For the purpose of providing effective data protection, supervisory authorities must act with complete independence (Article 52(1)). Independence is essential to ensure the proper level of data protection in all EU countries and free data flow within the EU single market.
The requirement of independence is addressed both to the Member States and public authorities. It means that not only national legislators have to implement specific legal provisions that will guarantee the independence of supervisory authorities but also the organisational structure of the authority must demonstrate this quality.
Based on Article 52 of GDPR we can distinguish three different conditions of supervisory authority’s independence:
- 1)institutional independence which means no supervisory authority should be subject to any other public body, especially governmental, or could be held criminally liable or deprived of liberty;
- 2)functional independence which excludes control of any other public authority within the scope of exercising its’ tasks and powers;
- 3)organisational independence, guaranteed by proper internal infrastructure, including financial and human resources.
The importance of supervisory authorities independence has been underlined by the Court of Justice of EU. The Court issued several rulings concerning this issue in which it stated that independence – yet within the meaning of Article 28(1) of Directive 95/46/EC – precludes not only any influence exercised by the supervised bodies but also any directions or any other external influence, whether direct or indirect, which could call into question the performance by those authorities of their task consisting of establishing a fair balance between the protection of the right to private life and the free movement of personal data. Thus, supervisory authorities are considered as the guardians of fundamental rights and freedoms related to data protection, so they must act objectively and impartially. In subsequent judgments, the Court explained that the independent status also precludes any indirect influence which is liable to have an effect on the supervisory authority’s decisions. The Court emphasised that any political influence, e.g., compelling to vacate the office without serving its full term is inadmissible.
The independence of supervisory authorities is also perceived as a fundamental requirement by the Council of Europe. Article 15 of Modernised Convention 108 obliges each party to the Convention to provide for one or more public authorities to be responsible for ensuring compliance with the provisions of the Convention and which will act with complete independence and impartiality in performing their duties and exercising their powers and in doing so shall neither seek nor accept instructions.
Article 52 of GDPR provides several conditions and criteria of complete independence of supervisory authority. To ensure compliance with this provision, members of each supervisory authority must remain free from external influence, whether direct or indirect, and shall neither seek nor take instructions from anybody while exercising their tasks and powers. They must refrain from any action incompatible with their duties to prevent a potential conflict of interests. Independence of members of the supervisory authority is a prerequisite to the independence of supervisory authority itself. Personal independence is also relevant in the light of Article 53 (4) of GDPR, as failure to comply with conflict of interest limitations may be considered as a serious misconduct and may lead to dismissal or compulsory retirement.
Certain obligations are imposed on Member States in order to satisfy the requirement of independence. The first and foremost duty of a Member State is to provide supervisory authority (or each of them if there are multiple supervisory authorities in a particular country – e.g., Germany) with proper resources, including human, technical and financial resources, premises and infrastructure that are necessary for the effective performance of their tasks and duties related to mutual assistance, cooperation and participation in the European Data Protection Board. The supervisory authorities must be given the opportunity to freely choose – based on justified reasons and needs – their own staff that will not be subject to any external directions or instructions. As regards financial control over supervisory authority, it cannot affect its independence; therefore supervisory authorities are required to have separate and public annual budgets.
The supervisory authority’s independence is also systemic which means that actions or functions carried out by other national bodies should be of no relevance for the activity of supervisory authority. In particular, measures concerning the legislative process or binding interpretation of law, adopted by other authorities, should have no effect on the scope of competences and discretion of supervisory authority. Otherwise, it may affect its independence and adversely influence the role it plays in the data protection system.