Implications for PSI Re-use policy and regulation
Source: European Court of Justice & European Data Protection Supervisor (EDPS)
Court of Justice Decision on Federal Republic of Germany failure to fulfil its obligations with respect to Directive 95/46/EC
Luxembourg: 9 March 2010
The European Court of Justice announced the judgement on the case brought by the European Commission against the Federal Republic of Germany with respect to the implementation of Directive 95/46/EC.
The announcement states:
“Failure of a Member State to fulfil obligations – Infringement of the second sentence of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) – Obligation of Member States to ensure that the national supervisory authorities responsible for monitoring the processing of personal data act with complete independence in exercising their functions – Submission to State monitoring of the supervisory authorities of the Länder responsible for monitoring the processing of personal data in the private sector
Advocate General : Mazák”
--
The Judgement states:
“By its application, the Commission of the European Communities requests the Court to declare that, by making the authorities responsible for monitoring the processing of personal data outside the public sector in the different Länder subject to State oversight, and by thus incorrectly transposing the requirement of ‘complete independence’ of the supervisory authorities responsible for ensuring the protection of that data, the Federal Republic of Germany has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) (‘Directive 95/46’).”
“On those grounds, the Court (Grand Chamber) hereby:
- Declares that, by making the authorities responsible for monitoring the processing of personal data by non-public bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen) in the different Länder subject to State scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions ‘with complete independence’, the Federal Republic of Germany failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;
- Orders the Federal Republic of Germany to pay the costs of the Commission;
- Orders the European Data Protection Supervisor (EDPS) to bear his own costs.”
---
The European Data Protection Supervisor press release EDPS/10/4 titled: EDPS welcomes Court of Justice's ruling strengthening independent position of data protection authorities states:
“Today, the Court of Justice decided that data protection authorities in the German Länder which supervise the processing of personal data in the private sector are not acting with "complete independence" as required by the Data Protection Directive 95/46/EC.
The case was brought by the Commission which argued that since these data protection authorities are part of the regional administration and subject to State scrutiny, they were not acting in complete independence. The German government stated that sufficient independence was ensured by making these authorities independent from the parties they supervise. The European Data Protection Supervisor (EDPS) intervened in the case in support of the arguments of the Commission.
The EDPS is very pleased with the judgment. Peter Hustinx, EDPS, stated: "The judgment of the Court is of great importance. It strengthens and clarifies the position of data protection authorities as part of the fundamental right to data protection. This judgment is relevant for all supervisory authorities in all EU Member States."
The Court confirmed the position of the Commission. It considered that "complete independence" means that the supervisory authority should be able to make decisions independently from any direct or indirect external influence. An authority must not only be independent from the parties it supervises, but must also not be part of government since the government itself may be an interested party. The German government argued that the State scrutiny in Germany sought only to guarantee the legality of the acts of the data protection authorities and not to exert any political influence. However, the Court considered that the existence of such State scrutiny means that the possibility remains that the authorities are not able to act objectively.
In its judgment the Court stated clearly that supervisory authorities are "an essential component of the protection of individuals with regard to the processing of personal data". “
Relevance to the re-use of Public Sector Information
The European Court of Justice judgement on independence of data protection regulators sets a principle on independence and as such has implications for Member States when implementing public sector information policy.