ECJ declares German data protection supervision unlawful

On March 9, 2010, the European Court of Justice ruled that by making the state authorities responsible for monitoring the processing of personal data by non-public bodies subject to state scrutiny, and by thus incorrectly transposing the requirement that those authorities perform their functions “with complete independence,” Germany failed to fulfill its obligations under Directive 95/46/EC.

Contrary to the position taken by the Federal Republic of Germany (and also the Attorney General), the concept of “independence” shall imply a decision-making power independent of any direct or indirect external influence on the supervisory authority. The court stated that the guarantee of independence of national supervisory authorities is intended to ensure the effectiveness and reliability of the supervision of compliance with the provisions on protection of individuals with regard to the processing of personal data and must be interpreted in the light of that aim. Therefore, when carrying out their duties, the supervisory authorities must act objectively and impartially. For that purpose, they must remain free from any external influence, including the direct or indirect influence of the state or the Länder, and not of the influence only of the supervised bodies.

Accordingly, Germany will have to revise the supervisory structure in several Länder, inter alia in Hesse, where the supervisory authority is subject to state scrutiny.