Commission v Austria Why Formal Independence Is Not Enough

Case C-614/10 | Court of Justice of the European Union | Grand Chamber | 16 October 2012

Practice takeaways: ① A supervisory authority must be protected from direct and indirect external influence. ② A statutory prohibition on instructions is essential, but does not by itself establish complete independence. ③ Employment supervision can compromise independence when a senior official of the authority remains answerable to another public body. ④ Staff and administrative arrangements matter because the authority depends on its office to perform its work. ⑤ A government body’s unconditional right to information about all aspects of an authority’s work may itself create an impermissible risk of influence. ⑥ EU law does not require every supervisory authority to have a separate budget, but shared resources cannot expose it to outside control.

Austria had expressly declared the members of its Data Protection Commission independent and prohibited them from taking instructions. The Court of Justice nevertheless held that the authority did not act with the “complete independence” required by EU data protection law.

The problem lay in the institutional arrangements surrounding that formal guarantee. The official who managed the authority’s daily work remained subject to employment supervision within the federal administration. The authority’s office and staff were integrated into the Federal Chancellery. The Federal Chancellor could demand information at any time about every aspect of the authority’s work.

Taken together, those arrangements exposed the authority to indirect influence and prevented it from remaining above all suspicion of partiality. Commission v. Austria therefore establishes a point that remains central under the GDPR: independence depends on how a supervisory authority is organized and resourced, not only on whether the law forbids direct instructions.

What happened

The case concerned Austria’s former Datenschutzkommission, or Data Protection Commission (DSK), which served as the national authority responsible for supervising compliance with data protection law.

The DSK consisted of six members appointed for five-year terms. Five were proposed by bodies representing professional interests, the Austrian Länder, and the President of the Supreme Court. The sixth was selected from lawyers working in the federal public administration. The members generally performed their DSK duties part time and could hold other employment at the same time. (Judgment, paras. 8–10.)

Austrian law stated that DSK members were independent and not bound by instructions of any kind. It also assigned the management of the DSK’s day-to-day business to one member, known as the managing member. Under the DSK’s internal rules, that position was held by the member drawn from the federal administration. (Judgment, paras. 11–14.)

The DSK did not have a separate administrative office. The Federal Chancellor established its office and supplied its equipment and staff. Those staff members were officials of the Federal Chancellery. Austrian law also entitled the Chancellor to obtain information at any time from the chair and managing member about all aspects of the DSK’s work. (Judgment, paras. 12–15.)

The European Commission began infringement proceedings in 2005. After a letter of formal notice, a supplementary notice, and a reasoned opinion failed to resolve the dispute, the Commission brought an action under Article 258 TFEU. Germany intervened in support of Austria; the European Data Protection Supervisor supported the Commission. (Judgment, paras. 16–24.)

Why the case matters

Commission v. Austria translated the Court’s general account of independence in Commission v. Germany into a close examination of institutional design.

• Commission v. Germany had already held that data protection authorities must remain free from any direct or indirect external influence capable of affecting their decisions.
• Austria tested what that principle required where national law formally protected an authority’s members from instructions, but the authority remained closely connected to the executive branch through personnel, staff, and access to information.

The Court held that formal or functional independence was only part of the inquiry. An authority may be legally free to decide cases without instructions and still lack complete independence if its structure creates a realistic risk of outside influence. The judgment focuses on that risk; the Commission did not have to prove that the Austrian Government had actually pressured the DSK in a particular matter.

The decision also shows why independence is especially important for a data protection authority. Public bodies are themselves subject to data protection oversight. If the authority depends on the institution it supervises for career advancement, staff, or unrestricted disclosure of its work, regulated government bodies may appear capable of influencing their own regulator. The Court required the authority and its decisions to remain above all suspicion of partiality. (Judgment, paras. 51–52, 61, and 64.)

The legal framework

At the time, the second subparagraph of Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46) required national supervisory authorities to act “with complete independence” when exercising their functions. The Court emphasized that independent supervision also followed from primary EU law, including Article 8(3) of the Charter of Fundamental Rights and Article 16(2) TFEU. It described independent supervisory authorities as an essential component of the protection of individuals whose personal data are processed. (Judgment, paras. 36–37.)

The Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR ) replaced Directive 95/46, but retained and elaborated the requirement. Article 52 provides that each supervisory authority must act with complete independence, remain free from direct or indirect external influence, and neither seek nor take instructions. It also requires members to refrain from incompatible occupations and Member States to provide the human, technical, and financial resources, premises, and infrastructure needed for the authority to perform its tasks effectively.

Commission v. Austria therefore remains relevant when interpreting the institutional safeguards now stated expressly in Article 52 GDPR.

Key holding

The Grand Chamber held that Austria had failed to fulfill its obligations. Three features of the existing framework were incompatible with EU law:

• The managing member of the DSK was a federal official subject to supervision.
• The DSK’s office was integrated with the departments of the Federal Chancellery.
• The Federal Chancellor had an unconditional right to information covering all aspects of the DSK’s work.

The Court treated those features as sources of possible indirect influence. It did not require evidence that the Chancellor or another superior had issued an improper instruction or altered a DSK decision. (Judgment, paras. 41–44 and 66.)

The Court’s analysis

(1) Freedom from instructions was necessary but insufficient

The Court first rejected Austria’s reliance on the standards used to determine whether a body qualifies as a court or tribunal for purposes of Article 267 TFEU. The expression “with complete independence” in Directive 95/46 had an autonomous meaning based on the Directive’s language, aims, and structure. The independence required of a data protection authority was therefore not resolved by classifying the DSK as a judicial body under another legal test. (Judgment, paras. 39–40.)

The Court then reaffirmed Commission v. Germany. A supervisory authority must be able to perform its duties free from external influence and remain protected from any direct or indirect influence capable of affecting its decisions. Austria’s prohibition on instructions established functional independence, which the Court called essential. But that safeguard alone did not protect the DSK from every form of external influence. (Judgment, paras. 41–43.)

(2) Employment supervision created a risk of prior compliance

The managing member was responsible for the DSK’s day-to-day business while remaining a federal official. The official’s hierarchical superior had broad employment powers, including evaluating performance and encouraging promotion. Even if the superior could not issue technical instructions about DSK matters, the employment relationship could still affect how the managing member performed the role. (Judgment, paras. 45–50.)

• The Court identified the possibility of “prior compliance”: an official who knows that a superior will evaluate the official’s work or influence promotion may anticipate the superior’s preferences without receiving an express instruction. That risk was enough to impair operational independence. (Judgment, para. 51.)

The concern was heightened because the DSK supervised the political body with which the managing member had institutional links. Those links meant that the DSK was not above all suspicion of partiality. The fact that the DSK itself selected the managing member did not cure the service relationship; Austria remained responsible for adopting legal rules that guaranteed complete independence. (Judgment, paras. 52–55.)

(3) Control over staff could become control over the authority

The DSK’s office consisted of Federal Chancellery officials who remained subject to the Chancellery’s administrative supervision. Austria argued that the office merely implemented the DSK’s decisions and should be distinguished from the decision-making body itself. The Court rejected that distinction. (Judgment, paras. 56–57 and 60.)

• The members served part time and depended substantially on the office’s staff to carry out the DSK’s workload. The status of those employees therefore could affect the authority’s actual work. Their connection to the Federal Chancellery created a risk of influence, while the organizational overlap undermined the appearance of impartiality. (Judgment, paras. 59–61.)

The Court did not hold that every supervisory authority must have a legally separate budget or sit entirely outside the administrative structure of government. Member States could place an authority within a ministerial department for budgetary purposes. The controlling question was whether the allocation and supervision of staff, equipment, and other resources prevented the authority from acting with complete independence. (Judgment, para. 58.)

(4) Unrestricted access to information enabled indirect influence

The Federal Chancellor could obtain information at any time from the DSK’s chair and managing member about all aspects of its work. Austria characterized this as a mechanism of democratic accountability rather than control.

The Court focused on the breadth and unconditional nature of the power. A right covering all aspects of the authority’s work could expose the DSK to indirect influence from the Chancellor, whose own administration was subject to DSK supervision. The power also prevented the authority from operating in all circumstances above suspicion of partiality. (Judgment, paras. 62–64.)

The Advocate General’s Opinion

Advocate General Ján Mazák reached the same conclusion as the Court. He treated Commission v. Germany as the starting point but resisted converting “complete independence” into a fixed checklist of institutional features.

• In his view, the Court had left room for a case-by-case assessment of whether a particular arrangement could produce direct or indirect external influence. Because it was difficult to identify every condition required for independence in the abstract, the better method was to examine the effects of the challenged institutional arrangements. (Opinion, paras. 25–28.)

Applying that approach, the Advocate General concluded that the managing member’s continuing service relationship with the federal administration created a risk of indirect influence; that staff and office arrangements were an essential part of the authority’s status; and that the Chancellor’s unlimited and unconditional right to information could harm the DSK’s independence, particularly because the Chancellor was subject to its supervision. (Opinion, paras. 31–32, 38–40, and 43–45.)

The Opinion went somewhat further than the judgment in discussing the part-time status and outside employment of other DSK members. The Advocate General suggested that their employers might also become sources of influence and considered whether the prohibition on incompatible outside activity applicable to the EDPS might inform the analysis. The Court did not rely on that broader proposition in its operative holding. (Opinion, para. 33.)

What the Court did and did not decide

The Court did decide that complete independence extends beyond formal freedom from instructions. It includes protection against structural and employment relationships that create a risk of indirect influence. It also decided that staff arrangements and rights of access to information may be relevant even if outsiders have no formal power to reverse or dictate the authority’s decisions.

The Court did not require proof that Austrian officials had actually interfered with a DSK investigation or decision. Nor did it find that every administrative or budgetary connection between a supervisory authority and a ministry is unlawful. It expressly stated that EU law did not require a separate budget. The defect arose because the particular personnel, staffing, and information arrangements left the DSK exposed to supervision or influence.

The Court also did not establish that the independence standards governing courts and data protection authorities are identical. It instead gave the requirement in Article 28(1) of Directive 95/46 an autonomous interpretation tailored to the role of data protection authorities.

The rule under the GDPR

Article 52 GDPR now states much of the Court’s reasoning expressly.

• Supervisory authorities must act with complete independence, remain free from direct and indirect external influence, and neither seek nor take instructions.
• Their members must refrain from incompatible action and occupations.
• Member States must provide each authority with the resources and infrastructure necessary to perform its tasks and exercise its powers effectively.

The judgment remains useful because Article 52 does not answer every question of institutional design. Commission v. Austria supplies the method: examine whether the authority’s actual legal and organizational arrangements create channels through which another body could influence its work. Formal autonomy is important, but the surrounding employment, staffing, reporting, and information rules determine whether that autonomy is real.

Conclusion

Commission v. Austria confirms that the independence of a data protection authority cannot be reduced to a clause stating that its members are not bound by instructions.

A supervisory authority must also be protected from less visible forms of influence. Career supervision over the official who runs its daily business, dependence on staff controlled by a regulated ministry, and unconditional governmental access to its work can compromise independence even without an express direction in a particular case.

The Court did not require total administrative isolation. It required institutional arrangements that allow the authority to perform its functions free from direct and indirect influence and remain above suspicion of partiality. That principle, developed under Directive 95/46, is now reflected in Article 52 GDPR.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

• Court of Justice of the European Union, Grand Chamber, Case C-614/10, European Commission v Republic of Austria, Judgment of 16 October 2012, ECLI:EU:C:2012:631.
• Opinion of Advocate General Ján Mazák, Case C-614/10, European Commission v Republic of Austria, delivered 3 July 2012, ECLI:EU:C:2012:406.

Useful reading from The de la Torre Review

• Commission v. Germany: Why Data Protection Authorities Must Be Free From State Influence. Provides the foundation for Austria’s analysis. The Court first held there that complete independence protects supervisory authorities against direct and indirect external influence, including State oversight capable of affecting their decisions. Read the Article.
• Supervisory Authorities, the EDPB, and the EDPS Explained. Explains the distinct roles of national supervisory authorities, the European Data Protection Board, and the European Data Protection Supervisor, together with the GDPR rules governing the powers and independence of national regulators. Read the Article.
• Commission v. Luxembourg: When Internal Delays Cannot Excuse Late Transposition. Offers useful background on Article 258 TFEU infringement proceedings and the rule that a Member State cannot rely on its internal legal or administrative difficulties to excuse noncompliance with EU law. Read the Article