Source: http://www.barrysookman.com/2015/10/12/schrems-what-the-cjeu-decided-and-why-it-is-a-problem-for-canadian-and-other-non-eu-businesses/
Timestamp: 2019-04-19 11:22:43+00:00

Document:
The implications of the CJEU’s judgment in Schrems to Canadian’s must not be underestimated. It directly impacts Canadian multinationals which have relied on the safe harbor to transfer data from their EU to US operations, Canadian businesses that host EU data with service providers with operations in the US or who outsource services to US service providers for customers resident in the EU. The implications of the judgment potentially apply to undermine every other mechanism the EU’s data protection laws have sanctioned to transfer personal data to the US. This includes the standard contractual clauses, business corporate rules, and the European Commission’s decision that Canada’s federal data protection laws, PIPEDA, adequately protect EU personal data. The judgment may even provide a basis for EU residents to sue data recipients for data that has been transferred to the US using the EU sanctioned contractual clauses.
Multinational businesses routinely transfer data from the EU to the US. Household names like Facebook, Google, Apple, Microsoft and approximately 4500 other multinational businesses did so relying on a safe harbour mechanism put in place under EU Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The Directive laid down rules on the transfer of personal data to third countries.
Under Art. 25(1) the transfer of personal data can take place only if the third country ensures an adequate level of protection of such data. Under Art. 25(6), in accordance with the procedure referred to in Article 31(2), the EU Commission may find that a third country ensures an adequate level of protection of personal data by reason of its domestic law or of the international commitments it has entered into. If the EU Commission adopts a decision to that effect, the transfer of personal data to the third country concerned may take place. Also, Member States are required to take the measures necessary to comply with a EU Commission’s decision.
The EU Commission adopted Decision 2000/520 pursuant to Art. 25(6). Under the Decision, if the safe harbour privacy principles are implemented, the processes are considered to ensure an adequate level of protection for personal data transferred from the EU to undertakings established in the US. The effect of Decision 2000/520 is to authorize the transfer of personal data from EU Member States to entities in the US which have undertaken to comply with the safe harbour principles.
As required, the Directive and Decision were implemented in Member States. For example, in Ireland, Section 11(1) of the Data Protection Act sets out a general prohibition on the transfer of personal data outside of Ireland except where the foreign state ensures an adequate level of protection for the privacy of data subjects. It also contains a sub-section which allows for the pre-emption of Irish law by EU law where a Community finding as to the adequacy of data protection in the third country has been made by the EU Commission. Under Section 11(2)(a), in any proceedings under the Act if a question arises about whether an adequate level of protection exists in a country outside of the EU to which data is transferred, if a Community finding (a determination under Art. 25(6) under the procedure set out in Art. 31(2)), has been made in relation to transfers of the kind in question, the question shall be determined in accordance with that finding. This process, therefore, enabled Irish based undertakings such as Facebook Ireland to transfer data of EU residents to Facebook Inc. in the US.
Following the revelations about US surveillance by Edward Snowden, an Austrian resident Max Schrems complained to the Irish data Commissioner about the transfers. The Commissioner determined that although there was generally power to investigate complaints about transfers of data outside of Ireland to territories that don’t have adequate data protection laws, the Commissioner couldn’t act because, among other things, the Commissioner did not have the authority to challenge the finding of adequacy by the EU Commission in Decision 2000/520.
The Irish Commissioner’s decision was appealed to the Irish High Court. The court in Schrems v Data Protection Commissioner  IEHC 310 (18 June 2014), questioned whether the Directive and the EU Commissioner’s Decision needed to be re-evaluated in the light of the EU Charter of Fundamental Rights and whether the Commissioner could look beyond or otherwise disregard the Community finding.
The Court went on to assess whether, on the basis of the evidence before it transfers of data to the US under the safe harbour would comply with Irish and EU data protection laws. Justice Hogan, expressed the opinion that it would be difficult to see how such transfers could comply with the Irish constitutional protections for privacy, that the potential for abuse “would be enormous”, and that, if permitted to do so, “this would indeed have been a matter which the Commissioner would have been obliged further to investigate”. As the validity of the safe harbour regime was not challenged in the judicial review proceedings, the court did not have to express any final decisions on whether the Commission Decision was valid. The court nevertheless questioned whether it was, going even further to find that ”it is not immediately apparent how the present operation of the Safe Harbour Regime can in practice satisfy the requirements of Article 8(1) and Article 8(3) of the Charter”.
Based on these findings, the High Court referred a question to the CJEU asking whether a data protection authority is bound by the EU Commission’s findings of adequacy with respect to data transferred to the US under the safe harbour regime.
Two weeks before the judgment of the CJEU was delivered, Advocate General Bot delivered an Opinion in the case. The AG rendered two important opinions which were largely followed by the CJEU in the Schrems judgment.
First, the AG addressed the effect to be given to a Commission decision of adequacy and whether such decision could be challenged by supervisor authorities in Member States. According to the AG, where the Commission finds that a third country ensures an adequate level of protection within the meaning of Art.25(2), the Member States must take the necessary measures to comply with the Commission’s decision. The effect of the decision is to allow transfers of personal data to a third country whose level of protection is considered adequate by the Commission. A Commission decision ensures uniformity in the transfer conditions applicable in the Member States.
However, that uniformity can continue only while that finding is not called into question. The finding can be called into question by either the Commission or the supervisory authority of Members States. The competence to make a finding of adequacy is shared and may be made either by the Commission or by the Member State, although their jurisdiction is not completely equal.
Second, the AG addressed whether Decision 2000/520 was valid. The AG expressed the opinion that the Decision invalid based on “the current factual and legal context”.
The revelations concerning the activities of the NSA. “Under the regime, ‘[a]dherence to [the Safe Harbour] Principles may be limited: (a) to the extent necessary to meet national security, public interest, or law enforcement requirements; (b) by statute, government regulation, or case-law that create conflicting obligations or explicit authorisations, provided that, in exercising any such authorisation, an organisation can demonstrate that its non-compliance with the Principles is limited to the extent necessary to meet the overriding legitimate interests furthered by such authorisation’.” The derogations are not limited to what is strictly necessary.
EU citizens have no effective right to be heard on the question of the surveillance and interception of their data. There is oversight on the part of the FISC, but the proceedings before it are secret and ex parte. That amounts to an interference with the right of citizens of the Union to an effective remedy, protected by Article 47 of the Charter.
The claim that US surveillance interfered with the fundamental rights protected by Articles 7, 8 and 47 of the EU Charter which is permitted by the derogations from the safe harbour principles, set out in the fourth paragraph of Annex I to Decision 2000/520, was “made out”.
The private dispute resolution mechanisms and the FTC, owing to its role limited to commercial disputes, was not a means of challenging access by the United States intelligence services to personal data transferred from the European Union. The FTC does not have the power to monitor possible breaches of principles for the protection of personal data by public actors such as the United States security agencies.
There are no opportunities for citizens of the EU to obtain access to or rectification or erasure of data, or administrative or judicial redress with regard to collection and further processing of their personal data taking place under the United States surveillance programmes.
The CJEU addressed the same two issues considered by the AG.
On the first issue, the CJEU reiterated the opinion of the AG that only the CJEU has the jurisdiction to set aside a decision of the EU Commission under Art 25(6). Until the decision is either revoked by the Commission or set aside by the CJEU, it remains binding on Member States. Thus, until such an event occurs, transfers of personal data to the US under the safe harbour regime legally complies with the prohibition against transfers of personal data to jurisdictions which do not provide the required level of protection.
The CJEU also agreed with the AG that the supervisory authority has the right to examine any finding of adequacy in considering whether to block particular transfers of personal data upon a complaint being lodged by an individual.
The CJEU then embarked on an analysis of whether Decision 2000/520 was compatible with EU law including the Charter protections individuals have with respect to privacy and the processing of their data. It concluded, as the AG had, that it did not and ruled it invalid.
The safe harbour principles “may be limited ‘to the extent necessary to meet national security, public interest, or law enforcement requirements’ and ‘by statute, government regulation, or case-law that create conflicting obligations or explicit authorisations, provided that, in exercising any such authorisation, an organisation can demonstrate that its non-compliance with the Principles is limited to the extent necessary to meet the overriding legitimate interests furthered by such authorisation’.” US organizations are required to comply with to US laws. In doing so, they are bound to disregard the other safe harbour principles where they conflict with those requirements and therefore prove incompatible with them. The Decision “thus enables interference, founded on national security and public interest requirements or on domestic legislation of the United States, with the fundamental rights of the persons whose personal data is or could be transferred from the European Union to the United States.” The Decision made no finding of any limitations in US law intended to limit such activities.
Under EU law, derogations and limitations in relation to the protection of personal data apply only in so far as is strictly necessary. “Legislation is not limited to what is strictly necessary where it authorises, on a generalised basis, storage of all the personal data of all the persons whose data has been transferred from the European Union to the United States without any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down by which to determine the limits of the access of the public authorities to the data, and of its subsequent use, for purposes which are specific, strictly restricted and capable of justifying the interference which both access to that data and its use entail.” “Legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life, as guaranteed by Article 7 of the Charter”.
The Decision did not contain sufficient findings regarding the measures by which the US ensures an adequate level of protection. The Commission also did not state in Decision 2000/520, that the United States in fact ‘ensures’ an adequate level of protection by reason of its domestic law or its international commitments.
The safe harbour protections applied only to the self-certifying organizations and not US public authorities.
The private dispute resolution mechanisms concern compliance by the United States undertakings with the safe harbour principles and cannot be applied in disputes relating to the legality of interference with fundamental rights that results from measures originating from the US government.
The full implications of the proceedings involving Schrems are not known. However, its effects on the legality of transfers of personal data from the EU to the US range from those that are immediate, to those that could manifest over time.
Personal data cannot be transferred from the EU to the US unless the US ensures an adequate level of protection for such personal data, as that phrase has been interpreted by the CJEU. Prior to the judgment of the CJEU, personal data could be transferred to the US under the safe harbour principles, or using the contractual clauses or binding corporate rules, procedures authorized by the EC Directive, or by relying on an exception or other derogation set out in the EC Directive, or by obtaining express authorization for the transfer from a data protection authority.
Transfers of personal data to Canada are on a similar footing, except that instead of a safe harbour regime, the EU Commission rendered another decision finding that Canada’s federal privacy legislation, PIPEDA, ensures an adequate level of protection for such personal data. Similar findings were made about the laws of other countries including Argentina, Israel, New Zealand, Uruguay, and Switzerland.
The judgment in Schrems impacts, or potentially impacts, each of these methods of transferring personal data outside of the EU.
The first direct casualty of the judgment is the EU-US safe harbour regime. The cornerstone of the regime was the “blessing” by the EU Commission that compliance with the safe harbour principles guaranteed an adequate level of protection necessary to comply with the data protection laws of Member States. It also provided comfort that the supervisory authorities could not challenge the adequacy of that finding.
It is now clear from the CJEU judgment that supervisory authorities have the jurisdiction to challenge particular transfers of data in response to a complaint. Accordingly, transfers of personal data can be challenged by data protection authorities on that basis alone.
The more nuanced question is whether businesses can continue to follow the safe harbour regime and hope that it will be regarded as providing adequate protection notwithstanding the judgment of the CJEU, or at least rely on it until a data protection authority decides to block transfers based on a complaint. Many commentators have concluded that the result of the judgment is to completely undo the safe harbor making compliance with it irrelevant.
The actual effect of the judgment is theoretically more nuanced because of the different ways Member States implemented the EU Directive. This requires almost a country by country analysis to determine the full implications of the judgment across the EU.
For example, in some countries, the transfer of personal data out of the EU is strictly prohibited unless there has been a finding of adequacy by the EU Commission. In these countries, the judgment of the CJEU undermines the legal basis for transfer of personal data to the US in reliance of the EU-US safe harbour. In other countries, a data protection authority may have expressly approved transfers of data to the US. The effect of the Schrems judgments on those approvals will vary from country to country, depending on the legal regime and the steps the data protection authority takes.
The situation may be different in other countries where transfers of personal data are permitted without express authorization. Here the data controller has the burden of establishing that transfers are effected in a manner that ensures an adequate level of protection. In these countries whether continued transfers can be made in reliance on the safe harbor may depend on whether the reasons of the CJEU could be overcome in a subsequent proceeding before supervisory authorities. It has been argued that the CJEU’s judgment was based, in large part, on deficiencies in the findings of the EU Commission about the safe harbour framework, but that the court did not find, as a matter of law, that the US lacked the protections required by EU law. Further, that the CJEU did not actually examine the US surveillance programs or the legal basis for those programs, or didn’t understand how Section 702 of FISA actually operated or recognize that the surveillance activities were carried out lawfully, and relied on the outdated and inaccurate 2013 highly critical EU Commission report.
Overcoming the judgment of the CJEU (and the findings of the High Court of Ireland and the opinion of the Advocate General in the Schrems proceedings) would likely be a real uphill battle.
First, it is debatable that even if the scope of the PRISM program is properly understood, it would satisfy the standards for privacy and data protection the CJEU lays out in Schrems as the program select targets who are non-U.S. persons located outside the United States on the basis of very broad criteria. The interference with EU citizen’s privacy rights would have to be based on the principle of “strict necessity”.
Second, it would have to be established that the PRISM program contains a dispute resolution process that provides a judicial means of redress, rectification or erasure of such data that applies to the US government.
Third, it would likely have to be shown that the 2013 Commission document (Communication COM(2013) 847 final) was incorrect at the time of its issuance, or is no longer accurate.
Fourth, there might be a question as to the extent to which the judgment is binding on supervisory authorities or lower courts. The CJEU made an express finding that US organizations are required to comply with to US laws and that in doing so, “they are bound to disregard the other safe harbour principles where they conflict with those requirements and therefore prove incompatible with them.” Further, under Art. 25(6) of the Directive, in certain situations where the EU Commission makes a finding that a third country does not ensure an adequate level of protection Member States are required to take the measures necessary to prevent any transfer of data of the same type to the third country in question. There would be questions as to whether the judgment constitutes such a finding and whether data protection authorities’ independent mandates give them the right to make findings that are different from those of the EU Commission.
In any event, transfers of personal data from the EU to the US would be particularly risky given the reasons of the CJEU in the Schrems judgment. Moreover, the Article 29 Working Party has issued a statement regarding the effect of the Schrems judgment.
Given that this is a joint statement by data protection authorities which enforce data protection laws in Members States, their views must be given considerable weight.
The Council and the European Parliament gave the EU Commission the power to decide, on the basis of Art. 26(4) of directive 95/46/EC, that certain standard contractual clauses offer sufficient safeguards as required by Art. 26(2). The Commission has so far issued two sets of standard contractual clauses for transfers from data controllers to data controllers established outside the EU/EEA and one set for the transfer to processors established outside the EU/EEA.
The uses of these clauses may become problematic as a result of the Schrems judgment.
Schrems makes it clear that supervisory authorities may still look behind the EU Commission’s findings of adequacy. Presumably, this would apply to a complaint to a supervisory authority that the contractual clauses are not effective to comply with EU data protection laws. A German data protection authority has already issued a position paper to declare the contractual clauses and even express consents to be an invalid way of transferring data to the US. Other German authorities have taken a similar position. However, on October 16, 2015, the Article 29 Working Party issued a statement that while the Working Party is continuing its analysis on the impact of the CJEU judgment on transfer tools, “data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used”. However, they note that “this will not prevent data protection authorities to investigate particular cases, for instance on the basis of complaints, and to exercise their powers in order to protect individuals”.
the clauses give data subjects remedies against the data exporter and the data importer, but provide no means of redress against governments such as the US government.
Under the contractual clauses, the data exporter and data importer make agreements and warranties with respect to the transfers and uses of the data by the data importer. They are jointly and severally liable including to data subjects who are express beneficiaries of many of the commitments. In light of the judgment of the CJEU it is unclear if these agreements and warranties can be entered into or complied with without breaching them and incurring direct liability to data subjects in Member States.
Similar considerations would apply to the Binding Corporate rules. Binding Corporate Rules (BCRs) are internal rules (such as a Code of Conduct) adopted by multinational group of companies which define its global policy with regard to the international transfers of personal data within the same corporate group to entities located in countries which do not provide an adequate level of protection. They are used by multinational companies in order to adduce adequate safeguards for the protection of the privacy and fundamental rights and freedoms of individuals within the meaning of article 26 (2) of the Directive 95/46/CE for all transfers of personal data protected under a European law.
There are practical problems in using BCRs. For example, the rules must be approved under a EU cooperation procedure. This can take over a year to put in place.
In 2001, the EU Commission issued 2002/2/EC: Commission Decision of 20 December 2001 finding that Canada’s federal privacy law, PIPEDA, is considered as providing an adequate level of protection for personal data transferred from the EU to Canada. Similar findings were made about the laws of other countries including Argentina, Israel, New Zealand, Uruguay, and Switzerland.
As noted above, Schrems makes it clear that supervisory authorities may still look behind the EU Commission’s findings of adequacy. Presumably, this would apply to a complaint to a supervisory authority alleging that PIPEDA is not effective, in fact, to provide an adequate level of protection to comply with EU data protection laws.
PIPEDA contains exemptions which permit disclosure of personal information for a variety of purposes including as required to comply with “a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records”; or “made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that, inter alia, it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs”. The EU Commission made no express findings that such disclosures are consistent with the specific purposes and proportionality principles under EU law or that Canada’s security agencies’ exercise of such powers provide for adequate protection of the personal information of EU residents. It is also always open to challenge the use of the exemptions based on current circumstances in Canada.
PIPEDA applies to Canadian organizations and provides no means of redress against the government for misuse of EU personal data.
Canadian businesses with operations in the EU and the US have a number of bad choices. However, they are not alone. Given the approximately 4500 entities that relied on the safe harbour, there is some comfort in the numbers affected, at least in the short term.
The EU Article 29 Working Party released a joint statement on October 16, 2015 to provide guidance on the CJEU judgment. In it they expressed the view that the EU-US safe harbour can no longer be relied upon and that the standard contractual clauses and BCRs can be used, at least until they complete their analysis of the judgment. They warn, however, that they will commence enforcement actions by the end of January 2016 if no solution is found with the US authorities by that time.
Following the landmark ruling of the Court of Justice of the European Union (CJEU) of 6 October 2015 in the Maximilian Schrems v Data Protection Commissioner case (C-362-14), the EU data protection authorities assembled in the Article 29 Working Party have discussed the first consequences to be drawn at European and national level. EU data protection authorities consider that it is absolutely essential to have a robust, collective and common position on the implementation of the judgment. Moreover, the Working Party will observe closely the developments of the pending procedures before the Irish High Court.
The EU and US were also reportedly close to finalizing an Umbrella Agreement to provide a proper and wide framework of protection for all the data exchanges among EU and US in the field of criminal law enforcement.
Those companies that rely on the EU-US safe harbour need to consider other options including using the standard contractual clauses or the BCRs. They should also consider conducting their own risk assessments to determine if their data handling processes, or those that are available such as encryption of data before transfer to the US, can assure an adequate level of protection. Consideration also needs to be given to the country or countries from which data is to be transferred. In some countries, for example, specific permits or authorizations might be granted so as to permit specific transfers of personal data. There is also a need to examine the basis under which their service providers transfer data from the EU to the US. Canadian businesses that import data from the EU directly to Canada currently are in a better position as they can continue to rely on Commission Decision of 20 December, at least for now.
“In this regard, it is very difficult to see how the mass and undifferentiated accessing by State authorities of personal data generated perhaps especially within the home – such as e-mails, text messages, internet usage and telephone calls – would pass any proportionality test or could survive constitutional scrutiny on this ground alone. The potential for abuse in such cases would be enormous and might even give rise to the possibility that no facet of private or domestic life within the home would be immune from potential State scrutiny and observation.
That general protection for privacy, person and security in Article 40.5 would thus be entirely compromised by the mass and undifferentiated surveillance by State authorities of conversations and communications which take place within the home. For such interception of communications of this nature to be constitutionally valid, it would, accordingly, be necessary to demonstrate that this interception of communications and the surveillance of individuals or groups of individuals was objectively justified in the interests of the suppression of crime and national security and, further, that any such interception was attended by appropriate and verifiable safeguards.
In this connection, the Court’s settled case-law should be recalled according to which the European Union is a union based on the rule of law in which all acts of its institutions are subject to review of their compatibility with, in particular, the Treaties, general principles of law and fundamental rights (see, to this effect, judgments in Commission and Others v Kadi, C‑584/10 P, C‑593/10 P and C‑595/10 P, EU:C:2013:518, paragraph 66; Inuit Tapiriit Kanatami and Others v Parliament and Council, C‑583/11 P, EU:C:2013:625, paragraph 91; and Telefónica vCommission, C‑274/12 P, EU:C:2013:852, paragraph 56). Commission decisions adopted pursuant to Article 25(6) of Directive 95/46 cannot therefore escape such review.
That said, the Court alone has jurisdiction to declare that a EU act, such as a Commission decision adopted pursuant to Article 25(6) of Directive 95/46, is invalid, the exclusivity of that jurisdiction having the purpose of guaranteeing legal certainty by ensuring that EU law is applied uniformly (see judgments in Melki and Abdeli, C‑188/10 and C‑189/10, EU:C:2010:363, paragraph 54, and CIVAD, C‑533/10, EU:C:2012:347, paragraph 40).
Whilst the national courts are admittedly entitled to consider the validity of a EU act, such as a Commission decision adopted pursuant to Article 25(6) of Directive 95/46, they are not, however, endowed with the power to declare such an act invalid themselves (see, to this effect, judgments in Foto-Frost, 314/85, EU:C:1987:452, paragraphs 15 to 20, and IATA and ELFAA, C‑344/04, EU:C:2006:10, paragraph 27). A fortiori, when the national supervisory authorities examine a claim, within the meaning of Article 28(4) of that directive, concerning the compatibility of a Commission decision adopted pursuant to Article 25(6) of the directive with the protection of the privacy and of the fundamental rights and freedoms of individuals, they are not entitled to declare that decision invalid themselves.
“On the contrary, Article 28 of Directive 95/46 applies, by its very nature, to any processing of personal data. Thus, even if the Commission has adopted a decision pursuant to Article 25(6) of that directive, the national supervisory authorities, when hearing a claim lodged by a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him, must be able to examine, with complete independence, whether the transfer of that data complies with the requirements laid down by the directive….
Having regard to those considerations, where a person whose personal data has been or could be transferred to a third country which has been the subject of a Commission decision pursuant to Article 25(6) of Directive 95/46 lodges with a national supervisory authority a claim concerning the protection of his rights and freedoms in regard to the processing of that data and contests, in bringing the claim, as in the main proceedings, the compatibility of that decision with the protection of the privacy and of the fundamental rights and freedoms of individuals, it is incumbent upon the national supervisory authority to examine the claim with all due diligence….
where the national supervisory authority considers that the objections advanced by the person who has lodged with it a claim concerning the protection of his rights and freedoms in regard to the processing of his personal data are well founded, that authority must, in accordance with the third indent of the first subparagraph of Article 28(3) of Directive 95/46, read in the light in particular of Article 8(3) of the Charter, be able to engage in legal proceedings. It is incumbent upon the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers well founded before the national courts in order for them, if they share its doubts as to the validity of the Commission decision, to make a reference for a preliminary ruling for the purpose of examination of the decision’s validity.
Without prejudice to paragraph 1, a Member State may authorise a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25(2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.
“The ECJ held separately that the Framework as it exists is invalid. Unlike the Advocate General’s opinion though, which listed a number of deficiencies all closely linked to the recent NSA disclosures, the ECJ made its determination on two fairly narrow grounds. First, “legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications” is facially a violation of the right to privacy under the Charter of Fundamental Rights of the European Union (¶94). Second, the failure to provide citizens a judicially-enforced rights of access, and to delete, personal data “does not respect the essence of the fundamental right to effective judicial protection” under the Charter (¶95). The Court did not hold as a matter of law that the U.S. lacked either of those protections (though it noted that the Commission seemed to believe the U.S. had excessive access to data, and that there was insufficient judicial redress). The main issue was that “the Commission did not state in Decision 2000/520, that the United States in fact ‘ensures’ an adequate level of protection by reason of its domestic law or its international commitments” (¶98).
 For example, in Commission Decision C(2010)593, the data importer is agrees to comply with “Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognised sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.” (emphasis added) If this term is interpreted in accordance with EU law, then the data importer may not be able to demonstrate compliance given the judgment of the CJEU in the Schrems case.
 See PIPEDA s7(3). See, Colin Bennett, Could Europe end up targeting Canada over C-51 and digital privacy? iPolitics Oct. 13, 2015.

References: Art. 25
 Art. 25
 Art. 25
 Art. 25
 Art. 31
 CJEU 
 CJEU 
 CJEU 
 Art.25
 CJEU 
 CJEU 
 CJEU 
 Art 25
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 Art. 25
 CJEU 
 Art. 26
 Art. 26
 CJEU 
 CJEU 
 CJEU 
 CJEU