Court of Justice upholds independence of data protection authorities in case against Hungary
European Commission
MEMO
Brussels, 8 April 2014
Court of Justice upholds independence of data protection authorities in case against Hungary
In a case brought by the European Commission, the European Court of Justice has today ruled (case C-288/12 ) that the abrupt termination the Hungarian Data Protection Commissioner’s term in office by the government constitutes an infringement of the independence of the Hungarian Data Protection Authority and is hence in breach of EU law. In the context of a reorganisation of the data protection authority by the Hungarian government, the six-year term of the Data Protection Commissioner, appointed in 2008, was prematurely brought to an end in 2011 (instead of 2014). The Commission therefore launched infringement proceedings in January 2012 ( IP/12/24 ) and referred Hungary to the Court in April 2012 ( IP/12/395 ). The independence of data protection supervisors is guaranteed under Article 16 of the Treaty on the Functioning of the EU and Article 8 of the Charter of Fundamental Rights. In addition, EU rules on data protection ( Directive 95/46/EC ) require Member States to establish a supervisory body to monitor the application of the Directive acting in complete independence.
Commenting on the ruling, Vice-President Viviane Reding i, the EU's Justice Commissioner said: " The Court's judgment confirms the Commission's legal analysis: Hungary's decision to cut short the Data Protection Commissioner’s term was against EU law. The independence of national data protection authorities is the very cornerstone of guaranteeing effective data protection rights for our citizens. Lack of independence means lack of effective supervision and oversight, and a lowering of the level of data protection. The Commission has intervened three times with infringement cases against Member States to stop such incursions on the independence of data protection watchdogs. I will not hesitate to intervene again if necessary.”
Next steps : It is now for Hungary to inform the Commission of the steps it intends to take to remedy the situation.
The requirement for national data protection authorities to act in complete independence has already been confirmed by the Court of Justice in two other cases. In its rulings in cases concerning Germany ( C-518/07 of 9 March 2010) and Austria ( C - 614/10 of 16 October 2012) , the Court underlined that data protection supervisory authorities have to remain free from any external influence, including the direct or indirect influence of the state. The mere risk of political influence through state scrutiny is sufficient to hinder the independent performance of the supervisory authority's tasks, the Court ruled. Vice-President Reding recently underlined that also other countries needed to make efforts to ensure the independence of their data protection authority ( SPEECH/14/62 ).
Background
The Commission raised legal concerns as regards the independence of the Hungarian data protection authority in December 2011, and launched accelerated infringement proceedings on 17 January 2012 (see IP/12/24 ).
The case related to Hungary's decision to create a new national agency for data protection, replacing the existing Data Protection Commissioner's Office from 1 January 2012. As a result, the six-year term of the incumbent Data Protection Commissioner, who was appointed in 2008, was prematurely put to an end. The new rules also created the possibility that the prime minister and president could dismiss the new supervisor on arbitrary grounds. Hungary addressed some of the Commission's concerns by amending its national legislation on 3 April 2012 to make the new National Agency for Data Protection independent in line with EU law. However, it maintained the termination of the mandate of the data protection commissioner. In this respect, the Commission decided to drop some of its concerns but referred the rest to the Court of Justice ( IP/12/395 ) .
For more information
Homepage of Vice-President Viviane Reding, EU Justice Commissioner:
Vice-President Reding on Twitter: @VivianeRedingEU
European Commission - Data protection:
http://ec.europa.eu/justice/data-protection/index_en.htm
Latest information on infringement proceedings concerning all Member States:
http://ec.europa.eu/community_law/index_en.htm