Source: https://pdpecho.com/category/comments/page/2/
Timestamp: 2019-04-24 18:12:51+00:00

Document:
After he establishes that the Court should carry out “a strict review of compliance with the requirements resulting from the principle of proportionality, and more particularly, from the adequacy of the level of protection of the fundamental rights guaranteed in the Union when Canada processes and uses the PNR data pursuant to the agreement envisaged” (§200), the AG further assesses if the interference is “strictly necessary”.
He considers the “strict necessity” test as a component of the proportionality test, together with “the ability of the interference to achieve the ‘public security’ objective pursued by the Agreement”.
With regard to the latter criterion, the AG does not believe “there are any real obstacles to recognising that the interference constituted by the agreement envisaged is capable of attaining the objective of public security, in particular the objective of combating terrorism and serious transnational crime” (§205). “As the United Kingdom Government and the Commission, in particular, have claimed, the transfer of PNR data for analysis and retention provides the Canadian authorities with additional opportunities to identify passengers, hitherto not known and not suspected, who might have connections with other persons and/or passengers involved in a terrorist network or participating in serious transnational criminal activities” (§205).
With regard to the strict necessity of the interference, the AG establishes that its assessment “entails ascertaining whether the contracting parties have struck a ‘fair balance’ between the objective of combating terrorism and serious transnational crime and the objective of protecting personal data and respecting the private life of the persons concerned” (§207), by making a reference to §77 of the Schecke judgment. That paragraph in Schecke seems to me to establish a different principle – namely that, when balancing two opposing rights, one of which is the right to the protection of personal data, it must be taken into account that “derogations and limitations in relation to the protection of personal data must apply only in so far as is strictly necessary”.
“That means that it is not sufficient to imagine, in the abstract, the existence of alternative measures that would be less intrusive in the fundamental rights at issue. Those alternative measures must also be sufficiently effective, that is to say, their effectiveness must, in my view, be comparable with those provided for in the agreement envisaged, in order to attain the public security objective pursued by that agreement” (§208).
This twofold test is not used in any of the most recent landmark judgments of the Court – DRI, which relies greatly on the analysis of the condition of “necessity”, and Schrems. However, looking at strict necessity through this lens of proportionality and equivalent effectiveness persuaded the AG to conclude that PNR schemes, even if they constitute the kind of interference he accurately described in §176, are acceptable.
Comparing the wealth of PNR data to data collected usually for border control purposes by immigration authorities, including Advance Passenger Information and information collected by Canadian authorities for their eVA program, the AG concluded that “data of that type (API, eVA – my note) does not reveal information about the booking methods, payment methods used and travel habits, the cross-checking of which can be useful for the purposes of combating terrorism and other serious transnational criminal activities. Independently of the methods used to process that data, the API and the data required for the issue of an eVA are therefore not sufficient to attain with comparable effectiveness the public security objective pursued by the agreement envisaged” (§214).
The AG further justifies that PNR data of all passengers are transferred to the Canadian authorities, “even though there is no indication that their conduct may have a connection with terrorism or serious transnational crime” (215) by arguing that “as the interested parties have explained, the actual interest of PNR schemes, whether they are adopted unilaterally or form the subject matter of an international agreement, is specifically to guarantee the bulk transfer of data that will allow the competent authorities to identify, with the assistance of automated processing and scenario tools or predetermined assessment criteria, individuals not known to the law enforcement services who may nonetheless present an ‘interest’ or a risk to public security and who are therefore liable to be subjected subsequently to more thorough individual checks” (§216).
He finds at §244, referring to the fact that the Agreement involves transfers of data of all passengers between the Union and Canada, irrespective of whether they are suspects or not, that “no other measure which, while limiting the number of persons whose PNR data is automatically processed by the Canadian competent authority, would be capable of attaining with comparable effectiveness the public security aim pursued by the contracting parties has been brought to the Court’s attention in the context of the present proceedings”.
The AG therefore concluded that “generally, the scope ratione personae of the agreement envisaged cannot be limited further without harming the very object of the PNR regimes” (§245).
Another characteristic of PNR schemes that is generally considered questionable – the lack of an ex ante control of access to PNR data, is found justifiable by the AG in the light of the “fair balance” test for strict necessity: “the appropriate balance that must be struck between the effective pursuit of the fight against terrorism and serious transnational crime and respect for a high level of protection of the personal data of the passengers concerned does not necessarily require that a prior control of access to the PNR data must be envisaged” (§269).
Therefore, the idea of PNR schemes seems to be compatible with the fundamental rights to data protection and respect for private life, in the view of AG Mengozzi. However, the list of conditions he develops for the Agreement in the current case to be fully compliant with EU primary law is quite long and quite strict and it bears bad news for other similar arrangements.
Yesterday I stumbled upon the ‘Order denying the motion to dismiss as to the merits of plaintiff’s claims’, issued by the US District Court – Northern District of California on 12 August 2016 in the case of Matera v. Google. The order allows the trial against Google to move forward.
This is the second case brought in front of the Californian Court alleging that Google’s practice to scan the content of emails sent through its Gmail service violates US wiretap laws. The first try was not successful because the plaintiffs could not constitute a ‘class’ (there’s a short history of the first case recalled in the Order). What’s interesting is that most of the findings in this Order are in fact re-statements of findings from the previous case. And with this case moving forward for now, there’s a chance we’ll see a real assessment of the facts of the case and an actual Court decision in the end.
Now, the plaintiff seeks to represent non-Gmail users ‘who have never established an email account with Google, and who have sent emails to or received emails from individuals with Google email accounts’.
According to the plaintiff, Google utilizes the user profiles ‘for purposes of selling to paying customers, and sending to the profiled communicants, targeted advertising based upon analysis of these profiles’ (p. 3).
Google defends itself by stating, among other things, that this practice is a part of their ‘ordinary course of business’ and therefore it falls under an exception of the Wiretap Law that allows them to look at the content of communications.
The Court found it plausible that the use of data to target ads is not ‘routine and legitimate commercial behaviour’ that is part of Google’s ordinary course of business, so it’s not exempted under the Wiretap Act.
The Court reiterated that it stands by the findings in Gmail I, according to which ‘the ordinary course of business exception protected electronic communication service providers from liability where the interceptions facilitated or were incidental to provision of the electronic communication service at issue‘ (p. 11).
In other words, the Court concluded that there ‘must be some nexus between the need to engage in the alleged interception and the provider’s ultimate business, that is, the ability to provide the underlying service or good‘ (p. 12).
Otherwise, the Court explained, ‘an electronic communication service provider could claim that any activity routinely undertaken for a business purpose is within the ordinary course of business, no matter how unrelated the activity is to the provision of the electronic communication service‘ (p. 15).
The Court further restated an argument of Chief Judge Hamilton from a previous case, who noted that ‘it is untenable for electronic communication service providers to ‘self-define’ the scope of their exemption from Wiretap Act liability‘.
Google used this following argument: ‘the alleged interception of email enables Google to provide targeted advertising, which in turn generates the revenue necessary for Google to provide Gmail. Google further contends that “the use of data to target ads is routine and legitimate commercial behavior”‘ (p. 24).
The Court in fact found that, because Google ceased intercepting and analysing the contents of emails transmitted via Google Apps for Education, ‘Google is able to provide the Gmail service to at least some users without intercepting, scanning and analyzing the content of email for advertising purposes’ (p. 24).
2) Google claims that California’s Invasion of Privacy Act does not apply to email and does not apply to new technologies in general. The Court is ‘unpersuaded’ by these claims and follows California Supreme Court’s philosophy according to which, when faced with two possible interpretations of CIPA, the CSC construes CIPA ‘in accordance with the interpretation that provides the greatest privacy protection’.
Section 631 of the California Penal Code creates liability for any individual who ‘reads, or attempts to read or to learn the contents or meaning of any message, report or communication while the same is in transit or passing over any wire, line or cable, or is being sent from or received at any place within this state‘.
The Court refers to the California Supreme Court’s findings in Flanagan v. Flanagan that ‘In enacting [CIPA], the Legislature declared in broad terms its intent to protect the right of privacy of the people of this state from what it perceived as a serious threat to the free exercise of personal liberties that cannot be tolerated in a free and civilized society. This philosophy appears to lie at the heart of virtually all the decisions construing [CIPA]’ (p.33). (Flanagan v. Flanagan, 27 Cal. 4th 766, 775 (2002)).
Finally, the Court refers to two other courts in its district that already decided to apply Section 631 of CIPA to ‘electronic communications similar to email’ (re Facebook Internet Tracking Litig., 140 F. Supp. 3d at 936 – holding that section 631 applies to “electronic communications”; Campbell, 77 F. Supp. 3d at 848 – finding that plaintiffs stated a claim under section 631 when defendant allegedly intercepted online Facebook messages). (p. 37).
When the Court says there must be a ‘nexus between the need to engage in the alleged interception and the provider’s ultimate business, that is, the ability to provide the underlying service or good’ for the interception of the content of the communications to be lawful, it’s almost like the Court would be saying that the interception must be ‘strictly necessary’ for the ordinary course of business (for a background of the ‘necessity’ condition in EU data protection law, click HERE).
If we were to transpose this case into the realm of EU law, we may not even get to think whether the interception (which amounts to an interference) is strictly necessary or not to achieve a purpose ‘allowed’ by the applicable law. The main question that would be there to answer is ‘does accessing all the content of emails and profiling all the users for marketing purposes touches the essence of the fundamental right to private life and that of the fundamental right to data protection?’.
The Plenary of the Article 29 Working Party (composed of national Data Protection Authorities – DPAs – in Europe and the European Data Protection Supervisor) met on 26 July to discuss, among other topics, the adopted text of the EU-US Privacy Shield and its accompanying adequacy decision issued by the European Commission on 12 July.
The Group adopted a Statement concerning its assessment of the adopted version of the Privacy Shield. To make a long story short, WP29 issued an Opinion on the Privacy Shield on 13 April, containing concerns, some of which outstanding, about the level of protection afforded by the Privacy Shield to personal data transferred from the EU to the U.S.. This, together with a later Opinion issued by the European Data Protection Supervisor, prompted the Commission to go back to the negotiation table with representatives of the U.S. government in order to alleviate these concerns. On 12 July, after passing through the vote of the Article 31 Committee, the final text of the Privacy Shield was adopted by the Commission.
The Statement issued by WP29 is meant to address the changes brought to the text of the Privacy Shield after the last rounds of negotiations. Have the two negotiating parties addressed the concerns raised by DPAs? Have they provided the requested clarifications?
The WP29 statement is very brief – so the Group preferred not to launch in an extensive legal analysis of the changes brought to the text. This would have required more time and the benefits of a detailed analysis at this stage, after the text has just been adopted, are few. However, the messages are very clear in the one-pager statement and they are quite critical.
At least the two last points stand right at the essence of the right to personal data protection and, respectively, the right to respect for private life. The first one has the ability to trigger a breach of Article 8(3) of the Charter of EU (independence of supervisory authorities) and the second one could amount to ‘legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications’. And, as the CJEU found, such legislation ‘must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter’ (para 94 of the Schrems judgement).
So, why do I think WP29 did not give a ‘carte blanche’ or a ‘green light’ for the application of the Privacy Shield?
First, because it is not in its competence to do so. According to Article 29(1) of Directive 95/46, the WP29 ‘shall have advisory status’. Article 30 of the Directive enumerates all the competences and powers of the Working Party – giving opinions, informing the Commission, issuing recommendations, advising the Commission. WP29 is not a Court. It is not even an administrative body that can deal with complaints and issue enforceable decisions to solve them. It cannot simply decide that a legal act issued by the European Commission (such as an adequacy decision) will be disapplied. Or, even more so, annulled.
The CJEU was more than clear in Schrems when stating that ‘the Court (of Justice of the EU – my addition) alone has jurisdiction to declare that an EU act, such as a Commission decision adopted pursuant to Article 25(6) of Directive 95/46, is invalid, the exclusivity of that jurisdiction having the purpose of guaranteeing legal certainty by ensuring that EU law is applied uniformly’ (para 61 of the judgment).
WP29 could not challenge the Privacy Shield in Court, either. It does not have this competence.
The ones that could indeed challenge the validity of the adequacy decision are the individual members of the Article 29 Working Party, the national DPAs – and only those whose national law gives them the legal standing to go to their national Courts (the others could also initiate such proceedings, if they would know how to directly invoke in front of the national courts the provisions of Directive 95/46 granting them this competence – third indent of Article 28(3); but this is another EU law discussion).
However, just as the CJEU points out in the Schrems judgment, court proceedings initiated by the DPAs are most likely to be possible only in situations where a complaint was made by an individual (this also depends on national procedural laws of EU Member States) and the DPA happens to agree with the complainant.
Perhaps it is not a coincidence that the only concrete immediate step mentioned by the WP29 in its Statement is the commitment of its members to ‘proactively and independently assist the data subjects with exercising their rights under the Privacy Shield mechanism, in particular when dealing with complaints‘.
Another concrete step the WP29 can do about the level of protection of the safeguards contained in the Privacy Shield is, indeed, focusing on the first Joint Annual Review. The Review will probably be done at the beginning of Summer in 2017, close to the 1 year anniversary of its adoption – and it is the quickest way to have the adequacy decision of the Privacy Shield to be suspended or repealed (see paragraphs 150 and 151 of the adequacy decision), if it indeed does not provide for an adequate level of protection.
In the meantime, the members of the WP29 can very well use as guidance the complex analysis in the 58 pages of the Opinion on the draft Privacy Shield issued on 13 April when they will be dealing with complaints.
This is why I think that yesterday’s Statement is not the ‘carte blanche’ or ‘the green light’ almost everyone thought it was.

References: §77
 §176
 §244
 v. 
 v. 
 v. 
 CJEU 
 CJEU 
 CJEU