Case C-518/07

European Commission

v

Federal Republic of Germany

(Failure of a Member State to fulfil obligations – Directive 95/46/EC – Protection of individuals with regard to the processing of personal data and the free movement of such data – Article 28(1) – National supervisory authorities – Independence – Administrative scrutiny of those authorities)

Summary of the Judgment

1. Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – National supervisory authorities

(European Parliament and Council Directive 95/46, Art. 28(1))

2. Approximation of laws – Protection of individuals with regard to the processing of personal data – Directive 95/46 – National supervisory authorities

(European Parliament and Council Directive 95/46, Art. 28(1))

1. The guarantee of the independence of national supervisory authorities, provided for by the second subparagraph of Article 28(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, is intended to ensure the effectiveness and reliability of the supervision of compliance with the provisions on protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. It was established, not to grant a special status to those authorities themselves and their agents, but in order to strengthen the protection of individuals and bodies affected by their decisions. It follows that, when carrying out their duties, the supervisory authorities must act objectively and impartially. For that purpose, they must remain free from any external influence, including the direct or indirect influence of the State or the Länder, and not of the influence only of the supervised bodies.

Consequently, the supervisory authorities responsible for supervising the processing of personal data outside the public sector must enjoy an independence allowing them to perform their duties free from external influence. That independence precludes not only any influence exercised by the supervised bodies, but also any directions or any other external influence, whether direct or indirect, which could call into question the performance by those authorities of their task consisting of establishing a fair balance between the protection of the right to private life and the free movement of personal data.

(see paras 25, 30)

2. The mere risk that the scrutinising authorities could exercise a political influence over the decisions of the supervisory authorities responsible for monitoring the processing of personal data, provided for by the second subparagraph of Article 28(1) of Directive 95/46 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, is enough to hinder the latter authorities’ independent performance of their tasks. First, there could be ‘prior compliance’ on the part of those authorities in the light of the scrutinising authority’s decision-making practice. Secondly, for the purposes of the role adopted by those supervisory authorities as guardians of the right to private life, it is necessary that their decisions, and therefore the authorities themselves, remain above any suspicion of partiality. The State scrutiny exercised over the national supervisory authorities responsible for supervising the processing of personal data outside the public sector is therefore not consistent with the requirement of independence.

Consequently, by making the authorities responsible for monitoring the processing of personal data by non-public bodies and undertakings governed by public law which compete on the market in the different Länder subject to State scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions with complete independence, a Member State fails to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46.

(see paras 36-37, 56, operative part)

JUDGMENT OF THE COURT (Grand Chamber)

9 March 2010 ( * )

(Failure of a Member State to fulfil obligations – Directive 95/46/EC – Protection of individuals with regard to the processing of personal data and the free movement of such data – Article 28(1) – National supervisory authorities – Independence – Administrative scrutiny of those authorities)

In Case C‑518/07,

ACTION under Article 226 EC for failure to fulfil obligations, brought on 22 November 2007,

European Commission, represented by C. Docksey, C. Ladenburger and H. Krämer, acting as Agents, with an address for service in Luxembourg,

applicant,

supported by:

European Data Protection Supervisor, represented by H. Hijmans and A. Scirocco, acting as Agents, with an address for service in Luxembourg,

intervener,

v

Federal Republic of Germany, represented by M. Lumma and J. Möller, acting as Agents, with an address for service in Luxembourg,

defendant,

THE COURT (Grand Chamber),

composed of V. Skouris, President, A. Tizzano, J.N. Cunha Rodrigues, K. Lenaerts, J.-C. Bonichot and E. Levits, Presidents of Chambers, A. Rosas, K. Schiemann (Rapporteur), J.-J. Kasel, M. Safjan and D. Šváby, Judges,

Advocate General: J. Mazák,

Registrar: R. Grass,

having regard to the written procedure,

after hearing the Opinion of the Advocate General at the sitting on 12 November 2009,

gives the following

Judgment

1 By its application, the Commission of the European Communities requests the Court to declare that, by making the authorities responsible for monitoring the processing of personal data outside the public sector in the different Länder subject to State oversight, and by thus incorrectly transposing the requirement of ‘complete independence’ of the supervisory authorities responsible for ensuring the protection of that data, the Federal Republic of Germany has failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31) (‘Directive 95/46’).

Legal context

Community legislation

2 Directive 95/46 was adopted on the basis of Article 100a of the EC Treaty (now, after amendment, Article 95 EC) and seeks to harmonise the national laws on the processing of personal data.

3 The 3rd, 7th, 8th, 10th and 62nd recitals in the preamble to Directive 95/46 are worded as follows:

‘(3) Whereas the establishment and functioning of an internal market in which, in accordance with Article 7a of the Treaty [(now Article 14(2) EC)], the free movement of goods, persons, services and capital is ensured require not only that personal data should be able to flow freely from one Member State to another, but also that the fundamental rights of individuals should be safeguarded;

…

(7) Whereas the difference in levels of protection of the rights and freedoms of individuals, notably the right to privacy, with regard to the processing of personal data afforded in the Member States may prevent the transmission of such data from the territory of one Member State to that of another Member State; whereas this difference may therefore constitute an obstacle to the pursuit of a number of economic activities at Community level, distort competition and impede authorities in the discharge of their responsibilities under Community law; whereas this difference in levels of protection is due to the existence of a wide variety of national laws, regulations and administrative provisions;

(8) Whereas, in order to remove the obstacles to flows of personal data, the level of protection of the rights and freedoms of individuals with regard to the processing of such data must be equivalent in all Member States; whereas this objective is vital to the internal market but cannot be achieved by the Member States alone, especially in view of the scale of the divergences which currently exist between the relevant laws in the Member States and the need to coordinate the laws of the Member States so as to ensure that the cross-border flow of personal data is regulated in a consistent manner that is in keeping with the objective of the internal market as provided for in Article 7a of the Treaty; whereas Community action to approximate those laws is therefore needed;

…

(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognised both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms [signed at Rome on 4 November 1950 (‘the ECHR’)] and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;

…

(62) Whereas the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of personal data’.

4 Article 1 of Directive 95/46, entitled ‘Object of the Directive’, is worded as follows:

‘(1) In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.

(2) Member States shall neither restrict nor prohibit the free flow of personal data between Member States for reasons connected with the protection afforded under paragraph 1.’

5 Article 28 of Directive 95/46, entitled ‘Supervisory authority’, provides:

‘(1) Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.

These authorities shall act with complete independence in exercising the functions entrusted to them.

(2) Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data.

(3) Each authority shall in particular be endowed with:

– investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,

– effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,

– the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.

Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.

(4) Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim.

Each supervisory authority shall, in particular, hear claims for checks on the lawfulness of data processing lodged by any person when the national provisions adopted pursuant to Article 13 of this Directive apply. The person shall at any rate be informed that a check has taken place.

(5) Each supervisory authority shall draw up a report on its activities at regular intervals. The report shall be made public.

(6) Each supervisory authority is competent, whatever the national law applicable to the processing in question, to exercise, on the territory of its own Member State, the powers conferred on it in accordance with paragraph 3. Each authority may be requested to exercise its powers by an authority of another Member State.

The supervisory authorities shall cooperate with one another to the extent necessary for the performance of their duties, in particular by exchanging all useful information.

(7) Member States shall provide that the members and staff of the supervisory authority, even after their employment has ended, are to be subject to a duty of professional secrecy with regard to confidential information to which they have access.’

6 Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1) was adopted on the basis of Article 286 EC. Article 44(1) and (2) of that regulation provide:

‘(1) The European Data Protection Supervisor shall act in complete independence in the performance of his or her duties.

(2) The European Data Protection Supervisor shall, in the performance of his or her duties, neither seek nor take instructions from anybody.’

National legislation

7 Concerning the protection of individuals with regard to the processing of personal data of individuals, German law makes a distinction depending on whether or not that processing is carried out by public bodies.

8 There is therefore a difference between the authorities responsible, on the one hand, for monitoring compliance with the provisions concerning data protection by public bodies and, on the other hand, for monitoring compliance with data protection by non-public bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen) (‘outside the public sector’).

9 The processing of data by public bodies is supervised, at Federal level, by the Federal representative responsible for the protection of personal data and freedom of information (‘Bundesbeauftragter für den Datenschutz und die Informationsfreiheit’) and, at regional level, by the representatives responsible for the protection of regional data (‘Landesdatenschutzbeauftragte’). Those representatives are solely responsible to their respective parliament and are not normally subject to any scrutiny, instruction or other influence from the public bodies which are the subjects of their supervision.

10 On the other hand, the organisation of the authorities responsible for supervising the processing of data by non-public bodies varies among the Länder. However, all the laws at Länder level expressly subject those supervisory authorities to State scrutiny.

Pre-litigation procedure and proceedings before the Court

11 As it considers that it is an infringement of the second subparagraph of Article 28(1) of Directive 95/46 for the authority responsible for ensuring that non-public bodies comply with the provisions on the protection of individuals with regard to the processing of personal data to be subject to State scrutiny, as is the case in all the German Länder, on 5 July 2005 the Commission sent a letter of formal notice to the Federal Republic of Germany. The latter replied by letter dated 12 September 2005 maintaining that the relevant German system of supervision complies with the requirements of that directive. On 12 December 2006, the Commission then sent a reasoned opinion to the Federal Republic of Germany, reiterating the complaint made previously. In its reply of 14 February 2007, the Federal Republic of Germany reaffirmed its original position.

12 It was in those circumstances that the Commission decided to bring the present action.

13 By order of 14 October 2008, the President of the Court granted leave to the European Data Protection Supervisor (‘the EDPS’) to intervene in the present case in support of the form of order sought by the Commission.

The action

Arguments of the parties

14 The present dispute concerns two different interpretations that the Commission, supported by the EDPS, and the Federal Republic of Germany have of the words ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46 and of the exercise of the supervisory authorities’ functions concerning protection of individuals with regard to the processing of personal data.

15 In the view of the Commission and the EDPS, which rely on a broad interpretation of the words ‘with complete independence’, the requirement that the supervisory authorities exercise their functions ‘with complete independence’ must be interpreted as meaning that a supervising authority must be free from any influence, whether that influence is exercised by other authorities or outside the administration. The fact that the authorities responsible for ensuring compliance with the provisions on the protection of individuals with regard to the processing of personal data outside the public sector are subject to State scrutiny in Germany constitutes an infringement of that requirement.

16 The Federal Republic of Germany proposes, on the contrary, a narrower interpretation of the words ‘with complete independence’ and maintains that the second subparagraph of Article 28(1) of Directive 95/46 requires the supervisory authorities to have functional independence in the sense that those authorities must be independent of bodies outside the public sector which are under their supervision and that they must not be exposed to external influences. However, in the view of the Federal Republic of Germany, the State scrutiny exercised in the German Länder does not constitute such an external influence, but rather the administration’s internal monitoring mechanism, implemented by the authorities attached to the same administrative machinery as the supervisory authorities and required, like the latter, to fulfil the aims of Directive 95/46.

Findings of the Court

The scope of the requirement of independence of the supervisory authorities

State Scrutiny

The principles of Community law pleaded by the Federal Republic of Germany

38 The Federal Republic of Germany contends that it would be contrary to various principles of European Community law to interpret the requirement of independence in the second subparagraph of Article 28(1) of Directive 95/46 in a way which would oblige that Member State to renounce its tried and tested system of scrutiny of the supervisory authorities with regard to the processing of personal data outside the public sector.

39 First, in the opinion of that Member State, the principle of democracy, in particular, precludes a broad interpretation of that requirement of independence.

40 That principle, which is enshrined not only in the German constitution, but also in Article 6(1) EU, requires that the administration be subject to the instructions of the government which is accountable to its parliament. Thus, the legality of interventions concerning the rights of citizens and undertakings should be subject to the scrutiny of the competent minister. Since the supervisory authorities responsible for the protection of individuals with regard to the processing of personal data have certain powers of intervention with regard to citizens and entities outside the public sector under Article 28(3) of Directive 95/46, a heightened scrutiny of the legality of their activities by means of instruments for monitoring legality or substance is absolutely necessary.

47 Secondly, the principle of conferred powers enshrined in the first paragraph of Article 5 EC, also pleaded by the Federal Republic of Germany, obliges the Community to act within the limits of the powers conferred on it and of the objectives assigned to it by the EC Treaty.

48 The Federal Republic of Germany contends in that regard that the independence of the supervisory authorities in relation to the higher administrative authorities could not be required on the basis of Article 100A of the EC Treaty, which serves as the basis of Directive 95/46.

49 That provision empowers the Community legislature to adopt measures to improve the conditions for the establishment and functioning of the internal market and they must genuinely have that object, contributing to the elimination of obstacles to the economic freedoms guaranteed by the EC Treaty (see, in particular, Case C‑376/98 Germany v Parliament and Council [2000] ECR I‑8419, paragraphs 83, 84 and 95; Case C‑491/01 British American Tobacco (Investments) and Imperial Tobacco [2002] ECR I‑11453, paragraph 60; and Case C‑436/03 Parliament v Council [2006] ECR I‑3733, paragraph 38).

50 As has already been stated, the independence of the supervisory authorities, in so far as they must be free from any external influence liable to have an effect on their decisions, is an essential element in light of the objectives of Directive 95/46. That independence is necessary in all the Member States in order to create an equal level of protection of personal data and thereby to contribute to the free movement of data, which is necessary for the establishment and functioning of the internal market.

51 In light of the foregoing, a broad interpretation of the requirement of independence of the supervisory authorities does not go beyond the limits of the powers granted to the European Community under Article 100a of the EC Treaty, which is the legal basis of Directive 95/46.

52 In the third place, the Federal Republic of Germany pleads the principles of subsidiarity and proportionality, in the second and third paragraphs of Article 5 EC, and the principle of cooperation in good faith between the Member States and the Community institutions enshrined in Article 10 EC.

53 It notes in particular Paragraph 7 of the Protocol on the application of the principles of subsidiarity and proportionality, annexed to the EU Treaty and the EC Treaty by the Treaty of Amsterdam, according to which, without prejudice to Community law, care should be taken to respect well established national arrangements and the organisation and working of Member States’ legal systems.

54 It would be inconsistent with that requirement to oblige the Federal Republic of Germany to adopt a system which is foreign to its legal order and, thus, to give up an effective supervisory system established for almost 30 years and which has acted as a model for legislation on the protection of data, well beyond the national level.

55 Those arguments cannot be accepted. As was stated in paragraphs 21 to 25 and 50 of the present judgment, the interpretation of the requirement of independence enshrined in the second subparagraph of Article 28(1) of Directive 95/46 as meaning that it precludes State scrutiny does not go beyond what is necessary to achieve the objectives of the EC Treaty.

56 Having regard to all of the foregoing considerations, it must be held that, by making the authorities responsible for monitoring the processing of personal data by non-public bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen) in the different Länder subject to State scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions ‘with complete independence’, the Federal Republic of Germany failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46.

Costs

57 Under Article 69(2) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the Commission has applied for costs and the Federal Republic of Germany has been unsuccessful, the latter must be ordered to pay the costs.

58 The EDPS is ordered to bear its own costs.

On those grounds, the Court (Grand Chamber) hereby:

1. Declares that, by making the authorities responsible for monitoring the processing of personal data by non-public bodies and undertakings governed by public law which compete on the market (öffentlich-rechtliche Wettbewerbsunternehmen) in the different Länder subject to State scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions ‘with complete independence’, the Federal Republic of Germany failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

2. Orders the Federal Republic of Germany to pay the costs of the Commission;

3. Orders the European Data Protection Supervisor (EDPS) to bear his own costs.

[Signatures]

* Language of the case: German.