explained by the requirement of independence, they are two quite distinct public law institutions.
63. According to Hungary, the appointment of the Supervisor to this new post would have been unjustified and incomprehensible, in view of a number of public statements that he had made expressing disagreement in principle with the new institutional model and his intention not to accept that appointment.
2. Assessment
a) Principles
64. It should be pointed out, first of all, that the Commission by no means disputes Hungary’s right to alter the institutional model for its data protection supervisory authority by changing from a structure managed by a single person to a collegiate body. On the other hand, the Commission considers that, when Hungary made those choices, it failed to fulfil its obligation to respect the independence of the Supervisor until his term of office had expired.
65. It is settled law that the need for supervision of the protection of personal data by an independent authority is an essential component of the protection of individuals with regard to the processing of personal data, (22) which derives not only from the second subparagraph of Article 28(1) of Directive 95/46, but also from the primary law of the European Union and, in particular, from Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU. (23) The supervisory authorities provided for in Article 28 of Directive 95/46 are therefore the guardians of fundamental rights and freedoms with respect to the processing of personal data. (24)
66. In Case C‑518/07 Commission v Germany and in Commission v Austria, referred to above, the Court gave an autonomous (25) and broad (26) interpretation to the words ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46. It based that interpretation on the actual wording of that provision, noting that the concept of ‘independence’ is reinforced by the adjective ‘complete’, and on the aim of guaranteeing the independence of national supervisory authorities in order to ensure the effectiveness and reliability of the supervision of compliance with the provisions on the protection of individuals with regard to the processing of personal data. (27)
67. The Court referred to the fact that that guarantee was established not to grant a special status to those authorities themselves as well as to their agents, but in order to strengthen the protection of individuals and bodies affected by their decisions. (28) It follows that, when carrying out their duties, the supervisory authorities must act objectively and impartially and remain free from any external influence, direct or indirect, which is liable to have an effect on their decisions. (29)
68. The mere risk of such an influence is enough to infringe the second subparagraph of Article 28(1) of Directive 95/46. (30)
69. In that regard, it emerges from Commission v Austria that any action that could lead to a form of ‘prior compliance’ (31) on the part of the data protection supervisory authority is inconsistent with the requirement for ‘complete independence’ which the Member States must guarantee their supervisory authority under the second subparagraph of Article 28(1) of Directive 95/46 and the primary law of the European Union.
70. I believe, as does the Commission, that, although each Member State may adopt the institutional arrangements that it considers most appropriate for its country and, accordingly, may alter those arrangements subsequently, it may do so on condition that the adoption or the subsequent alteration does not compromise the overriding requirement of ‘complete independence’ imposed under the second subparagraph of Article 28(1) of Directive 95/46.
71. I share the Commission’s view that the independence of that authority ‘must involve a term of office of a predetermined duration’ (32) and that his tenure must be assured until that term of office expires, unless this is precluded for overriding reasons, pre-determined by law and objectively verifiable, linked to his conduct or to his ability to carry out his duties.
72. The intrinsic link between that security of tenure throughout the term of office and the requirement of ‘complete independence’ is indisputable. (33) By analogy, the independence of a judge cannot be regarded as respected if his duties are prematurely terminated under cover of the dismantling of the court in which he sits and its replacement by another court, even if the latter court is accorded independence.
73. The mere risk that it might be compelled to vacate office before serving its full term may expose the authority to which the second subparagraph of Article 28(1) of Directive 95/46 refers to ‘undue intervention or pressure’ (34) and lead to a form of ‘prior compliance’ on its part.
74. It follows that, even though Member States have a measure of discretion as to the institutional structure of the authority provided for under the second subparagraph of Article 28(1) of Directive 95/46, (35) it cannot reasonably be denied that ‘complete independence’ as required under EU law is predicated upon the existence and observance of specific and detailed rules, which — as regards that authority’s appointment and term of office and the possible grounds for revoking its powers or dismantling that authority — dispel any reasonable doubt as to the imperviousness of that authority to external factors, whether direct or indirect, which might influence its decisions. (36)
b) Application to the case under consideration
75. It can be seen from the documents before the Court that the terms of the Supervisor’s mandate were the subject of specific and detailed provisions in Hungarian law. Under Article 4(5) of the Law of 1993, he was elected in 2008 for six years and could be re-elected once. Article 15 of that law governed, and strictly limited, the circumstances in which the Supervisor could be compelled to vacate office before serving his full term. (37)
76. In my view, the Commission has demonstrated adequately that the Supervisor’s term was brought to an end on 31 December 2011 in infringement of Article 15 of the Law of 1993, and that the procedural safeguards introduced by that instrument in order to protect his term of office were not observed. Moreover, when the institutional changes came into effect in 2012, Hungary did not adopt any transitional measures with a view to respecting the terms of the Supervisor’s mandate and, accordingly, his independence.
77. Hungary emphasises that it was the constitutional authority which decided on the ‘change of model’ introduced by the new legislation that entered into force on 1 January 2012, and that the Head of the Authority, on the one hand, and the Supervisor, on the other, are two quite different public offices which are not required to be linked to each other by the fact that the same person holds both.
78. These arguments do not convince me.
79. To my mind, the Commission has demonstrated adequately that, even if the Authority has a different legal status from the Supervisor and operates in accordance with different rules, it has succeeded him in the exercise of the tasks attributed to the supervisory authority under Article 28 of Directive 95/46. Both the Supervisor and the Authority were established by Hungary in order to meet the obligation under that provision to provide for a public authority responsible for monitoring on its territory the provisions adopted by that Member State pursuant to Directive 95/46. The two entities are therefore identical from the point of view of the task carried out in accordance with the above provision. Furthermore, continuity between the two entities has been ensured by Article 75(1) and (2) of the Law of 2011, under which the Authority is to handle the files opened by the Supervisor before 1 January 2012 and to process the data which the Supervisor processed before that date.
80. As for the fact that the institutional change was decided by the constitutional authority, it is clear, first of all, from the documents before the Court that the Authority itself was created by an organic law, that is to say, by the Law of 2011 and not by the Fundamental Law. (38) Moreover, institutional changes, even those brought about by means of constitutional laws, cannot compromise the effectiveness of the higher obligation imposed by EU law as regards the guarantee of ‘complete independence’, since the primacy of EU law applies whatever the nature of the national rule at issue. Such changes cannot therefore justify compelling the data protection supervisor to vacate office before serving his full term. As the Commission and the EDPS have argued, if such circumstances were to be accepted as justification, any authority in a higher position, whether wielding legislative or constitutional power, would be able to exert undue external influence on the data protection supervisory authority simply through the threat, express or implied, that such changes might be made and that the supervisory authority provided for under Article 28(1) of Directive 95/46 might be compelled to vacate office without serving his full term — possibly prompting thereby a form of ‘prior compliance’. (39)
81. Lastly, I do not regard as relevant Hungary’s assertion that the Supervisor could not be appointed as Head of the Authority following his public statements expressing his intention not to accept that appointment. Notwithstanding the fact that such statements published in the press have no legal value in the light of the strict requirements imposed by Article 28 of Directive 95/46 and by Article 15 of the Law of 1993, (40) Hungary has not contended that the post in question was officially offered to the Supervisor. I note, moreover, on reading Hungary’s response of 30 March 2012 to the reasoned opinion, that the Supervisor, Mr Jóri, had expressed his disapproval of the Law of 2011, adding that he would not have accepted the appointment as Head of the Authority if it had been offered to him because, in his view, the Authority did not meet the independence requirement under Directive 95/46. During the pre-litigation procedure, the Commission itself voiced the same criticisms and some of them — with the exception of those relating to the possible grounds for prematurely terminating the Supervisor’s term in office — were ultimately taken into account by Hungary in legislative amendments. (41) Moreover, the Supervisor’s official comments of 10 and 22 June 2011 (42) concerning the draft of the new law, in which he stated that the lack of transitional provisions constituted an infringement of his independence, and which were therefore comments made in the exercise of his official role as supervisory authority established in accordance with Article 28 of Directive 95/46, cannot in any event be held against him and could not be construed as an announcement of his resignation.
82. I therefore consider that, by prematurely bringing to an end the term to be served by the data protection supervisory authority, Hungary has failed to fulfil its obligations under Directive 95/46.
83. I would add that a judgment of the Court establishing an infringement in the present case would have great significance not only for the authorities created pursuant to Article 28(1) of Directive 95/46, but also for any other independent authority established in accordance with EU law. By assuring those independent authorities that they enjoy security of tenure until their term of office expires, except where this is precluded for overriding reasons pre-determined by law and objectively verifiable, the effect of such a judgment would be to diminish considerably the damaging risk of ‘prior compliance’ with external parties, whether public or private. Such a judgment would remove the ‘sword of Damocles’ represented by the paralysing risk that their term in office might be prematurely terminated.
VI – The temporal effects of a finding of failure to fulfil obligations
84. Hungary has requested that, in the event that the Court upholds the Commission’s action, the effects of the judgment be limited in time (43) so as not to affect the term of office of the current Head of the Authority. It maintains that the implications of the principle of legal certainty also preclude the reopening of cases which have been definitively closed.
85. It should be noted that ‘it is only exceptionally that the Court may, in application of the general principle of legal certainty inherent in the [EU] legal order, be moved to restrict for any person concerned the opportunity of relying upon a provision which it has interpreted with a view to calling in question legal relationships established in good faith.’ (44) It is also settled law that the financial consequences that a preliminary ruling might entail for a Member State do not in themselves justify limiting the temporal effects of the ruling. (45)
86. ‘The Court has taken such a step only in certain specific circumstances, where there was a risk of serious economic repercussions owing in particular to the large number of legal relationships entered into in good faith on the basis of rules considered at the time to be validly in force, and where it appears that both individuals and national authorities have been led to adopt practices which did not comply with EU law by reason of objective, significant uncertainty regarding the implications of EU provisions, to which the conduct of other Member States or the Commission may even have contributed.’ (46)
87. ‘Even if judgments delivered under Article [258 TFEU] were to have the same effects as those delivered under Article [267 TFEU] and even if, therefore, considerations of legal certainty might, exceptionally, make it necessary to limit their temporal effects’, (47) I consider that — assuming that Hungary’s request has been formulated correctly — it should be refused.
88. Hungary has in no way established the existence of serious economic problems or shown that, at the time when the law creating the Authority was adopted, it experienced objective and significant uncertainty regarding the scope of the second subparagraph of Article 28(1) of Directive 95/46.
89. At that time, in fact, the Court had already interpreted the expression ‘complete independence’ used in the second subparagraph of Article 28(1) of Directive 95/46. (48) EU law could not reasonably have been understood as authorising Hungary to bring to an end, prematurely, the Supervisor’s term in office. (49)
VII – Costs
90. Under Article 138(1) of the Rules of Procedure of the Court of Justice, the unsuccessful party must be ordered to pay the costs if they have been applied for in the other party’s pleadings. As the Commission seeks an order for costs against Hungary and Hungary must, in my view, be unsuccessful, I consider that Hungary must be ordered to pay the costs. In accordance with Article 140 of the Rules of Procedure, the EDPS should bear his own costs.
VIII – Conclusion
91. In the light of the foregoing considerations I propose that the Court should:
– declare that, by prematurely bringing to an end the term served by the data protection supervisor, Hungary has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
– order Hungary to bear its own costs and to pay the costs incurred by the European Commission; and
– order the European Data Protection Supervisor to bear his own costs.