EUROPEAN COMMISSION Brussels, 10.1.2017 COM(2017) 7 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Exchanging and Protecting Personal Data in a Globalised World



1. Introduction The protection of personal data is part of Europe's common constitutional fabric and is enshrined in Article 8 of the EU Charter of Fundamental Rights. It has been central to EU law for more than 20 years, from the Data Protection Directive in 1995 ("the 1995 Directive") to the adoption of the General Data Protection Regulation (GDPR) and the Police Directive in 2016. As President Juncker stressed in his State of the European Union speech on 14 September 2016, "[b]eing European means the right to have your personal data protected by strong, European laws. […] Because in Europe, privacy matters. This is a question of human dignity." The demand for protection of personal data is however not limited to Europe. Consumers around the world increasingly cherish and value their privacy. In turn, companies recognise that strong privacy protections give them a competitive advantage as confidence in their services increases. Many, especially those with global reach, are aligning their privacy policies with the GDPR, both because they want to do business in the EU, and because they see it as a model to follow. Likewise, several countries and regional organisations outside the EU, from our immediate neighbourhood to Asia, Latin America and Africa, are adopting new or updating existing data protection legislation to harness the opportunities offered by the global digital economy and respond to the growing demand for stronger data security and privacy protection. While differences exist amongst countries in their approach and the level of legislative development, there are signs of upward convergence towards important data protection principles, in particular in certain regions of the world. Greater compatibility between different data protection systems would facilitate international flows of personal data, whether for commercial purposes or cooperation between public authorities (e.g. law enforcement). The EU should seize this opportunity to promote its data protection values and facilitate data flows by encouraging convergence of legal systems. As announced in the Commission Work Programme, the present Communication therefore sets out the Commission's strategic framework for "adequacy decisions" as well as other tools for data transfers and international data protection instruments. 2. The EU Data Protection Reform Package – A Modern Legislative Framework That Supports International Data Flows With High Protection The reform of EU data protection legislation adopted in April 2016 puts in place a system that both ensures a strong level of protection and is open to the opportunities of the global information society. In giving individuals more control over their personal data, the reform strengthens consumer trust in the digital economy. In harmonising and simplifying the legal environment it makes it easier and less burdensome for companies, both domestic and foreign, to conduct their business activities in the EU, including through international data exchanges. The EU today combines openness for international data flows with the highest level of protection for individuals. It has the potential to become a hub for data services which require both free flows and trust. 2.1 A comprehensive, unified and simplified EU data protection framework The EU reform establishes a comprehensive framework governing the processing of personal data in both the private and public sectors and in both the commercial and law enforcement sectors (the GDPR and Police Directive respectively). Under the GDPR, as of May 2018, there will be one single pan-European set of rules contrary to 28 national laws today. The newly created one-stop-shop mechanism will ensure that one data protection authority ("DPA") will be responsible for the supervision of cross-border data processing operations carried out by a company in the EU. Consistency of interpretation of the new rules will be guaranteed. In particular, in cross-border cases where several national DPAs are involved, a single decision will be adopted to ensure that common problems receive common solutions. In addition, the GDPR creates a level playing field between EU and foreign companies in that companies based outside the EU will have to apply the same rules as European companies if they are offering goods and services or monitoring the behaviour of individuals in the EU. An increased level of consumer trust will benefit both EU and external commercial operators. The Police Directive provides common rules for the processing of the personal data of individuals involved in criminal proceedings, be it as suspects, victims, or witnesses, whilst taking into account the specific nature of the police and criminal justice field. Harmonising data protection rules in the law enforcement sector, including rules on international transfers, will facilitate cross-border cooperation between police and judicial authorities, both within the EU and with international partners, and thus create the conditions for a more effective fight against crime. This is an important contribution to the European Agenda on Security. 2.2 A renewed and diversified toolkit for international transfers From its inception, EU data protection legislation has provided several mechanisms enabling international data transfers. The primary purpose of these rules is to ensure that when the personal data of Europeans are transferred abroad, the protection travels with the data. Over the years, these rules have set the standard on international data flows in many jurisdictions. While the architecture remains essentially the same as under the 1995 Directive, the reform of the rules on international transfers clarifies and simplifies their use and introduces new tools for transfers. Under EU law, one way to transfer personal data abroad is on the basis of a Commission "adequacy decision" establishing that a non-EU country provides a level of data protection that is "essentially equivalent" to that in the EU. The effect of such a decision is to enable the free flow of personal data to that third country without the need for the data exporter to provide further safeguards or obtain any authorisation. A precise and detailed catalogue of elements that the Commission must take into account when assessing the adequacy of protection of a foreign system is available for interested countries or international organisations. The Commission can now adopt adequacy decisions also for the law enforcement sector. Furthermore, building on practice under the 1995 Directive, the reform explicitly allows for an adequacy determination to be made with respect to a particular territory of a third country or to a specific sector or industry within a third country (so-called "partial" adequacy). In the absence of an adequacy decision, international transfers can take place on the basis of a number of alternative transfer tools that provide appropriate data protection safeguards. The reform formalises and expands the possibilities to use existing instruments like standard contractual clauses (SCCs) and binding corporate rules (BCRs). For instance, SCCs can now be included in a contract between EU-based processors and processors in a non-EU country (so-called "processor-to-processor" model clauses). As for BCRs, which until now have been limited to arrangements among entities of the same corporate group, they can now be used by a group of enterprises engaged in a joint economic activity, but not necessarily forming part of the same corporate group. The reform also reduces red tape by abolishing general requirements of prior notification to and authorisation by DPAs of transfers to a third country based on SCCs or BCRs. This is an important simplification of the EU system of international data transfers as the existence of such requirements, which currently vary from one Member State to another, is often perceived as a significant obstacle for data flows, especially for smaller businesses. In addition, the reform introduces new instruments for international transfers. Controllers and processors will be able to use, under certain conditions, approved codes of conduct or certification mechanisms (such as privacy seals or marks) to establish "appropriate safeguards". This should allow the development of more tailor-made solutions for international transfers, reflecting, for instance, the specific features and needs of a given sector or industry, or of particular data flows. It also offers for the possibility to provide for appropriate safeguards for data transfers between public authorities or bodies on the basis of international agreements or administrative arrangements. Finally, the GDPR clarifies the use of so-called "derogations" (e.g. consent, performance of a contract or important reasons of public interest) on which entities in specific situations can base their data transfers in the absence of an adequacy decision and irrespective of the use of one of the above instruments. In particular, it contains a new, albeit circumscribed, derogation pertaining to transfers that can take place in pursuit of the legitimate interests of a company. Finally, the reform empowers the Commission to develop international cooperation mechanisms to facilitate the enforcement of data protection rules, including through mutual assistance arrangements. This recognises the contribution that closer forms of cooperation between supervisory authorities at international level could make to ensure both more effective protection of individual rights and more legal certainty for businesses. 3. International Data Transfers In The Commercial Sector: Facilitating Trade By Protecting Privacy Respecting privacy is a condition for stable, secure and competitive global commercial flows. Privacy is not a commodity to be traded. The internet and digitization of goods and services has transformed the global economy and the transfer of data, including personal data, across borders is part of the daily operations of European companies of all sizes, across all sectors. As commercial exchanges rely increasingly on personal data flows, the privacy and security of such data has become a central factor of consumer trust. For instance, two-thirds of Europeans say that they are worried about having no control over the information they provide online while half of the respondents are concerned about becoming a victim of fraud. At the same time, European companies operating in some third countries are increasingly faced with protectionist restrictions that cannot be justified with legitimate privacy considerations.

In the digital era, promoting high standards of data protection and facilitating international trade must thus necessarily go hand in hand. Whereas the protection of personal data is non-negotiable in trade agreements, the EU regime on international data transfers, as outlined above, provides a broad and varied toolkit to enable data flows in different situations while ensuring a high level of protection. 3.1 Adequacy decisions In recent years more and more countries around the world have adopted new legislation in the area of data protection and privacy or are in the process of doing so. In 2015, the number of countries that had enacted data privacy laws stood at 109, a significant increase from 76 in mid-2011. Moreover, around 35 countries are currently drafting data protection laws. These new or modernised laws tend to be based on a core set of common principles, including inter alia the recognition of data protection as a fundamental right, the adoption of overarching legislation in this field, the existence of enforceable individual privacy rights, and the setting up of an independent supervisory authority. This offers new opportunities, notably through adequacy findings, to further facilitate data flows while guaranteeing the continued high level of protection of personal data. Under EU law, an adequacy finding requires the existence of data protection rules comparable to the ones in the EU. This concerns both the substantive protections applicable to personal data and the relevant oversight and redress mechanisms available in the third country. Under its framework on adequacy findings, the Commission considers that the following criteria should be taken into account when assessing with which third countries a dialogue on adequacy should be pursued: (i) the extent of the EU's (actual or potential) commercial relations with a given third country, including the existence of a free trade agreement or ongoing negotiations; (ii) the extent of personal data flows from the EU, reflecting geographical and/or cultural ties; (iii) the pioneering role the third country plays in the field of privacy and data protection that could serve as a model for other countries in its region;and (iv) the overall political relationship with the third country in question, in particular with respect to the promotion of common values and shared objectives at international level. Based on these considerations, the Commission will actively engage with key trading partners in East and South-East Asia, starting from Japan and Korea in 2017, and, depending on progress towards the modernisation of its data protection laws, with India, but also with countries in Latin America, in particular Mercosur, and the European neighbourhood which have expressed an interest in obtaining an “adequacy finding”. In addition, the Commission welcomes expressions of interest from other third countries that are willing to engage on these issues. Discussions on a possible adequacy finding are a two-way dialogue that includes providing any necessary clarifications on the EU data protection rules and exploring ways to increase convergence of the third countries' laws and practice. In certain situations, rather than taking a country-wide approach, it may be more suitable to make use of other options such as partial or sector-specific adequacy (e.g. for financial services or IT sectors) which may concern geographic areas or industries that form an important part of a particular third country's economy. This will need to be considered in light of elements such as, for instance, the nature and state of development of the privacy regime (stand-alone law, multiple or sectorial laws etc.), the constitutional structure of the third country or whether certain sectors of the economy are particularly exposed to data flows from the EU. The adoption of an adequacy decision involves the establishment of a specific dialogue and close forms of cooperation with the concerned third country. Adequacy decisions are "living" documents that need to be closely monitored by the Commission and adapted in case of developments affecting the level of protection ensured by the third country in question. To that end, periodic reviews will be held, at least every four years, to address emerging issues and exchange best practices between close partners. This dynamic approach applies also to already existing adequacy decisions, adopted under the 1995 Directive, which will need to be reviewed in case they no longer meet the applicable standard. The third countries concerned are therefore invited to inform the Commission of any relevant change in law and practice that has taken place since the adoption of the adequacy decision relating to them. This is essential to ensure the continuity of these decisions under the new rules of the reform. The EU data protection rules cannot be the subject of negotiations in a free trade agreement. While dialogues on data protection and trade negotiations with third countries have to follow separate tracks, an adequacy decision, including a partial or sector-specific one, is the best avenue to build mutual trust, guaranteeing uninhibited flow of personal data, and thus facilitate commercial exchanges involving transfers of personal data to the third country in question. Such decisions can therefore ease trade negotiations or may complement existing trade agreements, thus allowing them to amplify their benefits. At the same time, by fostering the convergence of the level of protection in the EU and the third country, an adequacy finding reduces the risk of invocation by that country of personal data protection grounds to impose unjustified data localisation or storage requirements. Beyond this, as indicated in the Trade for All Communication, the Commission will seek to use EU trade agreements to set rules for e-commerce and cross-border data flows and tackle new forms of digital protectionism, in full compliance with and without prejudice to the EU’s data protection rules. The Commission will: Prioritise discussions on possible adequacy decisions with key trading partners in East and South-East Asia, starting from Japan and Korea in 2017, but also considering other strategic partners such as India, and with countries in Latin America, in particular Mercosur, and the European neighbourhood. Closely monitor the functioning of the existing adequacy decisions. This includes in particular the implementation of the EU-US Privacy Shield framework, notably through the annual joint review mechanism. Work with and assist countries interested in adopting strong data protection laws and support their convergence with EU data protection principles. 3.2 Alternative data transfer mechanisms EU data protection rules have always recognised that there is no one-size-fits-all approach to international data transfers. This is even truer of the rules resulting from the reform. While adequacy findings will be available only to those third countries that meet the relevant criteria, the GDPR provides a diverse set of mechanisms that are flexible enough to adapt to a variety of different transfer situations. Instruments can be developed to take into account the particular needs or conditions of specific industries, business models and/or operators. This could for instance take the form of SCCs targeted at the requirements of a particular sector, e.g. specific safeguards when processing sensitive data in the health sector, or of a specific type of processing activities prevalent in certain third countries, e.g. outsourcing services that are carried out for European companies. This could be done by either adopting new sets of standard clauses or by supplementing existing ones with additional safeguards which could range from technical to organisational to business-model related solutions. Some specific sectorial needs can also be accommodated through BCRs applying to groups of companies involved in a joint economic activity, for instance in the travel industry. International transfers between processors could benefit from the development of processor-to-processor SCCs or/and BCRs for processors. Finally, new transfer mechanisms such as approved codes of conduct and accredited third-party certifications provide industry with the possibility to introduce tailor-made solutions for international transfers while benefiting from the competitive advantages associated, for example, with a privacy seal or mark. Some of these instruments can be developed as transfer-specific mechanisms or as part of more general tools to demonstrate compliance with all the provisions of the GDPR, such as in the case of an approved code of conduct. The Commission will work with industry, civil society and data protection authorities with a view to harnessing the full potential of the GDPR toolkit for international transfers. The ongoing dialogue with stakeholders in the context of the implementation of the reform will help identify priority action areas in this respect. This may include completing work that has already started such as on the drawing up, in cooperation with the Article 29 Working Party (to be replaced in 2018 by the European Data Protection Board), of processor-to processor SCCs. It can involve developing new components of the EU compliance infrastructure, for instance through the Commission defining requirements and technical standards for the establishment and functioning of certification mechanisms, including for aspects relating to international transfers. Some of these actions can be complemented by work at international level, in particular with organisations that have developed similar transfer mechanisms. For example, ways could be explored to promote convergence between BCRs under EU law and the Cross Border Privacy Rules developed by the Asia Pacific Economic Cooperation (APEC) as regards both the applicable standards and the application process under each system. This should contribute to promoting high data protection standards globally while bridging differences in approaches to privacy and data protection, helping commercial operators to navigate between different systems and designing policies that comply with them.

The Commission will: Work with stakeholders to develop alternative personal data transfer mechanisms adapted to the particular needs or conditions of specific industries, business models and/or operators. 3.3 International cooperation for the protection of personal data 3.3.1. Promoting data protection standards through multilateral instruments and fora The EU data protection legal framework has often served as a point of reference for third countries developing legislation in this field. The EU will continue to engage actively in dialogue with its international partners, at both bilateral and multilateral level, to foster convergence by developing high and interoperable personal data protection standards globally. This contributes to the more effective protection of individuals' rights and at the same time reduces obstacles to the cross-border flow of data as an important element of free trade. In particular, the Commission encourages accession by third countries to Council of Europe Convention 108 and its additional Protocol. The Convention, which is open to non-members of the Council of Europe and has already been ratified by 50 countries, including African and South American States, is the only binding multilateral instrument in the area of data protection. It is currently in the process of being revised and the Commission will actively promote the swift adoption of the modernised text with a view to the EU becoming a Party. It will reflect the same principles as those enshrined in the new EU data protection rules and thus contribute to the convergence towards a set of high data protection standards. The G20 meeting in 2017 will provide a further opportunity for the EU to work towards convergence around the principle that high data protection standards are an essential component of the further development of a global information society capable of promoting innovation, growth and social prosperity. The Commission is also looking forward to engaging with important new actors, such as the UN Special Rapporteur on the Right to Privacy, and further developing its working relationships with regional organisations such as APEC, to foster a worldwide culture of respect for the rights to privacy and personal data protection. As part of its broader efforts to improve privacy awareness and raise data protection safeguards internationally, on 15 November 2016, the European Commission approved a project under the Partnership Instrument to strengthen cooperation with partner countries in this area. This will include the financing of activities such as training and awareness-raising. In turn, in the context of implementing the reform, the EU can benefit from the exchange of best practices and the experience of other systems with new challenges for the protection of privacy and emerging legal or technical solutions, including as regards enforcement, compliance tools (e.g. certification mechanisms, privacy impact assessments) or the protections for certain specific data sets (e.g. children's data). 3.3.2. Enforcement cooperation Enhancing cooperation with relevant privacy enforcement and supervisory authorities of third countries is increasingly necessary given the global reach of multinational companies that process vast amounts of personal data in a large number of countries. Often problems of non-compliance with data protection rules or data breaches simultaneously affect people in more than one jurisdiction. In these cases, the protection of individuals could be made more effective through common action. At the same time, economic operators would benefit from a clearer legal environment where common interpretation tools and enforcement practices are developed at global level. In the borderless and connected world of data flows, it is therefore time to step up cooperation between enforcers. The EU stands ready to play its part. As recalled above, the GDPR enables the Commission to develop international cooperation mechanisms to facilitate the effective enforcement of data protection legislation, including through mutual assistance arrangements. In this context, the possibility to develop a framework agreement for cooperation between EU data protection authorities and enforcement authorities in certain third countries should be explored, drawing also from the experience gained by the Commission in other enforcement areas such as competition and consumer protection. The Commission will: Promote the swift adoption of the modernised text of Council of Europe Convention 108 with a view to the EU becoming a Party and encourage accession by third countries. Use multilateral fora such as the United Nations, G20 and APEC to foster a global culture of respect for data protection rights. Develop international cooperation mechanisms with key international partners to facilitate effective enforcement. 4. More Effective Law Enforcement Cooperation With Strong Data Protection Safeguards Personal data exchanges are an integral part of the prevention, investigation and prosecution of criminal offences. In an interconnected world where crime rarely stops at national borders, the swift exchange of personal data is essential for successful law enforcement cooperation and an effective response to crime. Such exchanges must be underpinned by strong data protection safeguards. This also contributes to building confidence between law enforcement authorities (LEAs) and strengthening legal certainty when information is collected and/or exchanged. The rules on international transfers in the Police Directive govern data exchanges between EU and non-EU LEAs as well as, in specific situations, transfers from LEAs to other entities. The Directive introduces the possibility for adequacy findings in the criminal law enforcement sector. The Commission will promote the possibility of such adequacy findings with qualifying third countries, in particular with those countries with which close and swift cooperation is required in the fight against crime and terrorism, and where significant personal data exchanges are already taking place. On this basis, the Commission will prioritise discussions on adequacy decisions with third countries that are key partners in this endeavour. Alternatively, the EU-US Data Protection Umbrella Agreement concluded in December 2016 is a successful example of how law enforcement cooperation with an important international partner can be enhanced by negotiating a strong set of data protection safeguards. By automatically supplementing existing legal instruments on which data exchanges are based (in particular bilateral agreements at both EU and Member State level), the Umbrella Agreement brings immediate and direct benefits to individuals and strengthens law enforcement cooperation by facilitating the exchange of information. Also, by establishing a baseline for future data transfer arrangements with the United States, the Umbrella Agreement does away with the need to repeatedly renegotiate those same safeguards. The Umbrella Agreement constitutes the first bilateral international agreement with a comprehensive catalogue of data protection rights and obligations in line with the EU acquis. It can therefore serve as a basis for negotiating similar agreements with third countries not only in the field of judicial and police cooperation, but also in other areas of public enforcement (e.g. competition policy, consumer protection). This would cover both government-to-government exchanges and data transfers between private companies and LEAs. It could also facilitate the conclusion by the Union of agreements concerning the exchange of data between relevant EU agencies (notably Europol and Eurojust) and third countries. The Commission will thus explore the possibility to conclude similar framework agreements with its important law enforcement partners. Moreover, the Police Directive envisages the possibility, under strict safeguards and in specific circumstances, for LEAs in the EU to request information directly from a private company in a third country and to pass on personal information (typically a name or an IP address) in that request. Conversely, the GDPR specifically addresses cases where private entities in the EU transmit personal data to the LEAs of a third country following a request: such transfers outside the EU are permissible only under certain conditions, e.g. based on an international agreement or where disclosure is necessary for an important ground of public interest recognised in Union or Member State law. This cooperation, which has become central to the successful investigation and prosecution of crime and terrorism, is highlighted in Council conclusions on improving criminal justice in cyberspace. The Council has called on the Commission to take concrete actions, based on a common EU approach, to improve cooperation with service providers, make mutual legal assistance more efficient and propose solutions to the problems of determining and enforcing jurisdiction in cyberspace. These actions cover both exchanges between LEAs and service providers based in the EU and exchanges with non-EU authorities and companies. The Commission will outline options for access to electronic evidence in June 2017, taking into account the need for swift and reliable cooperation underpinned by the strong data protection standards of the Police Directive and the GDPR both in EU-internal situations and for international transfers. Finally, in accordance with the new legal basis for Europol, the Commission will assess the provisions contained in those operational cooperation agreements between Europol and third parties, concluded under Council Decision 2009/371/JHA, including their data protection provisions. Moreover, as set out in the 2015 European Agenda on Security, the Union's future approach to the exchange of PNR data with non-EU countries will take into account the need to apply consistent standards and specific fundamental rights protections. The Commission will work on legally sound and sustainable solutions to exchange Passenger Name Records (PNR) data with third countries, including by considering a model agreement on PNR setting out requirements third countries have to meet to receive PNR data from the EU. Any future policy in this area will, however, depend, in particular, on the forthcoming Opinion by the Court of Justice of the European Union on the envisaged EU PNR Agreement with Canada.