Mise à jour : 21 juin 2010 (Rédaction initiale : 3 juin 2010 )
Analyses Sectorielles
II-11.6: A judgment handed down by the Grand Chamber of the European Court of Justice on March 9, 2010 insists on the necessary independence of the authorities in charge of data privacy protection in German Länder, with regards to the application of the European Directive 95/46/EC of 24 October 1995 on "the protection of individuals with regard to the processing of personal data and on the free movement of such data" (Data Protection Directive)
In a judgment taken on March 9th 2010, the Grand Chamber of the European Court of Justice upheld the European Commission’s action against the Federal Republic of Germany, stating that by making the authorities responsible for monitoring the processing of personal data outside the public sector in the different Länder subject to State oversight, Germany incorrectly transposed the requirement of "complete independence" of the supervisory authorities responsible for ensuring data protection, and thereby failed to fulfil its obligations under the second subparagraph of Article 28(1) of Directive 95/46/EC of 24 October 1995 "on the protection of individuals with regard to the processing of personal data and on the free movement of such data".
FRENCH
Un jugement rendu par la Grande Chambre de la Cour Européenne de Justice le 9 mars 2010 insiste sur l'indépendance nécessaire des autorités en charge de la protection des données personnelles dans les Länder allemands au regard de l'application de la directive européenne 95/46/CE du 24 Octobre 1995 relative à la protection des personnes physiques à l'égard du traitement des données à caractère personnel et à la libre circulation de ces données (Directive "Données Personnelles").
Dans un jugement rendu le 9 mars 2010, la Grande Chambre de la Cour Européenne de Justice a jugé que les autorités de protection des données des Länder allemands qui contrôlent les fichiers du secteur privé n’agissaient pas en pleine indépendance, contrairement aux exigences de la Directive européenne de 1995 sur la protection des données.
GERMAN
Am 9. März 2010 verkündete der Europäische Gerichtshof sein Urteil in der Sache EG / Deutschland (C-518/07) betreffend der Verpflichtung des Mitgliedsstaats sicherzustellen, daß die nationalen Aufsichtsbehörden, die zur Überwachung der Datenverarbeitung verantwortlich sind, ihre Funktionen vollkommen unabhängig auszuüben.
Der Europäische Gerichtshof hat am 9. März 2010 sein Urteil verkündet in der Sache EG/Deutschland, in dem er betont, dass das deutsche Datenschutzsaufsichtssytem die Verpflichtung der Unabhängigkeit von Aufsichtsbehörden, die in den Rechtlinien 95/46 vorgeschrieben ist, unvollständig umgestetzt hat.
SPANISH
En una sentencia dictada por la Gran Cámara de la Corte Europea de la Justicia el 9 de marzo del 2010 insiste en la independencia necesaria de las autoridades a cargo de la protección de la privacidad de data en German Länder, en cuanto a la aplicación de la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos
En una sentencia del 9 de marzo del 2010 la Gran Cámara de la Corte Europea de la Justicia confirmó que la acción que tomó la Comisión Europea contra la República Federal de Alemania, constatando que, al darle a las autoridades la responsabilidad de monitorear el procesamiento de data personal fuera del sector público en los diferentes Länder sujetos a la vigilancia estatal, Alemania transpuso incorrectamente el requisito de ‘independencia completa’ de las autoridades supervisoras responsables de asegurar la protección de data y por lo tanto, no cumplen con los requisitos detallados en el segundo subpárrafo del artículo 28(1) de la Directiva 95/46/CE del Parlamento Europeo y del Consejo, de 24 de octubre de 1995, relativa a la protección de las personas físicas en lo que respecta al tratamiento de datos personales y a la libre circulación de estos datos
Pièces jointes
Context and Summary
Brief commentary
This case is in line with the demands for an independent regulator in charge of protecting the fundamental right to privacy that is both objective (i.e. structurally and organisationally independent); and subjective, which means that the regulatory authority does not appear to be influenced by the administration or by corporations in its decision-making.
More specifically, this decision illustrates the very teleological aspect of Regulatory Law—and of European law. Indeed, the European Court of Justice, confronted with the lack of definition of the concept of "independence" in Directive 95/46, assessed that its meaning should be induced by taking the Directive’s purpose into account. Emphasising the complex balance that national data protection authorities should achieve between enabling the free movement of data in Europe, on one hand, and the protection of the fundamental right to privacy, on the other, it embraced a broad understanding of the notion of "independence". Those authorities, "guardians" of the fundamental right to privacy, must be as independent as possible from the administrative hierarchy. In that particular purpose, the Court extracted the definition of "independence" from the goals of Directive 95/46, going so far as to reason analogically to put forward the need for both internal and external independence of data protection supervisory authorities.
The emphasis on this requirement of subjective independence is part of a larger movement initiated by the European Court of Human Rights (especially since the Engel case vs. The Netherlands from 8th June 1976). The ECHR, by borrowing the notion of subjective impartiality from British Law, aims at deepening the protection of people being tried by strengthening the impartiality of the judge, to which the subjective independence completely belongs. Interestingly, the ECJ is now joining the ECHR in its efforts, bringing legal reasoning between “Economic Europe” (ECJ) and “Human Rights Europe” (ECHR) closer, taking into consideration their common concern for the protection of fundamental rights.
Yet, it should be noted that the European Court of Justice did not, in this case, define the substantial components of the criteria of independence, even less of "complete independence". It thus avoided listing the requirements (such as institutional, organisational, budgetary, or financial independence) that the term "independence" entails. The lack of definition provided by this decision has the advantage—from the point of view of the European Union’s teleology—of not closing the door on deepening oversight in Member State’s implementation of such directives in the future.
However, as Advocate General Mazák noted in his opinion, the evidence that Germany failed to fulfil its obligation of transposition is fragile. In fact, the Court stated that "the mere risk" of the supervising authorities being influenced by the scrutinising authorities is a sufficient enough proof that the requirements of "complete independence" are not fulfilled. And yet, "according to the case-law of the Court, in an action for failure to fulfil obligations brought under Article 226 EC it is for the Commission to prove that the obligation has not been fulfilled without being able to rely on any presumption.", Advocate General Mazák says. In this particular case, the Commission failed to bring any evidence of the negative effects of the oversight of data protection authorities for non-public bodies by their States.
votre commentaire