I suppose that {i}on balance{/i} the judges of the Court of Justice have a better understanding of data protection law than I do. I tend to think that most of them are cleverer than I am – indeed, under pressure, I’d probably accept that all of them are a lot cleverer than I am. But when cobbling together some coverage of the recent {ECJ decision on data protection supervision and the meaning of complete independence: http://www.scl.org/site.aspx?i=ne15422}, I did begin to wonder whether they have lost sight of realities. I even worried that the decision might demonstrate a desperate hankering after ‘true independence’ – a dangerous desire indeed.
Essentially the ECJ decision rules that the German system for a degree of State oversight for data protection supervision authorities is a breach of the Data Protection Directive’s requirement that such authorities must be ‘completely independent’.
Most of us value our independence. From teenage years onwards, there is a fight to establish a degree of independence and then real life bites and the fight is to reduce the amount of independence we surrender – whether in jobs, relationships or dealings with the state. My experience is that the completely independent – those who really don’t care what others think and do not allow it to colour their actions – are either sociopaths or drunks. People in a relationship don’t come to a view on much, not even the correct position of the toilet seat, with ‘complete independence’; persons in work rarely even glimpse ‘complete independence’ whether because of pressures from the boss or pressures from clients/customers; those of us who live in a listed building know that a man’s home is his castle, only insofar as the local authority consents. Independence is a relative concept in every normal situation. And, even when applied in the context of judges and data protection supervisors, I think it still has some limits.
For example, judges must seek to be independent of pressures, whether from the State, the press, the public or any other source. But we do not expect them to have such complete independence that they can dance naked in the courtroom or sleep their way through tedious closing arguments. We’d expect someone to intervene and stop such behaviour. No matter how carefully the separation of powers is managed, that intervention is likely to come from the State.
In {i}EU Commission v Germany{/i}, the description of the oversight given by the Commission itself was that it was designed to establish whether the monitoring carried out by the data protection supervisory authorities was rational, lawful and proportionate. Surely such supervision is a necessary element in a democratic society. According to the Advocate General’s opinion in the case, ‘there is nothing to indicate that oversight is exercised in a way that might hinder the data protection supervisory authorities in exercising their functions with complete independence. The Commission cannot merely make assertions that this is so; it is up to it to establish that oversight does have such effects’. That seems bang on the money to me.
The ECJ claim that, when carrying out their duties, the supervisory authorities must act objectively and impartially and that a duty to report periodically to parliamentary authorities is consistent with the Directive. But, while the Court states that the absence of parliamentary influence over the data protection authorities is ‘inconceivable’, it seems to have conceived just such a monster.
