European Commission v Republic of Austria.
Date: 2012-10-16
36. The second subparagraph of Article 28(1) of Directive 95/46 requires Member States to set up one or more supervisory authorities for the protection of personal data which have complete independence in exercising the functions entrusted to them. In addition, the requirement that compliance with European Union rules on the protection of individuals with regard to the processing of personal data is subject to control by an independent authority derives from the primary law of the European Union, inter alia Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU.
37. The establishment in Member States of independent supervisory authorities is thus an essential component of the protection of individuals with regard to the processing of personal data (Case C-518/07 Commission  v Germany  [2010] ECR I-1885, paragraph 23).
40. It follows from the judgment in Commission  v Germany  that the words ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46 must be given an autonomous interpretation, independent of Article 267 TFEU, based on the actual wording of that provision and on the aims and scheme of Directive 95/46 (see Commission  v Germany , paragraphs 17 and 29).
41. The Court has already held in its judgment in Commission  v Germany , paragraph 30, that the words ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46 must be interpreted as meaning that the supervisory authorities for the protection of personal data must enjoy an independence which allows them to perform their duties free from external influence. The Court also stated in that judgment that those authorities must remain free from any external influence, direct or indirect, which is liable to have an effect on their decisions (see, to that effect, Commission  v Germany , paragraphs 19, 25, 30 and 50).
42. The fact that the DSK has functional independence in so far as, in accordance with Paragraph 37(1) of the DSG 2000, its members are ‘independent and [are not] bound by instructions of any kind in the performance of their duties’ is, admittedly, an essential condition in order for that authority to satisfy the criterion of independence within the meaning of the second subparagraph of Article 28(1) of Directive 95/46. However, contrary to what the Republic of Austria maintains, such functional independence is not by itself sufficient to protect that supervisory authority from all external influence.
43. The independence required under the second subparagraph of Article 28(1) of Directive 95/46 is intended to preclude not only direct influence, in the form of instructions, but also, as noted in paragraph 41 above, any indirect influence which is liable to have an effect on the supervisory authority’s decisions.
51. Suffice it to point out, in this regard, that it is conceivable that the evaluation of the managing member of the DSK by his hierarchical superior for the purposes of encouraging his promotion could lead to a form of ‘prior compliance’ on the part of the managing member (see, to that effect, Commission  v Germany , paragraph 36).
52. Moreover, by reason of the links that the managing member of the DSK has with the political body, which is subject to the supervision of the DSK, the latter is not above all suspicion of partiality. In the light of the role assumed by the supervisory authorities as guardians of the right to privacy, the second subparagraph of Article 28(1) of Directive 95/46 requires that their decisions, and therefore the authorities themselves, remain above all suspicion of partiality (see Commission  v Germany , paragraph 36).