The European Commission has started infringement procedures against the governments of Austria and Germany for not creating adequate independence of the Data Protection Authorities.

In Austria, the Commission was alerted by a complaint from the data protection association Arge Daten in October 2003. On 5 July 2005, the Commission responded by instigating official proceedings against the Republic for a faulty implementation of Article 28 (1) second sentence of the data protection directive (95/46/EG) which requires that data protection authorities shall exercise their functions with complete independence.

The Austrian Data Protection Commission is, in terms of organisation and staff, integrated in the Federal Chancellery and its managing member is a senior official of the Chancellery.

In its 2005 activity report the Data Protection Commission (DPC) responds to the European Commission by describing the history of its organisational structures. It claims in 1999 Austria was one of the first states to implement the directive in national law and that it was unclear at the time what standards would develop for "independent protection authorities".

Besides the lamentable lack of independence the Austrian DPC suffers from a chronical shortage of staff. After some increases in the last two years the DPC now employs eight persons plus 10 persons working with the Data Processing Register. This amounts to a proportion of 1 data protection officer per 400.000 inhabitants. In a roughly equally sized country like Sweden this ratio is 1:230.769. Larger countries like the Czech Republic and Hungary still range before Austria, with 1:126.582 and 1:185.185.

This staff shortage results in the disability of the DPC to undertake event-unrelated investigations and in an all time high of formal complaints because of unjustified long processing times. In its activity report the DPC states that while other problems remain at least the long processing times should be a thing of the past. It is to hope that the formal action of the European Commission will do its part to help resolve the remaining problems.

Similarly, in Germany government has been given until 5 September 2005 by the Commission to create full independence of the regional DPAs. This decision was also inspired by a complaint filed in 2003, this time by the legal scientist Patrick Breyer. On the provincial level, members of the local government (Regierungspräsidium) act as data protection authority. While these DPAs have formal independence regarding state data protection, in civil cases they are supervised by the provincial ministries. The e-zine Heise reports that Breyer elaborated on a specific example in the province of Hessen, where the DPA allowed an internet company (T-Online) to store the IP-numbers of a flat-fee service for a period of 80 days. When a user of this service was prosecuted for posting a satirical contribution, but acquitted, he took the data retention practice to court. The provincial DPA said it was perfectly legal, only to be corrected much later by an independent local judge who ordered T-Online to stop collecting detailed traffic data.

According to Breyer, the state-embedded provincial DPAs also respond 'in a lethargic way' to complaints from citizens, while the truly independent provincial DPAs defend civil rights in a very engaged way.

Letter from the Commission to Arge Daten (22.07.2005)
ftp://ftp.freenet.at/beh/eu-vertragsverletzung-5109.pdf

Datenschutzbericht 2005, Report of the Austrian Data Protection Commission covering 01.01.2002 until 30.06.2005
http://www.dsk.gv.at/Datenschutzbericht2005.pdf

EU-Kommission pocht auf Unabhängigkeit der Datenschutzbehörden (23.07.2005)
http://www.heise.de/newsticker/meldung/62007

(Contribution about Austria by Andreas Krisch, EDRI-member VIBE!AT)