The party’s over: EU data protection law after the Schrems Safe Harbour judgment

Steve Peers

The relationship between intelligence and law enforcement agencies (and companies like Google and Facebook) and personal data is much like the relationship between children and sweets at a birthday party. Imagine you’re a parent bringing out a huge bowl full of sweets (the personal data) during the birthday party – and then telling the children (the agencies and companies) that they can’t have any. But how can you enforce this rule? If you leave the room, even for a moment, the sweets will be gone within seconds, no matter how fervently you insist that the children leave them alone while you’re out. If you stay in the room, you will face incessant and increasingly shrill demands for access to the sweets, based on every conceivable self-interested and guilt-trippy argument. If you try to hide the sweets, the children will overturn everything to find them again.

When children find their demands thwarted by a strict parent, they have a time-honoured circumvention strategy: “When Mummy says No, ask Daddy”. But in the Safe Harbour case, things have happened the other way around. Mummy (the Commission) barely even resisted the children’s demands. In fact, she said Yes hours ago, and retired to the bath with an enormous glass of wine, occasionally shouting out feeble admonitions for the children to tone down their sugar-fuelled rampage. Now Daddy (the CJEU) is home, shocked at the chaos that results from lax parenting. He has immediately stopped the supply of further sweets. But the house is full of other sugary treats, and all the children are now crying. What now?

In this post, I’ll examine the reasons why the Court put its foot down, and invalidated the Commission’s ‘Safe Harbour’ decision which allows transfers of personal data to the USA, in the recent judgment in Schrems. Then I will examine the consequences of the Court’s ruling. But I should probably admit for the record that my parenting is more like Mummy's than Daddy's in the above example. 

Background

For more on the background to the Schrems case, see here; on the hearing, see Simon McGarr’s summary here; and on the Advocate-General’s opinion, see here. But I’ll summarise the basics of the case again briefly.

Max Schrems is an Austrian Facebook user who was disturbed by Edward Snowden’s revelations about mass surveillance by US intelligence agencies. Since he believed that transfers of his data to Facebook were subject to such mass surveillance, he complained to the Irish data protection authority, which regulates Facebook’s transfers of personal data from the EU to the USA.

The substantive law governing these transfers of personal data was the ‘Safe Harbour’ agreement between the EU and the USA, agreed back in 2000. This agreement was put into effect in the EU by a decision of the Commission, which was adopted pursuant to powers conferred upon the Commission by the EU’s current data protection Directive. The latter law gives the Commission the power to decide that transfers of personal data outside the EU receive an ‘adequate level of protection’ in particular countries.

The ‘Safe Harbour’ agreement was enforced by self-certification of the companies that have signed up for it (note that not all transfers to the USA fell within the scope of the Safe Harbour decision, since not all American companies signed up). Those promises were in turn meant to be enforced by the US authorities. But it was also possible (not mandatory) for the national data protection authorities which enforce EU data protection law to suspend transfers of personal data under the agreement, if the US authorities or enforcement system found a breach of the rules, or on a list of limited grounds set out in the decision.

The Irish data protection authority refused to consider Schrems’ complaint, so he challenged that decision before the Irish High Court, which doubted that this system was compatible with EU law (or indeed the Irish constitution). So that court asked the CJEU to rule on whether national data protection authorities (DPAs) should have the power to prevent data transfers in cases like these.

The judgment

The CJEU first of all answers the question which the Irish court asks about DPA jurisdiction over data transfers (the procedural point), and then goes on to rule that the Safe Harbour decision is invalid (the substantive point).

Following the Advocate-General’s view, the Court ruled that national data protection authorities have to be able to consider claims that flows of personal data to third countries are not compatible with EU data protection laws if there is an inadequate level of data protection in those countries, even if the Commission has adopted a decision (such as the Safe Harbour decision) declaring that the level of protection is adequate. Like the Advocate-General, the Court based this conclusion on the powers and independence of those authorities, read in light of the EU Charter of Fundamental Rights, which expressly refers to DPAs’ role and independence. (On the recent CJEU case law on DPA independence, see discussion here). In fact, the new EU data protection law currently under negotiation (the data protection Regulation) will likely confirm and even enhance the powers and independence of DPAs. (More on that aspect of the proposed Regulation here).

The Court then elaborates upon the ‘architecture’ of the EU’s data protection system as regards external transfers. It points out that either the Commission or Member States can decide that a third country has an ‘adequate’ level of data protection, although it focusses its analysis upon what happens if (as in this case) there is a Commission decision to this effect. In that case, national authorities (including DPAs) are bound by the Commission decision, and cannot issue a contrary ruling.

However, individuals like Max Schrems can still complain to the DPAs about alleged breaches of their data protection rights, despite the adoption of the Commission decision. If they do so, the Court implies that the validity of the Commission’s decision is therefore being called into question. While all EU acts must be subject to judicial review, the Court reiterates the usual rule that national courts can’t declare EU acts invalid, since that would fragment EU law: only the CJEU can do that. This restriction applies equally to national DPAs.

So how can a Commission decision on the adequacy of third countries’ data protection law be effectively challenged? The Court explains that DPAs must consider such claims seriously. If the DPA thinks that the claim is unfounded, the disgruntled complainant can challenge the DPA’s decision before the national courts, who must in turn refer the issue of the validity of the decision to the CJEU if they think it may be well founded. If, on the other hand, the DPA thinks the complaint is well-founded, there must be rules in national law allowing the DPA to go before the national courts in order to get the issue referred to the CJEU.

The Court then moves on to the substantive validity of the Safe Harbour decision. Although the national court didn’t ask it to examine this issue, the Court justifies its decision to do this by reference to its overall analysis of the architecture of EU data protection law, as well as the national court’s doubts about the Safe Harbour decision. Indeed, the Court is effectively putting its new architecture into use for the first time, and it’s quite an understatement to say that the national court had doubts about Safe Harbour (it had compared surveillance in the USA to that of Communist-era East Germany).

So what is an ‘adequate level of protection’ for personal data in third countries? The Court admits that the Directive is not clear on this point, so it has to interpret the rules. In the Court’s view, there must be a ‘high’ level of protection in the third country; this does not have to be ‘identical’ to the EU standard, but must be ‘substantially equivalent’ to it.  Otherwise, the objective of ensuring a high level of protection would not be met, and the EU’s internal standards for domestic data protection could easily be circumvented. Also, the means used in the third State to ensure data protection rights must be ‘effective…in practice’, although they ‘may differ’ from that in the EU. Furthermore, the assessment of adequacy must be dynamic, with regular automatic reviews and an obligation for a further review if evidence suggests that there are ‘doubts’ on this score; and the general changes in circumstances since the decision was adopted must be taken into account.

The Court then establishes that in light of the importance of privacy and data protection, and the large number of persons whose rights will be affected if data is transferred to a third country with an inadequate level of data protection, the Commission has reduced discretion, and is subject to ‘strict’ standards of judicial review. Applying this test, two provisions of the ‘Safe Harbour’ decision were invalid.

First of all, the basic decision declaring adequate data protection in the USA (in the context of Safe Harbour) was invalid. While such a decision could, in principle, be based on self-certification, this had to be accompanied by ‘effective detection and supervision mechanisms’ ensuring that infringements of fundamental rights had to be ‘identified and punished in practice’. Self-certification under the Safe Harbour rules did not apply to US public authorities; there was not a sufficient finding that the US law or commitments met EU standards; and the rules could be overridden by national security requirements set out in US law.

Data protection rules apply regardless of whether the information is sensitive, or whether there were adverse consequences for the persons concerned. The Decision had no finding concerning human rights protections as regards the national security exceptions under US law (although the CJEU acknowledged that such rules pursued a legitimate objective), or effective legal protection in that context. This was confirmed by the Commission’s review of the Safe Harbour decision, which found (a) that US authorities could access personal data transferred from the EU, and then process it for purposes incompatible with the original transfer ‘beyond what was strictly necessary and proportionate for the purposes of national security’, and (b) that there was no administrative or judicial means to ensure access to the data and its rectification or erasure.

Within the EU, interference with privacy and data protection rights requires ‘clear and precise rules’ which set out minimum safeguards, as well as strict application of derogations and limitations.  Those principles were breached where, ‘on a generalised basis’, legislation authorises ‘storage of all the personal data of all the persons whose data has been transferred’ to the US ‘without any differentiation, limitation or exception being made in light of the objective pursued’ and without any objective test limiting access of the public authorities for specific purposes. General access to the content of communications compromises the ‘essence’ of the right to privacy. On these points, the Court expressly reiterated the limits on mass surveillance set out in last year’s Digital Rights judgment (discussed here) on the validity of the EU’s data retention Directive. Furthermore, the absence of legal remedies in this regard compromises the essence of the right to judicial protection set out in the EU Charter. But the Commission made no findings to this effect.

Secondly, the restriction upon DPAs taking action to prevent data transfers in the event of an inadequate level of data protection in the USA (in the context of Safe Harbour) was also invalid. The Commission did not have the power under the data protection Directive (read in light of the Charter) to restrict DPA competence in that way. Since these two provisions were inseparable from the rest of the Safe Harbour decision, the entire Decision is invalid. The Court did not limit the effect of its ruling.

Comments

The Court’s judgment comes to the same conclusion as the Advocate-General’s opinion, but with subtle differences that I’ll examine as we go along. On the first issue, the Court’s finding that DPAs must be able to stop data flows if there is a breach of EU data protection laws in a third country, despite an adequacy Decision by the Commission, is clearly the correct result. Otherwise it would be too easy for the standards in the Directive to be undercut by means of transfers to third countries, which the Commission or national authorities might be willing to accept as a trade-off for a trade agreement or some other quid pro quo with the country concerned.

As for the Court’s discussion of the architecture of the data protection rules, the idea of the data protection authorities having to go to a national court if they agree with the complainant that the Commission’s adequacy decision is legally suspect is rather convoluted, since it’s not clear who the parties would be: it’s awkward that the Commission itself would probably not be a party.  It’s unfortunate that the Court did not consider the alternative route of the national DPA calling on the Commission to amend its decision, and bringing a ‘failure to act’ proceeding directly in the EU courts if it did not do so. In the medium term, it would be better for the future so-called ‘one-stop shop’ system under the new data protection Regulation (see discussion here) to address this issue, and provide for a centralised process of challenging the Commission directly.

It’s interesting that the CJEU finds that there can be a national decision on adequacy of data flows to third States, since there’s no express reference to this possibility in the Directive. If such a decision is adopted, or if Member States apply the various mandatory and optional exceptions from the general external data protection rules set out in Article 26 of the data protection Directive, much of the Court’s Schrems ruling would apply in the same way by analogy. In particular, national DPAs must surely have the jurisdiction to examine complaints about the validity of such decisions too. But EU law does not prohibit the DPAs from finding the national decisions invalid; the interesting question is whether it obliges national law to confer such power upon the DPAs. Arguably it does, to ensure the effectiveness of the EU rules. Any decisions on these issues could still be appealed to the national courts, which would have the option (though not the obligation, except for final courts) to ask the CJEU to interpret the EU rules.

As for the validity of the Safe Harbour Decision, the Court’s interpretation of the meaning of ‘adequate’ protection in third States should probably be sung out loud, to the tune of ‘We are the World’. The global reach of the EU’s general data protection rules was already strengthened by last year’s Google Spain judgment (discussed here); now the Court declares that even the separate regime for external transfers is very similar to the domestic regime anyway. There must be almost identical degrees of protection, although the Court does hint that modest differences are permissible: accepting the idea of self-certification, and avoiding the issue of whether third States need an independent DPA (the Advocate-General had argued that they did).

It’s a long way from the judgment in Lindqvist over a decade ago, when the Court anxiously insisted that the external regime should not be turned into a copy of the internal rules; now it’s insistent that there should be as little a gap as possible between them. With respect, the Court’s interpretation is not convincing, since the word ‘adequate’ suggests something less than ‘essentially equivalent’, and the EU Charter does not bind third States.

But having said that, the American rules on mass surveillance would violate even a far more generous interpretation of the meaning of the word ‘adequate’. It’s striking that (unlike the Advocate-General), the Court does not engage in a detailed interpretation of the grounds for limiting Charter rights, but rather states that general mass surveillance of the content of communications affects the ‘essence’ of the right to privacy. That is enough to find an unjustifiable violation of the Charter.

So where does the judgment leave us in practice? Since the Court refers frequently to the primary law rules in the Charter, there’s no real chance to escape what it says by signing new treaties (even the planned TTIP or TiSA), by adopting new decisions, or by amending the data protection Directive. In particular, the Safe Harbour decision is invalid, and the Commission could only replace it with a decision that meets the standards set out in this judgment. While the Court refers at some points to the inadequacy or non-existence of the Commission’s findings in the Decision, it’s hard to believe that a new Decision which purports to claim that the American system now meets the Court’s standards would be valid if the Commission were not telling the truth (or if circumstances subsequently changed).

What standards does the US have to meet? The Court reiterates even more clearly that mass surveillance is inherently a problem, regardless of the safeguards in place to limit its abuse. Indeed, as noted already, the Court ruled that mass surveillance of the content of communications breaches the essence of the right to privacy and so cannot be justified at all. (Surveillance of content which is targeted on suspected criminal activities or security threats is clearly justifiable, however). In addition to a ban on mass surveillance, there must also be detailed safeguards in place. The US might soon be reluctantly willing to address the latter, but it will be even more unwilling to address the former.

Are there other routes which could guarantee that external transfers to the USA take place, at least until the US law is changed? In principle, yes, since (as noted above) there are derogations from the general rule that transfers can only take place to countries with an ‘adequate’ level of data protection. A first set of derogations is mandatory (though Member States can have exceptions in ‘domestic law governing particular cases’): where the data subject gives ‘consent unambiguously’; where the transfer is necessary to perform a contract with (or in the interest of) the data subject, or for pre-contractual relations; where it’s ‘necessary or legally required on important public interest grounds’, or related to legal claims; where it’s ‘necessary to protect the vital interests of the data subject’; or where it’s made from a public register. A second derogation is optional: a Member State may authorise transfers where the controller offers sufficient safeguards, possibly in the form of contractual clauses. The use of the latter derogation can be controlled by the Commission.

It’s hard to see how the second derogation can be relevant, in light of the Court’s concerns about the sufficiency of safeguards under the current law. US access to the data is not necessary in relation to a contract, to protect the data subject, or related to legal claims.  An imaginative lawyer might argue that a search engine (though not a social network) is a modern form of public register; but the record of an individual’s use of a search engine is not.

This leaves us with consent and public interest grounds. Undoubtedly (as the CJEU accepted) national security interests are legitimate, but in the context of defining adequacy, they do not justify mass surveillance or insufficient safeguards. Would the Court’s ruling in Schrems still apply fully to the derogation regarding inadequate protection? Or would it apply in a modified way, or not at all?

As for consent, the CJEU ruled last year in a very different context (credibility assessment in LGBT asylum claims) that the rights to privacy and dignity could not be waived in certain situations (see discussion here). Is that also true to some extent in the context of data protection? And what does unambiguous consent mean exactly? Most people believe they are consenting only to (selected) people seeing what they post on Facebook, and are dimly aware that Facebook might do something with their data to earn money. They may be more aware of mass surveillance since the Snowden revelations; some don’t care, but some (like Max Schrems) would like to use Facebook without such surveillance. Would people have to consent separately to mass surveillance? In that case, would Facebook have to be accessible for those who did not want to sign that separate form? Or could a ‘spy on me’ clause be added at the end of a long (and unread) consent form?  Consent is a crucial issue also in the context of the purely domestic EU data protection rules.

The Court’s ruling has addressed some important points, but leaves an enormous number of issues open. It’s clear that it will take a long time to clear up the mess left from this particular poorly supervised party.  

Barnard and Peers: chapter 9

Photo credit: www.businessinsider.com

Do Facebook and the USA violate EU data protection law? The CJEU hearing in Schrems

 

 

Simon McGarr, solicitor at McGarr solicitors

 

Last week, the CJEU held a hearing in the important case of Schrems v Data Protection Commissioner, which concerns a legal challenge brought by an Austrian law student to the transfers of his personal data to the USA by Facebook, on the grounds that his data would be subject to mass surveillance under US law, as revealed by Edward Snowden. His legal challenge was actually brought against the Irish data protection commissioner, who regulates such transfers pursuant to an agreement between the EU and the US known as the ‘Safe Harbour’ agreement. This agreement takes the form of a Decision of the European Commission made pursuant to the EU’s data protection Directive, which permits personal data to be transferred to the USA under certain conditions. He argued that the data protection authority has the obligation to suspend transfers due to breaches of data protection standards occurring in the USA. (For more detail on the background to the case, see the discussion of the original Irish judgment here).

 

The following summarises the arguments made at the hearing by the parties, including the intervening NGO Digital Rights Ireland, as well as several Member States, the European Parliament, the Commission and the European Data Protection Supervisor.  It then sets out the question-and-answer session between the CJEU judges (and Advocate-General) and the parties. The next step in this important litigation will be the opinion of the Advocate-General, due June 24^th.


Please note: these notes are presented for information purposes only. They are not an official record or a verbatim account of the hearing. They are based on rough contemporaneous notes and the arguments made at the hearing are paraphrased or compressed. Nothing here should be relied on for any legal or judicial purpose, and all the following is liable to transcription error.

  

Schrems v Data Protection Commissioner

Case C-362/14

 

Judges:

M.V Skouris (president); M.K. Lenaerts (Vice President); M.A. Tizzano; Mme R. Silva de Lapuerta; M. T. Von Danwitz (Judge Rapporteur); M. S. Rodin; Mme K. Jurimae; M. A Rosas; M. E. Juhász; M. A. Borg Barthet; M. J. Malenovsky; M. D. Svaby; Mme M. Berger; M. F. Biltgen; M. C. Lycourgos; M. F. Biltgen

 

M. Y. Bot (Advocat General)

 

Max Schrems

 

Noel Travers SC for Mr. Schrems told the court that personal data in the US is subject to mass and indiscriminate mass surveillance. The DRI v Ireland case struck down the EU data retention directive, establishing a principle which applies a fortiori to this case. However, the court held that Data Retention did not affect the essence of the right under Article 8, as it concerned only metadata. The surveillance carried out in the US accesses the content of data as well as the metadata, and without judicial oversight. This interference is so serious that it does violate the essence of Article 8 rights, unlike the data retention directive. Mr. Travers held that the Safe Harbour decision is contrary to the Data Protection directive’s own stated purpose, and that it was accordingly invalid.

 

Answering the Court’s question as to whether the decision precludes an investigation by a Data Protection Authority (DPA) such as the Irish Data Protection Commissioner, he submitted that compliance with fundamental rights must be part of the implementation of any Directive. Accordingly, national authorities, when called upon in a complaint to investigate breaches must have the power to do so.

 

Article 25.6 of the data protection Directive allows for findings on adequacy regarding a third country “by reason of its domestic law or of the international commitments it has entered into”. The Safe Harbour Principles (SHPs) and FAQs are not a law or an international agreement under the meaning of the Vienna Convention. And the SHPs do not apply to US public bodies. The Safe Harbour Principles are set out in an annex to a Commission Decision, but that annex is subject to US courts for interpretation and for compliance. Where there is a requirement for compliance with law, it is with US law, not EU law.

 

Irish Data Protection Commissioner

 

For the Data Protection Commissioner, Mr. Paul Anthony McDermott said that with power must come limitations. All national regulators are firstly bound by domestic law.  The Data Protection Commissioner is also bound by the Irish Constitutional division of powers. She cannot strike down laws, Directives or a Decision.

 

Mr. Schrems wanted to debate Safe Harbour in a general way- it wasn’t alleged then that Facebook was in breach of safe harbour or that his data was in danger. The Irish High Court had a limited Judicial Review challenge in front of it. Mr. Schrems didn’t challenge Safe Harbour, or the State, or EU law directly, and the Irish High Court declined the application by Digital Right Ireland to refer the validity of the Safe Harbour Decision to Luxembourg. Mr. McDermott asked the court to respect the parameters of the case.

 

Europe has decided to deal with the transfer of data to the US at a European level. The purpose of the Safe Harbour agreement is to reach a negotiated compromise. The words “negotiate”, “adapt” and “review” appear in the Decision. It is clear therefore that a degree of compromise is envisaged. Such matters are not to be dealt with in a court but, as they involve both legal and political issues, by diplomacy and realpolitik.

 

The Data Protection Commissioner can have regard to the EU Charter of Fundamental Rights when she’s balancing matters but it doesn’t trump everything. It doesn’t allow her to ignore domestic law or European law, Mr. McDermott concluded.

 

Digital Rights Ireland

 

For Digital Rights Ireland (DRI), Fergal Crehan BL said that while it was clear that the Decision permits some member states, under existing legislation, to question the adherence of individual organisations to the Safe Harbour Principles, that the Decision purported to require Member states to accept it as a full and final determination as to the adequacy of the law and practices of the United States of America. In this regard at least DRI agreed with the submissions of the Commission. However, the Decision in fact could not require member states to do so. Citing Case 34/78 Yoshida, and related cases, he said that the Decision was clearly an item of tertiary legislation, relying on the Directive for its legitimacy. It follows that the Decision must comply, not only with the Charter, but also with the Directive from which it takes its being.

 

The law of the EU requires independent supervision of the Fundamental Right to Data Protection. This is established in Article 8.3 of the Charter, and fleshed out in the Directive, particularly at Article 28. Accordingly, by purporting to abridge this supervisory power, it is the SHD which runs contrary to the norms of primary and secondary EU law, and therefore it is the SHD which must yield.

 

To the Court’s question as to whether such powers can be made subject to requirements such as those at 3(1)(b) of the Decision, he give a similar answer. The powers granted to Data Protection Authorities in the Directive cannot be limited by a Decision, where that Decision is made on foot of the Directive, without inverting the hierarchical norms of the EU legal order. Insofar as the Decision purports to do so, it was invalid.

 

Turning to the Court’s question as to whether the Decision be reviewed, under Article 46 of Regulation 45/2001, by the European Data Protection Supervisor (EDPS), he noted that Article 41 of that Regulation sets out the EDPS' remit as not only the "processing of personal data by a Community institution or body", but also advising Community institutions on all matters concerning the processing of personal data.

 

To the court’s question as to whether a decision on adequacy was limited to an examination of laws and international agreements, he noted that the Directive provides that “The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation”

 

Accordingly, the Commission must consider the adequacy of practice as well as law. It would be both absurd and entirely inadequate to the requirements of the Directive were the Commission to simply open the statute book of a third country, and assess adequacy solely on the basis of a legal order which might not correspond to reality.

 

In the judgment of this Court in NS v Secretary of State for the Home Department, it was held,:

 

“a third country can only be considered as a ‘safe third country’ where not only has it ratified the Geneva Convention and the ECHR but it also observes the provisions thereof.

 

It was further held in NS that mere ratification of conventions by a Member State cannot result in the application of a conclusive presumption that that State observes those conventions. The same principle is applicable both to Member States and third countries

 

Echoing Mr. Schrems, DRI submitted that an “adequate level of protection” must include effective judicial protection, noting that the Charter of Fundamental Rights provides, at Article 41 for the Right to Good Administration, and at Article 47 for the Right to An Effective Remedy.

 

However, FAQ 11 of the SHD offers organisations a choice of enforcement mechanisms, none of which involve submission to “an independent and impartial tribunal previously established by law” as required by the Charter. Even where options 2 or 3 set out in FAQ 11 could be said to satisfy the Charter requirement, the fact that they are optional, and may be shunned by the Safe Harbour Organisation in favour of option 1, a private sector mechanism, chosen and paid for by the Safe Harbour Organization, meant the Decision fails to provide effective independent judicial protection.

 

DRI also noted that while data subjects may make complaints to the US Federal Trade Commission, the FTC is not obliged to investigate them, and has never done so on even one occasion. This weakness of the Decision in the area of Enforcement was the subject of constant criticism by the Article 29 Working Party [the advisory body set up by the data protection directive] at every stage in the evolution of the Safe Harbour Agreement.

 

Mr. Crehan noted that the Decision does not require Safe Harbour Organizations to comply with the Safe Harbour Principles in practice. Rather it states, at article 1.3, that where an organization self-certifies, certain conditions shall be considered to have been met. The key condition is that the organisation receiving the data has disclosed its commitment to comply with the Safe Harbour Principles. The Commission notably did not take the perhaps more logical approach of making compliance itself a condition under Article 1.2. The effect of this formulation is that an organisation is deemed compliant by reason solely of its making a commitment to comply. The decision, he said, was not a "finding", in the everyday sense of that word; it was simply a decision to cease looking.

 

The findings of the Commission in its Communications on the functioning of Safe Harbour were findings, in the true and literal sense of the word. These ran contrary to that which the Commission purported to “find”, in the Safe Harbour Decision. The result was an extraordinary state of affairs where a “finding” was being defended in the very face of the commission’s own later findings to the contrary.

 

DRI acknowledged the difficulties that might be caused by a state of affairs where each and every national authority was to make its own intervention, each perhaps coming to different conclusions, and submitted that the EDPS might be best placed to intervene in a coordinating role.

 

Irish government

 

For the Republic of Ireland, Mr. David Fennelly BL submitted that the Safe Harbour Decision is binding on the Member States and remains binding while it is in force. Article 25 of the Directive must be read in a holistic way. The protection of personal data must be safeguarded in an appropriate way, but that there can be variations in the means of safeguarding. In regulating EU data beyond the borders, the EU can’t unilaterally impose its standards on third countries. That’s why Article 25 does not require “equivalent” level of protection, but an “adequate” level of protection.

 

Ireland noted with concern the Commission’s findings regarding the working of Safe Harbour, but also noted that the Commission did not think these were sufficiently serious to justify them either repealing or suspending the Decision.

 

The scheme created under Article 25 says that findings must be made through negotiations, and Member States are bound by the positive adequacy finding and can’t make any findings or do anything which would undermine the Commission’s negotiations.

 

Belgium

 

Counsel for Belgium submitted that there is no hierarchy of norms within the Directive, placing Chapter 4, which provides for the Safe Harbour Decision, above Chapter 6, which provides for the powers of DPAs. Chapter 6 is a general chapter which may be supplemented by chapter 4 but is not necessarily subordinate to it. The independence of national supervisory authorities is vital. The primary goal of the adequacy decision is to bring legal certainty. The Decision has no temporal limit, and while circumstances can change, there was no requirement to review the Safe Harbour Decision in the light of those new circumstances.

 

A member state, Belgium submitted, must not make an interpretation of their domestic law that is in defiance of the EU Charter Rights. So protection of Charter Rights might require that any limitations on DPAs be negated.

 

Austria

 

Counsel for The Republic of Austria noted that adequacy decisions are not directly applicable under EU Member States’ law, but are rather directed to Member States, requiring them to take necessary measures. Art 25.6 of the Directive doesn’t contain any express requirement on the Commission to act in the light of ongoing circumstances. However, other forms of EU law place an implicit requirement on the Commission to review matters. If the Commission doesn’t act, the adequacy decisions can be looked at by national supervisory authorities. Article 3 of the Decision provides for an “emergency exit” by granting powers to Data Protection authorities. But the Decision provided so narrow an exit, with so many different requirements for it to be invoked, that the national supervisory authorities in effect are prevented from enacting their powers.

 

How should these requirements be interpreted? It can’t just be a theoretical legal examination, but rather it needs to be a practical issue. Contrary to Ireland’s submissions, Austria saw this not as trying to force EU law on third parties but rather as taking EU citizens’ rights as a starting point and seeking to have them protected. Legal and judicial protection for EU citizens is a central issue.

 

There is no adequacy decision under Article 25.6 of the Directive. Safe Harbour is not a safe harbour for EU citizens but rather a safe harbour for data pirates. Safe Harbour has not amended US law or created any international requirements, so there is no legal basis for the Safe Harbour Decision. It should be repealed, though perhaps with a transitional period for legal certainty.

 

Poland

 

Counsel for Poland referred to Digital Rights Ireland’s point that the Decision was based on the Directive and must be interpreted in the light of the Directive. Therefore the Decision cannot prevent national supervisors from acting under their directive powers, as the Directive is of a higher rank so cannot be limited by the Decision. There can be a presumption of adequacy created by the Desicion, but the presumption must be rebuttable.

 

The safeguard mechanism is there to allow national supervisors to suspend flows, but it is too limited. Supervisory authorities must be permitted to conduct investigations, and if they find there is a problem, they must have the right to suspend data transfer. The Directive says that the adequacy of the protection in third countries must be considered in the light of all the circumstances – not just the rules, but also the facts.  This must include the availability of effective judicial oversight.

 

Slovenia

 

Counsel for Slovenia also submitted that national data protection authorities (DPAs) were not prevented from investigating by the Decision. To ensure an adequate level of protection in third parties, the Commission is not limited only to the assessment of legal norms but also their practical implementation. EU citizens have got judicial protections and if there are any breaches under Safe Harbour, there must be judicial remedies at the level of the EU law. The Commission’s findings point to a violation of human rights in respect of transfers and there should not be a requirement on the part of Mr. Schrems to prove an actual breach but to show a strong possibility of a breach.

 

United Kingdom

 

Counsel for the UK submitted that Member States must take all measures necessary to give effect to the Decision’s assessment. Article 25 of the Directive empowers the Commission to establish a common position for the Union, so as not to have conflicting findings. This is integral to international relations on data to allow for international trade.

 

DPAs can investigate the lawfulness of data processing. However, once the Commission has given its decision, the issue of lawfulness has been dealt with. But examining adequacy of individual data transfers remains within the local authorities’ remit. In this way the Directive is therefore in compliance with the Charter.

 

The Commission’s findings on the functioning of Safe Harbour were expressions of policy. They have no legal status, and there is not a requirement to act on foot of them. Had there been such a requirement, the Commission would have done so. Rather, they are part of an ongoing discussion on how to improve the arrangements and this Court isn’t the right place to usurp the Commission Decision. He also noted that if the Court did strike the Decision down, there would be serious effect on transfers to the US risking disruption to trade.

 

European Parliament

 

Counsel for the European Parliament noted that the Commission may make a finding of adequacy ‘only if’ there is adequate protection. The default is a presumption that there is not adequate protection. The Commission only creates a presumption, which can be rebutted in the face of evidence.

 

The Commission cannot, by its Decision, prevent supervisory authorities from exercising their powers under Article 28 of the Directive. The legislature did not give any powers to the Commission under Article 28. Article 25, which allows for the finding on adequacy, does not provide powers to restrict the supervisory authorities.

 

The Commission must take into account all circumstances in determining adequacy. It may exercising power having regard to two particular issues (law and international commitments), but that doesn’t preclude the Commission from taking anything else into account. Rules of law to be taken into account must include effective judicial protection.

 

US law and practice allows for large scale, unnecessary and disproportionate collection of EU data, and does not provide adequate protection for EU citizens’ data. The Commission therefore cannot maintain there is adequate protection. The Commission was required to suspend Safe Harbour. They have failed to respond to the Parliament’s call to do so. The EDPS and national authorities must and should intervene in the face of clear evidence of a serious violation of EU rights.

 

Commission

 

Finally, Counsel for the European Commission made his submissions. He submitted that every adequacy decision has a procedural safeguard, allowing that suspension is permitted where a specific data transfer is not, in fact, adequate. The limitations on DPAs in the Decision do not limit the right to supervision under Charter Article 8.3 but rather give shape to it. The review powers of the EDPS are only to do with data processing by EU institutions, and the EDPS also is not empowered to review the Commission’s adequacy decisions.

 

In finding on adequacy, the Commission is not restricted to reviewing the laws on the books but also the law in action. There is a requirement for appropriate redress - taking account of different traditions in third countries. Redress can be sought before the FTC or the Dept of Transport or US courts or domestic courts. Echoing Ireland, counsel for the Commission argued that ‘adequate’ does not mean ‘equivalent’.

 

Talks with the US are ongoing and making some progress, but they are complex and political. The Commission cannot conclude that there is an adequate level of protection of all data transfers made under the Safe Harbour principles. However, the Commission must be allowed to have a margin of discretion. It has to balance citizen’s rights with the need for legal certainty, for trade and for the EU’s international relationships.

 

European Data Protection Supervisor

 

Counsel for the European Data Protection Supervisor, Mr. Dockson, stated that Safe Harbour, quite apart from current concerns regarding mass surveillance, was adopted in the face of doubts. The Article 29 working group have tried to make it work. However, 18 months after criticisms were issued by the group, they remain unacted upon. Mass surveillance of the sort when the Decision was made was not imagined. The Safe Harbour system was not designed to allow for the level of surveillance now obtaining in the US. 

 

Echoing counsel for Mr. Schrems, he noted that DRI v Ireland clarified when the essence to the right to privacy was infringed. There is serious inference where there is access to the content of the data. In DRI v Ireland, the Court criticised the failure to require the holding of data within the EU, under the control of an Independent data protection authority. In the US, such protections are wholly absent.

 

Regarding the role of the EDPS’ authority, Mr. Dockson referred to the European Parliament’s consideration of EDPS powers. Independence of data protection authorities is crucial. Independence cannot be curtailed by a Commission comitology Decision.

 

The improvements by the US in the coming months must be sufficient. If there is not a positive outcome, then there is a need to suspend the Decision.

 

Court questioning

 

Counsel’s observations having finished, the Judge-Rapporteur led the Court’s questioning.

 

He asked Counsel for the Commission whether the EDPS could or should intervene if the Commission is inactive. Counsel for the Commission replied firstly that the Commission is not inactive, and added that national authorities cannot intervene in respect of third countries while the Commission Decision stands.

 

The Advocate-General then took up the questioning. He referred to Recital 5 of the Decision, which requires that adequacy shall be “ensured”. The Decision itself merely states that it shall be “considered ensured”.

 

Per Pg 35 of the Decision, where US law provides for a breach, then that breach is allowed. So everything that is in the Safe Harbour agreement can be set aside by US national law? If so, how can you then plead that these regulations ensure adequacy? Having taken some advice, counsel for the Commission stated that what must be assessed is a situation, not just a system of laws. The United States ensured that they would enforce the Safe Harbour Principles.

 

The Judge-Rapporteur (JR) now intervened:

 

There is no explicit competence given to the Commission to limit the powers of DPAs. Article 3 does not have any bearing on adequacy.

 

Commission: There is a safety valve in all these adequacy decisions, which can only be a general finding. Rules can be adequate, but their implementation may be problematic.

 

JR: but you say you’re limiting the powers of the independent national authorities. Where do you get that power?

 

Commission: Read Art 25 and 28 together. Adequacy decisions must be complied with by the Member States, and the national authorities must comply.

 

JR: you’ve stated here that you can’t confirm today that adequacy is respected. If this is your finding, what is the implication of recital 57? Or isn’t it limiting your discretion? Shouldn’t you explain your justification for continuing with the Decision?

 

Commission: Legal certainty is a very important consideration. There is a lot of reliance on the Decision currently. And also we need to consider the relations with the third party country.

 

JR: So, you say you’re remaining with the margin of discretion. Are you in essence pleading that the Safe Harbour decision is not subject to Art 8.3 of the Charter? Yes or No?

 

*Commission take instructions*

 

Commission: It is not the task of a national supervisory authority to examine whether the Commission complies with Art 8.3 of the Charter.

 

JR: The answer is no?

 

Commission: The answer is no.

 

The Judge Rapporteur asked counsel for the Commission to consider C-518/07 Commission -v- Germany where it was held that all actions by Independent authorities must be interpreted in the light of their duties.

 

After a lunch break, the questions resumed, with the Court’s Advocate-General (AG) taking the lead.

 

AG: What is the meaning of “ensure”? This verb should mean ‘to make sure that’, i.e that the third country could be obliged to do something?

 

Commission: Under Article 25 [of the Directive], read as a whole, it is up to the member states to examine the adequacy of the protections. That is not an obligation on a third country. It is an examination of a state of affairs. However, when the Commission reaches the conclusion that there is an adequate level of protection, it has been satisfied that sufficient data protection will be guarantee in the future. What has happened in the case of the Safe Harbour decision is that the US communicated a letter to the Commission. They ensured us they would enforce the principles.

 

AG: A different question, re Charter Article 8.3. You said that there was an area that was the exclusive competence of the Commission which could not be challenged by the national authorities. In this case, how do you think effective protection can be provided if they were not permitted to consider a swathe of data?

 

Commission: Well, we can only control data protection in the EU, under the Safe Harbour decision as it is applied. As it is currently applied, there is no guarantee that the fundamental rights of the EU citizens are adequately protected in the US. The Commission has taken action.

 

AG: Let’s imagine I’m on Facebook and I decide my rights have been breached. But I don’t see the Commission taking action.

 

Commission: The Commission has analysed the facts, examined the problems and engaged in talks with the US authorities. We were assured by the US President in a speech that there was to be a review.

 

AG: - Until then, what happens?

 

Commission: National authorities need to take whatever actions they need to take for individuals. There’s a lot a data is already in the US.

 

President Judge: This can’t be your main argument. I don’t understand it. Because there are already violations, then the violations need to continue?

 

Commission: Well, there’s lots of data flowing.

 

President Judge: you don’t intend to change the decision, but rather to seek to get assurances from the US?

 

Commission: Yes, we hope for concrete guarantees. But it’s too early to tell.

 

President Judge: How long will that take? Your recommendations were made in 2013.

 

Commission: There is some hope that our recommendations may be accepted. We shouldn’t be pushed by changing the Safe Harbour situation. It might not improve our position with the US.

 

AG: Perhaps my position is self-centred, but in the meantime my data is still being transferred.

 

Commission: Close your Facebook account. An individual can revoke consent.

 

AG: If I wish to approach a National Authority, I am not able to do so?

 

Commission: You can approach them and if they are restricted by article 3 of the Decision, then that Article needs to be interpreted in the light of Fundamental Rights.

 

Judge Berger of Austria then addressed a question to the Counsel for the Data Protection Commissioner

 

Judge Berger: Your Data Protection Authority is hopelessly understaffed and you want to attract IT companies to site in Ireland and so are soft on data protection, we understand from the media. Is this why the Data Protection Authority is so willing to exercise self-restraint in exercising powers?

 

DPC: No, new resources have been given.

 

Vice President Lenearts then addressed some questions to counsel for the Commission.

 

Vice President: The legality of a law must be considered in the light of what is legal at the moment that it is made. All of this happened in the year 2000. Irrespective of the actual form of question referred to the court, validity has been discussed, and let’s not quarrel about semantics.

 

Should we 15 years later be bound by the historical case of fact finding? Should the Commission be seen in all times after that, to be still confirming the 2000 appraisal in the context  of all the facts known at subsequent moments.

 

Commission: This is novel and the court should tread carefully. The Court has asked about “old school” validity, but also it may look and see if there was a subsequent duty to act.

 

Vice President: But a national court is looking to this court to know the state of the law. If the Commission is not acting 15 years later, then the court can then assess that decision?

 

Commission: But action does not require the removal or amendment of Safe Harbour. The Court may not substitute its own decision as to when is the right time to review a measure.

 

Judge Rodin: A question of a factual nature: What was the harm to your client [Mr. Schrems]?

 

Schrems: The harm is the breach to his right to privacy.

 

Judge: But do you have any evidence that this happened re your client’s data?

 

Schrems: No, but there is no need in case law flowing from the primary breach to prove an individual breach.

 

Judge: Is the right to privacy absolute or not?

 

Schrems: No right is absolute except perhaps that against torture, but there is no objective reason for access of the data in US law.

 

Judge: A question for the Commission, assuming that mass surveillance took place, might there be an overriding reason for it that would mean that it was still adequately protected?

 

Commission: Over-broad use of the national security exception would damage adequacy.

 

There followed some brief replies from the main parties. Mr. Herwig Hoffman for Mr. Schrems pointed out that the Commission has repeatedly stated that it cannot now state EU citizens’ data is adequately protected. Private companies are not bound by the Safe Harbour principles, where they clash with any US domestic law. In order to justify itself, the Commission has said here that the Decision does not need to comply with Art 8 of the Charter. Independence of the national DPA contains an obligation to uphold individual rights. Article 3 of the Decision purports to fetter this independence. Striking down this Safe Harbour agreement will only affect a couple of thousand of companies, who have signed up to it. It will simply place all US companies in the same position as non-Safe Harbour companies have been up until now.

 

Mr. McDermott for the Data Protection Commissioner said that Mr. Schrems has not shown that he personally has been harmed in any way. That is hardly surprising, as the NSA doesn’t care about accessing the essays of an Austrian Law Student. The Court could take advantage of the fact that Mr. Schrems is not being harmed to allow the Commission some time to complete negotiations with the US. The solution is for the walls of Safe Harbour to be built higher, not to allow the harbour to be dismantled brick by brick by individual national authorities.

 

Mr. Crehan for DRI noted that Article 3 provides only for investigations into compliance with the Safe Harbour principles. These principles are such that even if they are complied with, this does not respect fundamental rights.

 

The Commission, concluding, stated that if the Commission can find adequacy, it can find adequacy in a conditional way also. Article 3 does not require too narrow a reading and if they need to, national DPAs can always use their authority under the Charter to read it as widely as they require to act in individual cases.

 

However, this independence does not mean that the Data Protection Authorities are not bound by the law and so they must accept the adequacy Decision. A harmonised approach is necessary to ensure that different member states may not make different findings about the US.

 

Case concluded. Advocate General's Opinion on 24^th June.

 

Simon McGarr will present on aspects of this case in a talk titled "Regulation, Litigation and the rise of Fundamental Rights" at the forthcoming Digital Rights Europe conference, 15 April in Dublin.