By prematurely bringing to an end the term served by its Data Protection Supervisor, Hungary has infringed EU law
The independence of the authorities responsible for the protection of personal data requires Member States to allow those authorities to serve their full term of office
Click here to the full text of the judgement
In accordance with the Data Protection Directive
1, Member States are to appoint one or more authorities responsible for monitoring the application of that directive within their respective territories. Those authorities must act with complete independence in exercising the functions entrusted to them.
In Hungary, the Data Protection Supervisor was made responsible, until 2012, for the performance of the tasks entrusted to supervisory authorities under that directive. On 29 September 2008, Mr András Jóri was appointed Data Protection Supervisor for a term of six years. However, with effect from 1 January 2012, the Hungarian Parliament decided to reform the data protection system and replace the Supervisor with a national authority for data protection and freedom of information. Accordingly, Mr Jóri had to vacate office before his full term had expired and was replaced by Mr Attila Péterfalvi, who was appointed as Head of the new Authority for a term of nine years.
Taking the view that to compel Mr Jóri to vacate office before serving his full term was in breach of Directive 95/46 (under which the independence of the authorities responsible for the protection of personal data is to be guaranteed), the Commission brought an action against Hungary for failure to fulfil its obligations. The European Data Protection Supervisor was granted leave to intervene in support of the form of order sought by the Commission.
In its judgment delivered today, the Court points out that the supervisory authorities established in accordance with Directive 95/46 must be allowed to perform their duties free from external influence. That requirement implies, on the one hand, that those authorities must not be bound by instructions of any kind in the performance of their duties and, on the other, that their decision-taking process must be free from political influence, it being necessary to dispel even the risk of such influence. If it were permissible for a Member State to compel a supervisory authority to vacate office before serving its full term, in contravention of the rules and safeguards established in that regard by the legislation applicable
2, that authority might be prompted to enter into a form of prior compliance with political powers. Consequently,
the independence of supervisory authorities necessarily covers the obligation to allow them to serve their full term of office and to cause them to vacate office before expiry of the full term only in accordance with the applicable legislation.
That interpretation is supported, moreover, by the rules applicable to the circumstances in which the term served by the European Data Protection Supervisor may be prematurely brought to an end. The term served by the European Data Protection Supervisor may not be prematurely brought to an end unless there are overriding and objectively verifiable grounds for doing so. In that regard, the Court states that the provisions of the Hungarian legislation in force before 1 January 2012 also provided that only such grounds
3 could justify the premature bringing to an end of the term served by the Data Protection Supervisor. The Court finds, however, that Mr Jóri was not compelled to vacate office pursuant to such provisions.
Accordingly, the Court holds that,
by prematurely bringing to an end the term served by the supervisory authority for the protection of personal data, Hungary has failed to fulfil its obligations under Directive 95/46.
-----------------
NOTE: An action for failure to fulfil obligations directed against a Member State which has failed to comply with its obligations under European Union law may be brought by the Commission or by another Member State. If the Court of Justice finds that there has been a failure to fulfil obligations, the Member State concerned must comply with the Court’s judgment without delay. Where the Commission considers that the Member State has not complied with the judgment, it may bring a further action seeking financial penalties. However, if measures transposing a directive have not been notified to the Commission, the Court of Justice can, on a proposal from the Commission, impose penalties at the stage of the initial judgment.
------------------
1Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).
2The Hungarian legislation in force before 1 January 2012 allowed for the premature bringing to an end of the term served by the Supervisor for the protection of personal data inter alia on the following grounds: if the Supervisor was incapable of carrying out his duties for an extended period; if he failed to meet his obligation to declare his assets; if he was found guilty of an offence by a final judgment of a criminal court; and if there is a declaration of a conflict of interest.
3See footnote 2. 