On 16 October 2012, the Court of Justice of the European Union (“CJEU”) ruled in favour of the European Commission in its claim against Austria that the Austrian Data Protection Authority, the Datenschutzkommission (“DSK”), was not independent from the Austrian government as required under Article 28 of the EU’s Data Protection Directive. The Commission’s action was supported by the European Data Protection Supervisor (“EDPS”); Austria’s defence was supported by Germany.

Article 28, which was the focus of the case, requires data protection authorities to “act with complete independence in exercising the functions entrusted to them”. This principle is also made clear in the Charter of Fundamental Rights of the EU and in the Treaty on the Functioning of the EU (“TFEU”).

The Commission argued that part of Article 28 had been incorrectly transposed into Austrian law, because the relevant provision in Austrian law did not allow the DSK to act “with complete independence”. The Commission was concerned that the DSK had been too closely integrated, structurally and substantively, with the Austrian Federal Chancellery, compromising the DSK’s purported independence.  More specifically, under the Austrian-implemented law, members of the DSK were only asked to work for the DSK on a part-time basis, and the manager of the DSK was, at the same time, a federal Austrian official, who was also bound to follow the Austrian government’s instructions.  DSK staff members were also placed under the authority of the Federal Chancellery, and the Federal Chancellor had a right to ask for (and receive) any information about the DSK’s work.  The Commission’s argument was that these links to the Austrian government, which were extensive, would undermine the appearance of the DSK’s impartiality, and subject the DSK to indirect (or possibly direct) influence from the Federal Chancellery.

This is not the first case relating to the independence of data protection authorities (“DPAs”).  In an earlier case, against Germany, the CJEU followed a similar logic, and clearly stated that DPAs must remain free from any direct or indirect external influence that could affect the performance of their duties, or their decision-making processes.

Tags: Austria, Data Protection Authorities, Data Protection Directive, European Commission
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Dan Cooper Dan Cooper

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing…

Daniel Cooper is co-chair of Covington’s Data Privacy and Cyber Security Practice, and advises clients on information technology regulatory and policy issues, particularly data protection, consumer protection, AI, and data security matters. He has over 20 years of experience in the field, representing clients in regulatory proceedings before privacy authorities in Europe and counseling them on their global compliance and government affairs strategies. Dan regularly lectures on the topic, and was instrumental in drafting the privacy standards applied in professional sport.

According to Chambers UK, his “level of expertise is second to none, but it’s also equally paired with a keen understanding of our business and direction.” It was noted that “he is very good at calibrating and helping to gauge risk.”

Dan is qualified to practice law in the United States, the United Kingdom, Ireland and Belgium. He has also been appointed to the advisory and expert boards of privacy NGOs and agencies, such as the IAPP’s European Advisory Board, Privacy International and the European security agency, ENISA.

Read more about Dan CooperEmail
Show more Show less