EN Official Journal of the European Union C 215/7

Executive summary of the Opinion of the European Data Protection Supervisor on the proposal for a Council decision on the conclusion of the Anti-Counterfeiting Trade Agreement between the European Union and its Member States, Australia, Canada, Japan, the Republic of Korea, the United Mexican States, the Kingdom of Morocco, New Zealand, the Republic of Singapore, the Swiss Confederation and the United States of America

(Abridged version. The full text of this Opinion can be found in EN, FR and DE on the EDPS website: http://www.edps.europa.eu)

2012/C 215/08

I. Introduction

I.1. The EU legislative process on ACTA

1. On 24 June 2011, the Commission put forward a proposal for a Council decision on the conclusion of the Anti-Counterfeiting Trade Agreement (‘ACTA’ or the ‘Agreement’) between the European Union and its Member States, Australia, Canada, Japan, the Republic of Korea, the United Mexican States, the Kingdom of Morocco, New Zealand, the Republic of Singapore, the Swiss Confederation and the United States of America (1).

2. The Agreement aims at tackling the enforcement of intellectual property rights (‘IP rights’) by developing a common approach to enforcement and facilitating cooperation at international level. Chapter II contains measures in several areas of the law, namely in the field of civil enforcement (Section 2), border measures (Section 3), criminal enforcement (Section 4), and enforcement of intellectual property rights in the digital environment (Section 5). Chapter III contains measures to improve enforcement practices, and Chapter IV deals with international cooperation.

3. ACTA was adopted unanimously by the Council in December 2011 (2) and signed by the European Commission and 22 Member States (3) on 26 January 2012. According to Article 40 of the Agreement, ACTA will enter into force after ratification by six signatory States. However, to enter into force as EU law the Agreement must be ratified by the EU, which means approval by the European Parliament under the consent procedure for international commercial agreements (4) and ratification by Member States under their constitutional procedures. The European Parliament's vote on ACTA is scheduled to take place in the course of 2012 in plenary session.

I.2. State of play of ACTA in the EU

4. Growing concerns have been expressed over the last months about ACTA (5). This has led the European Commission to announce on 22 February 2012 its intention to refer the agreement to the Court of Justice of the European Union for an opinion (6). Such procedure is foreseen in Article 218(11) of the Treaty on the Functioning of the European Union (‘TFEU’) (7).

5. On 4 April 2012, the Commission decided that it would ask the Court the following question: ‘Is the Anti-Counterfeiting Trade Agreement (ACTA) compatible with the European Treaties, in particular with the Charter of Fundamental Rights of the European Union?’ (8). In case the outcome would be negative, Article 218(11) of the TFEU makes it clear that ‘the agreement envisaged may not enter into force unless it is amended or the Treaties are revised.’

6. However, the referral of the Agreement to the Court of Justice by the Commission would not automatically suspend the consent procedure currently under way in the European Parliament. After discussion in the International Trade Committee of the European Parliament, it was decided to proceed with the vote on the Agreement in accordance with the planned schedule (9).

I.3. The reasons for a second EDPS Opinion on ACTA

7. In February 2010, the EDPS issued an Opinion on his own initiative in order to draw the attention of the Commission on the privacy and data protection aspects that should be considered in the ACTA negotiations (10). While negotiations were being conducted confidentially, there were indications that ACTA would contain online enforcement measures having an impact on data protection rights, notably the three strikes mechanism (11).

8. The EDPS at the time focused his analysis on the lawfulness and proportionality of this type of measure and concluded that the introduction in ACTA of a measure that would involve the massive surveillance of Internet users would be contrary to EU fundamental rights and in particular the rights to privacy and data protection, which are protected under Article 8 of the European Convention on Human Rights and Articles 7 and 8 of the Charter of Fundamental Rights of the EU (12). The EDPS furthermore underlined the safeguards needed for international exchanges of personal data in the context of IP rights' enforcement.

9. Now that the text of the proposed agreement on ACTA has been made public (13), the EDPS considers it appropriate to issue a second Opinion on ACTA to assess some of the provisions contained in the Agreement from a data protection perspective, and by doing so to provide specific expertise that could be taken into consideration in the ratification process. Acting on his own initiative, the EDPS has therefore adopted the current Opinion based on Article 41(2) of Regulation (EC) No 45/2001 in view of providing guidance on the privacy and data protection issues raised by ACTA.

(Abridged version. The full text of this Opinion can be found in EN, FR and DE on the EDPS website: http://www.edps.europa.eu)

II. Conclusion

67. While the EDPS acknowledges the legitimate concern of ensuring the enforcement of IP rights in an international context, a right balance must be struck between demands for the protection of IP rights and the rights to privacy and data protection.

68. The EDPS emphasizes that the means envisaged for strengthening enforcement of IP rights must not come at the expense of the fundamental rights and freedoms of individuals to privacy, data protection and freedom of expression, and other rights such as presumption of innocence and effective judicial protection.

69. Many of the measures envisaged in the Agreement in the context of enforcement of IP rights in the digital environment would involve the monitoring of users' behaviour and of their electronic communications on the Internet. These measures are highly intrusive to the private sphere of individuals and, if not implemented properly, may therefore interfere with their rights and freedoms to, inter alia, privacy, data protection and the confidentiality of their communications.

70. It should be ensured that any online enforcement measure implemented within the EU as a result of entering into ACTA is necessary and proportionate to the aim of enforcing IP rights. The EDPS underlines that measures that entail the indiscriminate or widespread monitoring of Internet user' behaviour, and/or electronic communications, in relation to trivial, small-scale not for profit infringement would be disproportionate and in breach of Article of the ECHR, Articles 7 and 8 of the Charter of Fundamental Rights, and the Data Protection Directive.

71. The EDPS has furthermore specific concerns in relation to several provisions of the Agreement, in particular: — the Agreement is unclear about the scope of enforcement measures in the digital environment envisaged in Article 27, and whether they only target large-scale infringements of IP rights. The notion of ‘commercial scale’ in Article 23 of the Agreement is not defined with sufficient precision, and acts carried out by private users for a personal and not-for profit purpose are not expressly excluded from the scope of the Agreement, — the notion of ‘competent authorities’ entrusted with the injunction power under Article 27(4) of the Agreement is too vague and does not provide sufficient certainty that the disclosure of personal data of alleged infringers would only take place under the control of judicial authorities. Furthermore, the conditions to be fulfilled by right holders to be granted such an injunction are also not satisfactory. These uncertainties may have a particular impact in cases of requests from foreign ‘competent authorities’ to EU-based ISPs, — many of the voluntary enforcement cooperation measures that could be implemented under Article 27(3) of the Agreement would entail a processing of personal by ISPs which goes beyond what is allowed under EU law, — the Agreement does not contain sufficient limitations and safeguards in respect of the implementation of measures that entail the monitoring of electronic communications networks on a large scale. In particular, it does not lay out safeguards such as the respect of the rights to privacy and data protection, effective judicial protection, due process, and the respect of the principle of the presumption of innocence.

Done at Brussels, 24 April 2012. Giovanni BUTTARELLI Assistant European Data Protection Supervisor

(1) Commission proposal for a Council decision on the conclusion of the Anti-Counterfeiting Trade Agreement between the European Union and its Member States, Australia, Canada, Japan, the Republic of Korea, the United Mexican States, the Kingdom of Morocco, New Zealand, the Republic of Singapore, the Swiss Confederation and the United States of America, COM(2011) 380 final.

(2) The text of the Agreement, in its latest version of the Council of 23 August 2011, is available at: http://register.consilium.europa.eu/pdf/en/11/st12/st12196.en11.pdf

(3) Germany, Cyprus, Estonia, the Netherlands and Slovakia have not signed it yet.

(4) Pursuant to Article 218(6) of the TFEU.

(5) See amongst others: http://euobserver.com/9/115043; http://euobserver.com/871/115128; https://www.bfdi.bund.de/bfdi_forum/showthread.php?3062-ACTA-und-der-Datenschutz, http://www.bbc.co.uk/news/technology-17012832

(6) Statement by Commissioner Karel De Gucht on ACTA (Anti-Counterfeiting Trade Agreement), http://europa.eu/rapid/pressReleasesAction.do?reference=MEMO/12/128

(7) Article 218(11) of the TFEU provides that ‘a Member State, the European Parliament, the Council or the Commission may obtain the opinion of the Court of Justice as to whether an agreement envisaged is compatible with the Treaties. Where the opinion of the Court is adverse, the agreement envisaged may not enter into force unless it is amended or the Treaties are revised.’ According to Article 107(2) of the Rules of procedures of the Court of Justice, ‘[t]he Opinion may deal not only with the question whether the envisaged agreement is compatible which the provisions of the Treaties but also with the question whether the Union or any Union institution has the power to enter into that agreement.’

(8) http://europa.eu/rapid/pressReleasesAction.do?reference=IP/12/354&format=HTML&aged=0&language=EN&guiLanguage=en

(9) See http://www.neurope.eu/article/parliament-halts-sending-acta-court-justice

(10) Opinion of the European Data Protection Supervisor on the current negotiations by the European Union of an Anti-Counterfeiting Trade Agreement (ACTA), OJ C 147, 5.6.2010, p. 1.

(11) ‘Three strikes Internet disconnection policies’ or ‘graduated response’ schemes allow copyright holders, or entrusted third parties, to monitor Internet users and identify alleged copyright infringers. After contacting the Internet service providers (‘ISPs’) of the alleged infringer, ISPs would warn the user identified as infringer, and he would be disconnected from Internet access after having received three warnings.

(12) Charter of Fundamental Rights of the European Union, OJ C 303, 14.12.2007, p. 1.

(13) See footnote 3.