European Commission v Hungary (C-288/12)

Contents

Judgment of the Court (Grand Chamber)8 April 2014^note(Failure of a Member State to fulfil obligations — Directive 95/46/EC — Protection of individuals with regard to the processing of personal data and the free movement of such data — Article 28(1) — National supervisory authorities — Independence — National legislation prematurely bringing to an end the term served by the supervisory authority — Creation of a new supervisory authority and appointment of another person as head of that authority)In Case C‑288/12,ACTION under Article 258 TFEU for failure to fulfil obligations, brought on 8 June 2012,European Commission, represented by K. Talabér-Ritz and B. Martenczuk, acting as Agents, with an address for service in Luxembourg,European Data Protection Supervisor (EDPS), represented by I. Chatelier, A. Buchta, Z. Belényessy and H. Kranenborg, acting as Agents,vHungary, represented by M.Z. Fehér, acting as Agent,THE COURT (Grand Chamber),composed of V. Skouris, President, K. Lenaerts, Vice-President, M. Ilešič, L. Bay Larsen, T. von Danwitz, E. Juhász, A. Borg Barthet, C.G. Fernlund and J.L. da Cruz Vilaça, Presidents of Chambers, G. Arestis, J. Malenovský, M. Berger, A. Prechal, E. Jarašiūnas (Rapporteur) and C. Vajda, Judges,Advocate General: M. Wathelet,Registrar: C. Strömholm, Administrator,having regard to the written procedure and further to the hearing on 15 October 2013,after hearing the Opinion of the Advocate General at the sitting on 10 December 2013,gives the following

Judgment

1By its action, the European Commission asks the Court to declare that, by prematurely bringing to an end the term served by the supervisory authority for the protection of personal data, Hungary has failed to fulfil its obligations under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (OJ 1995 L 281, p. 31).

Legal context

EU law

2Recital 62 in the preamble to Directive 95/46 states:‘… the establishment in Member States of supervisory authorities, exercising their functions with complete independence, is an essential component of the protection of individuals with regard to the processing of personal data’.

3Paragraphs 1 and 2 of Article 28 of Directive 95/46, which is entitled ‘Supervisory authority’, provide:1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.These authorities shall act with complete independence in exercising the functions entrusted to them.2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals’ rights and freedoms with regard to the processing of personal data.’

4Under Chapter V of Regulation (EC) No 45/2001 of the European Parliament and of the Council of 18 December 2000 on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data (OJ 2001 L 8, p. 1), an independent supervisory authority is established, namely, the European Data Protection Supervisor (EDPS).

5Article 42 of Regulation No 45/2001, which is entitled ‘Appointment’, provides:1. The European Parliament and the Council shall appoint by common accord the [EDPS] for a term of five years, on the basis of a list drawn up by the Commission following a public call for candidates.…3. The [EDPS] shall be eligible for reappointment.4. Apart from normal replacement or death, the duties of the [EDPS] shall end in the event of resignation or compulsory retirement in accordance with paragraph 5.5. The [EDPS] may be dismissed or deprived of his … right to a pension or other benefits in its stead by the Court of Justice at the request of the European Parliament, the Council or the Commission, if he … no longer fulfils the conditions required for the performance of his … duties or if he … is guilty of serious misconduct.…’

Hungarian law

6Until 31 December 2011, the supervisory authority for the protection of personal data, referred to in Article 28 of Directive 95/46 (‘the supervisory authority’ or ‘the Authority’), was governed by Law LXIII of 1992 on the Protection of Personal Data and Access to Data of Public Interest, as amended (‘the Law of 1992’). Article 23 of that law was worded as follows:1. The Parliament shall appoint a data protection supervisor [(‘the Supervisor’)] in order to safeguard the constitutional right to the protection of personal data and access to data of public interest …2. The Law on the Parliamentary Commissioner for Civil Rights shall apply — subject to the derogations allowed under the present law — to the [Supervisor].’

7Articles 24 and 25 of the Law of 1992 set out the Supervisor’s tasks. In particular, Article 24(a) provided that the Supervisor was to ‘verify compliance with the present law and other legal rules on the processing of personal data, acting upon a complaint or upon his own initiative, if no judicial proceedings are pending in relation to that file’ and Article 24(d) stated that the Supervisor was to ‘promote the uniform application of legislative provisions relating to the processing of personal data and access to data of public interest’.

8Since the Law of 1992 was silent as regards the duration or the ending of the Supervisor’s term in office, Law LIX of 1993 on the Parliamentary Commissioner for Civil Rights, in the version in force until 31 December 2011 (‘the Law of 1993’), applied. Article 4(5) of the Law of 1993 provided that the Parliamentary Commissioner was to be elected for six years and could be re-elected once. Article 15 of that law governed the circumstances in which the term served in office could come to an end, providing as follows:1.The Parliamentary Commissioner shall vacate office upon:(a) expiry of the term of office,(b) death,(c) resignation,(d) declaration of a conflict of interest,(e) compulsory retirement,(f) compulsory resignation.2. The President of the Parliament shall bring the Parliamentary Commissioner’s term in office to an end in accordance with points (a), (b) and (c) of paragraph 1. A parliamentary decision shall be required in the situations referred to in points (d), (e) and (f) of paragraph 1. The adoption of a declaration ending the term in office shall require a two-thirds majority.3. Resignations must be submitted in writing to the President of the Parliament. The term in office of the Parliamentary Commissioner shall come to an end on the date indicated in the letter of resignation. A declaration of acceptance shall not be necessary in order for the resignation to take effect.…’

9The situations referred to in points (d), (e) and (f) of Article 15(1) of the Law of 1993 are regulated in detail in Article 15(4), (5) and (6) of that law. In particular, Article 15(5) of the Law of 1993 provided that compulsory retirement could not take place unless the Parliamentary Commissioner proved incapable of carrying out the duties relating to his term of office for a period in excess of 90 days, for reasons not attributable to him. Under Article 15(6) of that law, compulsory resignation could be decided upon in certain circumstances: (i) if the Parliament Commissioner failed to carry out the duties relating to his term of office for a period in excess of 90 days, for reasons attributable to him; (ii) if he deliberately refrained from meeting his obligation to declare his assets; (iii) if he had intentionally quoted incorrect data or facts in his declaration of assets; or (iv) if he had committed an offence established by a judgment which had acquired the authority of res iudicata.

10The Fundamental Law of Hungary entered into force on 1 January 2012. Under Article VI(3) thereof, ‘[e]xercise of the right to the protection of personal data and access to data of public interest shall be supervised by an independent authority established by statute’. Paragraphs 3 and 5 of the final provisions of the Fundamental Law provide, respectively, that the Parliament is to adopt transitional measures separately and that those provisions are to form part of the Fundamental Law.

11Article 16 of those transitional provisions, adopted by the Parliament, states:‘The term served in office by the incumbent [Supervisor] shall come to an end upon the entry into force of the present Fundamental Law.’

12On 1 January 2012, Hungarian legislation on the supervisory authority was amended accordingly and Law No CXII of 2011 on the right to informational self-determination and freedom of information (‘the Law of 2011’) — which, under Article 77(a) thereof, transposes Directive 95/46 into Hungarian law — entered into force. The Law of 2011 repeals the Law of 1992 and replaces the Supervisor with the Nemzeti Adatvédelmi és Információszabadság Hatóság (National Authority for Data Protection and Freedom of Information) (‘the Authority’).

13The tasks of the Authority are set out in Article 38(2) and (3) of the Law of 2011. Article 38(2) of that law provides that the Authority ‘has the task of monitoring and promoting application of the law on access to data of public interest and data accessible on public interest grounds, and the protection of personal data’. Article 38(3) of the Law of 2011 provides inter alia that, in performance of the tasks entrusted to it, the Authority may act on the basis of a complaint or of its own motion.

14Paragraphs 1 and 2 of Article 75 of the Law of 2011 ensures continuity between the Supervisor, on the one hand, and the Authority, on the other, by providing, in essence, that the Authority is to handle the files opened by the Supervisor on the basis of observations submitted before 1 January 2012 and that, after 1 January 2012, the Authority is to process the data that the Supervisor processed before that date.

15Article 38(5) of the Law of 2011 states that ‘the Authority shall be independent and shall be subject only to the law; it may not take any instructions within its sphere of competence and shall perform its tasks in full independence from other bodies, without being subject to any influence whatsoever’. Under that provision, the tasks of the Authority are to be established exclusively by statute.

16Under Article 40(1) and (3) of the Law of 2011, the Head of the Authority is to be appointed by the President of the Republic, upon a recommendation by the Prime Minister, for a term of nine years and Article 45 of that law governs the circumstances in which his term in office may come to an end. Under Article 45(1) of the Law of 2011, as amended by Law No XXV of 2012, which entered into force on 7 April 2012:‘The Head of the Authority shall vacate office upon:(a) expiry of the term of office;(b) resignation;(c) death;(d) a finding that the conditions for appointment have not been met or that the rules relating to the declaration of assets have been infringed;(e) a finding of a conflict of interest.’

17Those situations are regulated in detail by Article 45(2) to (8) of the Law of 2011, as amended by Law No XXV of 2012.

18Article 74 of the Law of 2011 establishes the rules relating to the appointment of the first Head of the Authority. It provides:‘Before 15 November 2011, the Prime Minister shall propose a name to the President of the Republic for appointment as first Head of the Authority. The President of the Republic shall appoint the first Head of the Authority with effect from 1 January 2012.’

Facts

19On 29 September 2008, Mr Jóri was appointed Supervisor in accordance with the Law of 1992 and took up his duties on that same date. As Mr Jóri was appointed for a term of six years, he should not have vacated office until the end of September 2014 but, pursuant to Article 16 of the transitional measures of the Fundamental Law, he had to vacate office on 31 December 2011. The Authority commenced operations on 1 January 2012 and, on a proposal from the Prime Minister, the President of the Republic appointed Mr Péterfalvi as Head of the Authority for a term of nine years.

The pre-litigation procedure and the proceedings before the Court of Justice

20On 17 January 2012, the Commission sent Hungary a letter of formal notice. In that letter, the Commission expressed the view that Hungary had infringed Article 28(1) and (2) of Directive 95/46 in the following ways: (i) by compelling the Supervisor to vacate office before his full term had expired; (ii) by failing to consult the Supervisor regarding the draft of the new law on data protection; and (iii) by offering, under that new law, too many opportunities for prematurely bringing to an end the term served by the Head of the Authority and according a role in that connection to the President of the Republic and the Prime Minister.

21By letter of 17 February 2012, Hungary denied the infringement imputed to it. First, Hungary claimed that the premature bringing to an end of the term served by the Supervisor was prompted by the change in the Hungarian supervisory authority model; that the Supervisor did not wish to be appointed as Head of the Authority; and that to compel the current Head to vacate office before serving his full term would be in breach of the legislation guaranteeing his independence. Secondly, Hungary provided the Commission with documents relating to consultation with the Supervisor regarding the draft of the new law on data protection. Thirdly, Hungary stated that the provisions relating to possible grounds for prematurely bringing to an end the term served by the Head of the Authority had been amended in order to meet the Commission’s concerns.

22On 7 March 2012, the Commission sent Hungary a reasoned opinion, in which the Commission withdrew its reservations concerning consultation with the Supervisor regarding the draft new law on data protection. On the other hand, the Commission repeated its concerns regarding the fact that the Supervisor had had to vacate office without serving his full term, as well as the possible grounds for prematurely bringing to an end the term served by the Head of the Authority and the role played in that connection by the President of the Republic and the Prime Minster. With regard to that last point, the Commission nevertheless stated that if Hungary had adopted the proposed legislative amendments by the deadline set in the reasoned opinion — one month from notification — the Commission would consider that the infringement in that regard had come to an end.

23By letter of 30 March 2012, Hungary replied to the reasoned opinion, stating that the amendment to Article 45 of the Law of 2011 was to be adopted within the next few days. The amendment was indeed adopted on 2 April 2012 by Law No XXV of 2012, which entered into force on 7 April 2012. In its letter, however, Hungary maintained its point of view with regard to the premature bringing to an end of the term served by the Supervisor, and the Commission accordingly brought the present action.

24By letter of 6 December 2012, Hungary requested, on the basis of Article 60(1) of the Rules of Procedure of the Court of Justice, that the case be assigned to the Grand Chamber.

25By order of the President of the Court of 8 January 2013, the EDPS was granted leave to intervene in support of the form of order sought by the Commission.

The action

Admissibility

Arguments of the parties

26Hungary contends that the present action is inadmissible, because if it leads to a ruling that Hungary had, as alleged, failed to fulfil its obligations, compliance with that judgment will be impossible. Even if the Court were to find that the premature bringing to an end of the Supervisor’s term in office was in breach of Directive 95/46, the only conceivable way of rectifying the illegality would be to revoke the appointment of Head of the Authority, replacing the current Head with the former Supervisor, which would amount to committing the infringement alleged. According to Hungary, the Commission cannot apply to the Court for a judgment declaring a failure to fulfil obligations when the only way in which the Member State in question can comply with such a judgment is by infringing EU law. Moreover, to compel the Head of the Authority to vacate office before serving his full term would be in breach of the principle of the independence of the Authority, which is enshrined in the Fundamental Law.

27Furthermore, the approach proposed by the Commission in order to remedy the alleged infringement, if established, implies — Hungary argues — that all acts carried out by the incumbent Head of the Authority are incompatible with EU law because they were adopted by a supervisory authority that did not meet the requirements under Directive 95/46, and thus in breach of the principle of legal certainty. Hungary contends in that regard that the Law of 2011 nevertheless meets the requirements under Directive 95/46.

28The Commission claims that Hungary’s arguments must be rejected, since the present action retains its purpose and there is nothing to preclude compliance with a judgment establishing the alleged infringement.

Findings of the Court

29First of all, it should be borne in mind that, according to settled case-law, the question whether a Member State has failed to fulfil its obligations must be determined by reference to the situation prevailing in the Member State at the end of the period laid down in the reasoned opinion (Case C‑20/09 Commission v Portugal EU:C:2011:214, paragraph 31 and the case-law cited). In the present case, the deadline by which Hungary had to comply with the reasoned opinion was set at one month after notification of that opinion, that is to say, 7 April 2012.

30In that regard, the Court has admittedly ruled that an action for failure to fulfil obligations is inadmissible if, after expiry of the period laid down in the reasoned opinion, the alleged infringement does not continue to produce effects (see, to that effect, Case C‑221/04 Commission v Spain EU:C:2006:329, paragraphs 25 and 26, and Commission v Portugal EU:C:2011:214, paragraph 33).

31In the present case, however, the infringement alleged by the Commission resides in the fact that the Supervisor was prevented from serving his full term and it is common ground that the term of office initially defined had not expired by the date specified in the reasoned opinion. Accordingly, it cannot be found that the alleged infringement had ceased to produce effects by the deadline set in the reasoned opinion.

32Even if it were established that the Law of 2011 meets the requirements under Directive 95/46, that fact would be irrelevant in this context, as it has no bearing on the question whether the alleged infringement had ceased to produce effects by the deadline set in the reasoned opinion, since the present action concerns only the question whether, by prematurely bringing to an end the term served by the supervisor, Hungary has failed to fulfil its obligations under Directive 95/46.

33Next, it should be borne in mind that, if the Court finds that a Member State has failed to fulfil one of the obligations incumbent upon it under the Treaties, that State is required, in accordance with Article 260(1) TFEU, to take the measures necessary to comply with the judgment of the Court, since a question concerning the measures required for the implementation of a judgment establishing a failure to fulfil obligations under Article 258 TFEU does not form part of the subject-matter of such a judgment (see, to that effect, Case C‑503/04 Commission v Germany EU:C:2007:432, paragraph 15 and the case-law cited).

34The fact relied on by Hungary that it would be impossible, without infringing Directive 95/46 or the principle of legal certainty, for it to remedy the alleged infringement, if it were established, accordingly relates in any event to compliance with a judgment establishing failure to fulfil obligations and therefore has no bearing on the admissibility of the present action.

35Lastly, in response to Hungary’s argument that compliance with a judgment establishing the alleged infringement could create a situation incompatible with the Fundamental Law, it must be observed that the Court has consistently held that a Member State cannot plead provisions prevailing in its domestic legal system, even its constitutional system, to justify failure to observe obligations arising under EU law (see, inter alia, Case 102/79 Commission v Belgium EU:C:1980:120, paragraph 15, and Case C‑70/06 Commission v Portugal EU:C:2008:3, paragraphs 21 and 22).

36In the light of those considerations, the present action is admissible.

Substance

Arguments of the parties

37The Commission, supported by the EDPS, submits that it follows from the case-law that the phrase ‘with complete independence’ in Article 28(1) of Directive 95/46 means full independence, free from any influence — direct or indirect — which ensures that the supervisory authority concerned can act with complete freedom, without taking any instructions or being put under any pressure, free from external influence and without the threat of such influence being exercised.

38The Commission and the EDPS acknowledge that Directive 95/46 leaves Member States a measure of discretion as regards the implementation of Article 28 of that directive, in particular with regard to the institutional model and the duration of the supervisory authority’s term of office. Consequently, Member States are, in principle, free to set that term. However, once that term has been set, the Member State must respect it and cannot compel the office to be vacated before the expiry of that term, except for overriding and objectively verifiable reasons. A comparison with Article 42 of Regulation No 45/2001, relating to the EDPS, confirms that interpretation.

39In the present case, Hungary has not established that there were objective reasons to justify bringing the supervisor’s term in office to a premature end. First, the reform of the supervisory authority is not an acceptable justification, even though Hungary is entitled to change the institutional model for its supervisory authority. Secondly, Hungary has not established that the Supervisor had waived the right to serve his full term of office and refused to manage the Authority. Thirdly, it is irrelevant that the Hungarian legislation at issue forms part of the Fundamental Law and its transitional provisions or that the Law of 2011 satisfies, or fails to satisfy, the requirements under Directive 95/46.

40Hungary states, first of all, that the decision to replace the Supervisor with a body which operates as an authority and, accordingly, to bring to an end prematurely the term served by the Supervisor was adopted by the constitutional authority, and that the new legislation relating to the Authority is based on the Fundamental Law.

41With regard to the substance, Hungary contests the position argued for by the Commission and the EDPS. Hungary has doubts as to whether the requirement of independence set out in Article 28 of Directive 95/46 extends to the decision of a Member State on the form, or a change in the form, that the supervisory authority is to take, where the operation and decision-taking process of the body created meets the requirement of independence as provided for in that directive and as interpreted by the Court.

42According to Hungary, it is clear from the wording of Article 28 of Directive 95/46 and Article 44 of Regulation No 45/2001, and from the case-law of the Court that the requirement of independence provided for in Article 28(1) of Directive 95/46 relates to independence in the performance of the tasks entrusted to the supervisory authorities and therefore concerns the operational independence of the authority in question. The Hungarian legislation, both before and after 1 January 2012, fully satisfies that requirement. Article 28 of Directive 95/46 cannot support the inference that a right must be vested in the person appointed head of that authority to exercise the tasks entrusted to him. To the extent that the operational independence of the supervisory authority is intact, it is of little importance that a change be made regarding the person in charge of that authority even before the former incumbent has served his full term of office. That view is consistent with the discretion left to the Member States to set the duration of the term of office of supervisory authorities.

43Hungary argues that, since Directive 95/46 defines neither the structural organisation of supervisory authorities nor the term of office of the persons placed in charge, Member States are free to determine the institutional structure. That freedom extends to the appointment of the person entrusted to exercise the powers of the supervisory authority within the institutional model selected and the replacement of that person where there is a change in the institutional model, including the premature bringing to an end ‘in accordance with statute’ of the incumbent’s term in office.

44According to Hungary, the only limit that Article 28 of Directive 95/46 places on Member States is to ensure that the supervisory authorities are able to carry out their tasks smoothly, without any hiatus and with complete independence, throughout their term of office as set by the Member States. That is the position in the present case.

45Hungary argues that institutional changes to the system for the protection of personal data thus constitute an objective reason justifying the premature bringing to an end of the term served by the Supervisor. In view of the fact that the Fundamental Law and the related transitional provisions provide for those changes and for the premature bringing to an end of the Supervisor’s term in office, neither the old nor the new legislation could have provided differently in that respect. In the light of the institutional changes introduced by the new legislation, it would be unjustifiable to expect the incumbent Supervisor to be automatically entrusted with the office of Head of the Authority. Moreover, the Supervisor expressed his disagreement with the new institutional model and stated his intention not to accept that appointment.

46According to Hungary, if the Commission’s argument were upheld, Directive 95/46 would have to be interpreted as also precluding renewal of the term of office of the Head of the supervisory authority or the possibility for that person to serve in another elective public office. It follows from that argument that the hope of serving another term of office or of taking up another public position might induce the head of the supervisory authority to meet the actual or perceived expectations of the political powers, in the interests of career advancement.

Findings of the Court

47First of all, it should be borne in mind that the second subparagraph of Article 28(1) of Directive 95/46 requires Member States to set up one or more supervisory authorities with complete independence in the exercise of the duties entrusted to them. In addition, the requirement that compliance with the EU rules on the protection of individuals with regard to the processing of personal data is subject to control by an independent authority derives from the primary law of the European Union and, in particular, from Article 8(3) of the Charter of Fundamental Rights of the European Union and Article 16(2) TFEU.

48The establishment in Member States of independent supervisory authorities is thus an essential component of the protection of individuals with regard to the processing of personal data (Case C‑518/07 Commission v Germany EU:C:2010:125, paragraph 23, and Case C‑614/10 Commission v Austria EU:C:2012:631, paragraph 37), as stated in recital 62 in the preamble to Directive 95/46.

49It should be borne in mind that, in Hungary, the Law of 1992 provided that the Supervisor, elected for a term of six years, renewable once, was the supervisory authority for the protection of personal data within the meaning of Directive 95/46, a point which Hungary does not dispute.

50In order to determine whether the present action is well founded, it is necessary to examine whether — as the Commission maintains — the requirement, set out in the second subparagraph of Article 28(1) of Directive 95/46, to ensure that each supervisory authority is able to carry out the tasks entrusted to it in complete independence entails an obligation for the Member State concerned to allow that authority to serve its full term of office.

51The Court has held that the second subparagraph of Article 28(1) of Directive 95/46 must be interpreted as meaning that the supervisory authorities responsible for supervising the processing of personal data must enjoy an independence allowing them to perform their duties free from external influence. That independence precludes inter alia any directions or any other external influence in whatever form, whether direct or indirect, which may have an effect on their decisions and which could call into question the performance by those authorities of their task of striking a fair balance between the protection of the right to private life and the free movement of personal data (see, to that effect, Commission v Germany EU:C:2010:125, paragraph 30, and Commission v Austria EU:C:2012:631, paragraphs 41 and 43).

52The operational independence of supervisory authorities, in that their members are not bound by instructions of any kind in the performance of their duties, is thus an essential condition that must be met if those authorities are to satisfy the criterion of independence for the purposes of the second subparagraph of Article 28(1) of Directive 95/46, but — contrary to the assertions made by Hungary — such operational independence is not sufficient in itself to protect supervisory authorities from all external influence (Commission v Austria EU:C:2012:631, paragraph 42).

53In that regard, the Court has held that the mere risk that the State scrutinising authorities could exercise a political influence over the decisions of the supervisory authorities is enough to hinder the latter in the independent performance of their tasks. First, there could be ‘prior compliance’ on the part of those authorities in the light of the scrutinising authority’s decision-making practice. Secondly, in view of the role adopted by those authorities as guardians of the right to private life, the second subparagraph of Article 28(1) of Directive 95/46 requires that their decisions — and, therefore, the authorities themselves — remain above all suspicion of partiality (see Commission v Germany EU:C:2010:125, paragraph 36, and Commission v Austria EU:C:2012:631, paragraph 52).

54If it were permissible for every Member State to compel a supervisory authority to vacate office before serving its full term, in contravention of the rules and safeguards established in that regard by the legislation applicable, the threat of such premature termination to which that authority would be exposed throughout its term of office could lead it to enter into a form of prior compliance with the political authority, which is incompatible with the requirement of independence (see, to that effect, Commission v Austria EU:C:2012:631, paragraph 51). That is true even where the premature termination of the term served comes about as a result of the restructuring or changing of the institutional model, which must be organised in such a way as to meet the requirement of independence laid down in the applicable legislation.

55Moreover, in such a situation, the supervisory authority cannot be regarded as being able, in all circumstances, to operate above all suspicion of partiality. Accordingly, the independence requirement laid down in the second subparagraph of Article 28(1) of Directive 95/46 must necessarily be construed as covering the obligation to allow supervisory authorities to serve their full term of office and to have them vacate office before expiry of the full term only in accordance with the rules and safeguards established by the applicable legislation.

56The rules applicable to the circumstances in which the term served by the EDPS may be prematurely brought to an end reflect that interpretation. It can be seen from Chapter V of Regulation No 45/2001 and, in particular, from Article 42(4) and (5) thereof, under which the circumstances in which the EDPS can be called upon to vacate office before the full term has expired are strictly limited, that allowing the EDPS to serve its full term of office, save where this is precluded for overriding and objectively verifiable reasons, is an overarching requirement for its independence.

57In the present case, Article 15(1) of the Law of 1993, applicable to the Supervisor pursuant to Article 23(2) of the Law of 1992, provided that the Supervisor could be called upon to vacate office only upon expiry of his term of office or upon death, resignation, declaration of a conflict of interest, compulsory retirement or compulsory resignation. The last three situations require a decision of the Parliament to be adopted by a two-thirds majority. Moreover, compulsory retirement and compulsory resignation cannot take place except in limited circumstances, set out in Article 15(5) and (6) of that regulation respectively.

58It is common ground that the Supervisor was not compelled to vacate office pursuant to one of those provisions and, in particular, that the Supervisor did not officially resign.

59It follows that Hungary compelled the Supervisor to vacate office in contravention of the safeguards established by statute in order to protect his term of office, thereby compromising his independence for the purposes of the second subparagraph of Article 28(1) of Directive 95/46. The fact that it was because of institutional changes that he was compelled to vacate office before serving his full term cannot render that situation compatible with the requirement under that provision of independence for supervisory authorities, as stated in paragraph 54 above.

60It is true that Member States are free to adopt or amend the institutional model that they consider to be the most appropriate for their supervisory authorities. In doing so, however, they must ensure that the independence of the supervisory authority under the second subparagraph of Article 28(1) of Directive 95/46 is not compromised, which entails the obligation to allow that authority to serve its full term of office, in accordance with the findings made in paragraph 54 above.

61Moreover, even if — as Hungary maintains — the Supervisor and the Authority are fundamentally different in terms of their organisation and structure, those two bodies are, in essence, entrusted with identical tasks, that is to say, the tasks for which national supervisory authorities are responsible pursuant to Directive 95/46, as is apparent from the duties respectively entrusted to them and the continuity between their respective handling of files, as guaranteed under Article 75(1) and (2) of the Law of 2011. A mere change in institutional model cannot therefore objectively justify compelling the person entrusted with the duties of Supervisor to vacate office before expiry of his full term, without providing for transitional measures to ensure that he is allowed to serve his term of office in full.

62In the light of all the foregoing considerations, it must be held that, by prematurely bringing to an end the term served by the supervisory authority for the protection of personal data, Hungary has failed to fulfil its obligations under Directive 95/46.

Limitation of the temporal effects of the present judgment

63Hungary asks the Court to limit the temporal effects of its judgment by declaring that the established failure to fulfil obligations does not affect the term of office of the Head of the Authority. In support of its application, Hungary relies on the fact that the Law of 2011 is consistent with Directive 95/46, and on the novelty of the issue raised by the present case. The Commission, on the other hand, contends that the application should be refused.

64In that regard, even if judgments delivered under Article 258 TFEU were to have the same effects as those delivered under Article 267 TFEU and even if considerations of legal certainty might therefore make it necessary, exceptionally, to limit their temporal effects, always provided that the conditions laid down by the Court’s case-law in the context of Article 267 TFEU are met (see, inter alia, Case C‑178/05 Commission v Greece EU:C:2007:317, paragraph 67 and the case-law cited, and Case C‑82/10 Commission v Ireland EU:C:2011:621, paragraph 63 and the case-law cited), it must be held that, in the present case, Hungary has not established that those conditions have been met. In particular, in the light of the failure to fulfil obligations established in paragraph 62 above, the phrase ‘with complete independence’ in the second subparagraph of Article 28(1) of Directive 95/46 is clear in itself and, in any event, that phrase has already been interpreted by the Court in Case C‑518/07 Commission v Germany EU:C:2010:125, that is to say, more than a year before the failure established in the present case. Following that judgment, EU law could not reasonably have been understood as authorising Hungary to call upon the Supervisor to vacate office without serving his full term.

65Consequently, Hungary’s application for limitation of the temporal effects of the present judgment must be refused.

Costs

66Under Article 138(1) of the Rules of Procedure, the unsuccessful party is to be ordered to pay the costs if they have been applied for in the successful party’s pleadings. Since the Commission has applied for costs and Hungary has been unsuccessful, the latter must be ordered to pay the costs.

67Under Article 140(3) of those rules, the Court may order an intervener other than those mentioned in Article 140(1) and (2) to bear its own costs. Accordingly, the Court finds that the EDPS, which has intervened in the proceedings, must bear its own costs.

Operative part

On those grounds, the Court (Grand Chamber) hereby:

1.Declares that, by prematurely bringing to an end the term served by the supervisory authority for the protection of personal data, Hungary has failed to fulfil its obligations under Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data;

2.Orders Hungary to pay the costs;

3.Orders the European Data Protection Supervisor (EDPS) to bear its own costs.