Commission v. Germany: Why Data Protection Authorities Must Be Free From State Influence

Case C-518/07 | European Commission v Federal Republic of Germany | Court of Justice of the European Union | Grand Chamber | 9 March 2010

Practice Takeaways: ① “Complete independence” extends beyond independence from regulated entities. ② A data protection authority must also be free from direct or indirect influence by government. ③ Actual interference is unnecessary; the risk of political influence can itself compromise independence. ④ Independence protects the effectiveness and credibility of supervision, not the institutional interests of the authority. ⑤ Democratic accountability remains possible through legislation, appointments, public reporting, and judicial review.

A supervisory authority can have enforcement powers on paper and still lack the independence needed to use them. Commission v. Germany addressed that problem under Article 28(1) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (Directive 95/46), which required national data protection authorities to act with “complete independence.” Germany argued that this requirement protected regulators from the private entities they supervised, but did not prevent a Land government from reviewing their decisions as part of the administration.

The Grand Chamber rejected that narrow reading. “Complete independence” meant freedom from any direct or indirect external influence capable of affecting the authority’s judgment, including influence from the State or the Länder. More strikingly, the Commission did not have to prove that political interference had occurred. The possibility of influence was enough because it could induce “prior compliance” and place the authority’s impartiality under suspicion. (Judgment, paras. 18–19, 25, 30, 32–37.)

Practice Tip: Formal autonomy is only part of the inquiry. When assessing a supervisory authority’s independence, ask who can direct, review, cancel, replace, or informally shape its decisions—and whether the institutional arrangement could cause the authority to anticipate political preferences before acting.

What happened

German law divided data protection supervision according to the identity of the controller. Processing by public bodies was supervised at federal and regional level by officials who were answerable to their respective parliaments and were generally not subject to scrutiny or instruction from the public bodies they supervised. The authorities responsible for supervising private-sector processing and public undertakings competing in the market varied among the Länder, but every Land subjected those authorities to State scrutiny. (Judgment, paras. 7–10.)

The European Commission considered that arrangement incompatible with Article 28(1) of Directive 95/46. After a 2005 letter of formal notice and a 2006 reasoned opinion failed to change Germany’s position, the Commission brought an infringement action. The European Data Protection Supervisor (EDPS) intervened in support of the Commission. (Judgment, paras. 11–13.)

The dispute turned on the meaning of “with complete independence.” The Commission and the EDPS argued that supervisory authorities must be free from all outside influence. Germany argued for functional independence only from the private entities under supervision. In its view, oversight by another body within the same administration was an internal control mechanism, not an external influence forbidden by the Directive. (Judgment, paras. 14–16.)

Why the case matters

Commission v. Germany made institutional design part of effective data protection. The Court treated national supervisory authorities as "guardians of fundamental rights" whose credibility depends not only on whether they reach impartial decisions, but also on whether their structure leaves room for political pressure or reasonable suspicion of partiality. (Judgment, paras. 23–25, 36.)

The decision also separated independence from isolation. A regulator may remain subject to law, judicial review, legislative definition of its powers, appointment procedures, and reporting duties. What the government may not retain is a mechanism that allows it to influence the regulator’s exercise of its data protection functions. (Judgment, paras. 41–46.)

Key holding

The Court held that Germany failed to fulfill its obligations under Article 28(1) of Directive 95/46 by subjecting the authorities responsible for supervising private-sector processing and market-competing public undertakings in the Länder to State scrutiny. (Judgment, para. 56 and operative part.)

The required independence had to allow those authorities to perform their duties free from external influence. It excluded influence by regulated entities and any direct or indirect directions or pressure capable of calling into question the authority’s task of balancing privacy with the free movement of personal data. (Judgment, para. 30.)

The Court’s analysis

1 Complete independence reaches all external influence

The Court began with the ordinary meaning of independence. For a public body, independence describes a status that allows the body to act freely, without instructions or pressure. The adjective “complete” foreclosed Germany’s attempt to limit the guarantee to independence from supervised entities. It implied decision-making power free from direct or indirect external influence. (Judgment, paras. 17–19.)

2 Independence protects effective and credible supervision

The Court then connected independence to the Directive’s objectives. Directive 95/46 sought both to facilitate the free movement of personal data within the internal market and to secure a high level of protection for fundamental rights, particularly private life. National supervisory authorities helped maintain the fair balance between those interests and cooperated across borders. (Judgment, paras. 20–24.)

Their independence was therefore functional, but in a broader sense than Germany proposed. It existed to make supervision effective and reliable and to strengthen the protection of persons affected by processing and regulatory decisions. To act objectively and impartially, an authority had to remain free from external influence by the State or a Land as well as from influence by regulated bodies. (Judgment, para. 25.)

3 The risk of political influence was enough

State scrutiny could allow the Land government, or an administrative body under its control, to influence a supervisory authority’s decisions or to cancel and replace them. Germany responded that the purpose of review was only to ensure legality and that the State did not intend to impose political objectives inconsistent with data protection. (Judgment, paras. 31–33.)

The Court focused on institutional risk rather than official purpose. A Land government might itself have an interest in private-sector processing through a public-private partnership, public contract, access to databases for taxation or law enforcement, or a desire to favor an economically important company. A reviewing authority within the general administration might therefore be unable to apply data protection law objectively. (Judgment, paras. 34–35.)

No completed act of interference was required. The mere risk of political influence could cause the supervisory authority to conform in advance to the reviewing body’s known preferences. It could also undermine public confidence in the regulator’s impartiality. Because supervisory authorities served as guardians of private life, their decisions and the authorities themselves had to remain above suspicion of partiality. (Judgment, para. 36.)

4 Independence does not eliminate democratic accountability

Germany argued that removing executive oversight would conflict with the democratic principle because the administration should remain subject to instructions from a government accountable to parliament. The Court accepted that democracy forms part of EU law, but held that it does not prohibit public authorities outside the traditional administrative hierarchy. Independent administrative authorities may exercise regulatory functions that must be protected from political influence while remaining bound by law and subject to judicial review. (Judgment, paras. 38–42.)

Nor did the Directive require supervisory authorities to be insulated from every form of parliamentary influence. Parliament or government could appoint their leadership; legislation could define their powers; and lawmakers could require public activity reports. Those mechanisms supplied democratic legitimacy without allowing the executive to direct individual supervisory decisions. (Judgment, paras. 43–46.)

5 The EU had authority to require independence

Germany also invoked conferred powers, subsidiarity, proportionality, and respect for national administrative arrangements. The Court rejected those objections. Equal independence across Member States supported an equivalent level of data protection and, in turn, the cross-border movement of personal data needed for the internal market. The requirement therefore remained within the EU legislature’s internal-market competence and did not go beyond what was necessary to achieve the Treaty’s objectives. (Judgment, paras. 47–55.)

The Advocate General’s Opinion

Advocate General Ján Mazák agreed that independence could not be confined to relations with regulated entities. A data protection authority also needed sufficient independence from other parts of the executive to exercise its functions effectively. But he treated “independence” as relative and resisted reading “complete independence” as necessarily requiring every form of institutional, organizational, budgetary, financial, functional, personal, and decisional autonomy. (Opinion, paras. 13–23.)

His decisive disagreement with the Commission concerned proof. In his view, State oversight could serve the legitimate purpose of ensuring that an authority acted rationally, lawfully, and proportionately. Because infringement proceedings placed the burden on the Commission, he would not infer a violation from the existence of oversight alone. The Commission had not shown that the system had failed or that reviewing bodies had abused their powers in a consistent practice. He therefore proposed dismissing the action. (Opinion, paras. 24–36.)

The Court took the opposite approach. It treated the structural possibility of influence as the problem and held that the resulting risk of anticipatory compliance or perceived partiality was itself incompatible with complete independence. (Judgment, paras. 32–37.)

What the Court did and did not decide

The Court did hold that “complete independence” protects a data protection authority from government influence as well as influence from the entities it supervises.

It did hold that direct instructions are not the only concern. Indirect influence and institutional arrangements capable of affecting decision-making also fall within the prohibition.

And it did hold that proof of actual interference is unnecessary when the oversight structure itself creates a risk of political influence, anticipatory compliance, or suspicion of partiality.

But the Court did not require supervisory authorities to operate outside the law or without democratic legitimacy.

It did not prohibit judicial review, legislative definition of powers, appointment by parliament or government, or reporting obligations.

And it did not define every institutional, budgetary, staffing, or operational safeguard required for complete independence. The GDPR later addressed many of those matters expressly in Article 52.

Conclusion

Commission v. Germany established that the independence of a data protection authority cannot depend on proving that political pressure changed a particular outcome. By the time such evidence exists, the institutional safeguard has already failed.

The Court therefore focused on the authority’s legal position and the channels through which influence could operate. A government body could not retain power to shape, cancel, or replace supervisory decisions merely because it characterized that power as administrative review. The possibility of influence could encourage the authority to adjust its conduct in advance and could weaken confidence in its impartiality.

The judgment’s continuing lesson is that accountability and independence must be designed together. Supervisory authorities remain accountable through law, courts, appointments, and public reporting. Their application of data protection law, however, must be protected from direct and indirect political control.

Sources and Useful Reading

Sources

CJEU judgments, Advocate General opinions, and related case materials are available through InfoCuria, the Court of Justice of the European Union’s official case-law database.

• Court of Justice of the European Union, Grand Chamber, Case C-518/07, Commission v. Germany, Judgment of 9 March 2010, ECLI:EU:C:2010:125.
• Opinion of Advocate General Ján Mazák, Case C-518/07, delivered 22 October 2009, ECLI:EU:C:2009:694.

Useful Reading From The de la Torre Review

• Supervisory Authorities, the EDPB, and the EDPS Explained — Explains the distinct but complementary roles of national supervisory authorities, the European Data Protection Board, and the European Data Protection Supervisor in overseeing, coordinating, and enforcing EU data protection law. Read the Article
• Commission v. Austria: Independence of EU Supervisory Authorities — Builds upon Commission v. Germanyand examines whether organizational links, staffing arrangements, and government access to information can compromise a supervisory authority’s independence. Read the Article.
• Commission v. Luxembourg: When Internal Delays Cannot Excuse Late Transposition — Examines another infringement action involving Directive 95/46. While Commission v. Germany addressed whether national implementation satisfied the Directive’s independence requirement, Commission v. Luxembourg established that internal political changes and administrative arrangements cannot excuse a Member State’s failure to implement EU data-protection law on time. Read the Article
• Ireland v. Parliament: The EU Had Power to Require Data Retention—But That Wasn’t the End of the Story — Provides additional context for the Court’s conclusion that EU internal-market competence can support legislation governing personal-data processing. Like Commission v. Germany, it explains how harmonized data-protection obligations may contribute to the functioning of the internal market, while carefully separating that competence question from the distinct question of compliance with fundamental rights. Read the Article.
• Parliament v Council: When Passenger Data Becomes a Security Measure — Illustrates the other side of the EU-competence analysis. Whereas Commission v. Germany held that Article 100a EC supported common requirements for the independence of data protection authorities, Parliament v Council held that Directive 95/46 and the internal-market legal basis could not support measures governing processing for public-security and law-enforcement purposes that the Directive expressly excluded from its scope. Read the Article.