Source: https://www.jipitec.eu/issues/jipitec-6-3-2015/4320
Timestamp: 2019-04-25 19:46:42+00:00

Document:
For a number of years, Facebook user and privacy law expert Maximilian Schrems  has insisted on a better data protection on Facebook. Since 2011, Schrems filed 22 complaints  against Facebook´s European headquarters in Dublin based on alleged infringement of the Irish Data Protection Act and the underlying European Union (EU) Data Protection Directive of 1995  . Following nearly three years, Schrems´ initiative “Europe vs. Facebook“  withdraw these complaints against Facebook; however, the “PRISM complaints”  were still pursued. The latter consisted of complaints against Apple  , Facebook  , Skype  , Microsoft  and Yahoo  . In his lodged complaint with the Irish supervisory authority (the Data Protection Commissioner) regarding Facebook, Mr. Schrems upheld the view that, in light of the revelations made in 2013 by Edward Snowden concerning the activities of United States´ (US) intelligence services (in particular the National Security Agency - NSA), the law and practices of the US do not offer sufficient protection against surveillance by the public authorities of the data transferred to that country. On 24 March 2015, the Court of Justice of the European Union (CJEU) heard  this procedure against Facebook, which had been referred  by the Irish High Court.
In its judgement of 6 October 2015  , the CJEU declared the Safe Harbour decision of 2000 void. Although the CJEU ruled that the validity of the decision of 2000 is not a subject of the referred question itself, it indicated in margin numbers 93 and 94, that mass surveillance practices are incompatible with European fundamental rights. The CJEU claimed - in a remarkable way - decision-making power on questions of fundamental rights of EU citizens, which the EU Commission had formerly dealt with: “It is thus ultimately the Court of Justice which has the task of deciding whether or not a Commission decision is valid“.  The CJEU held that “even if the Commission has adopted a decision, the national supervisory authorities, when dealing with a claim, must be able to examine, with complete independence, whether the transfer of a person’s data to a third country complies with the requirements laid down by the directive.“  Thus, the CJEU found that the nature of Art. 3 of the Safe Harbour decision is illegitimate in this respect as it reduces the competence of national data protection authorities to fully assess the adequate level of data protection of self-certified companies in the US.
In light of this decision, the Irish High Court decided on 21 October 2015 that the Irish Data Protection Commissioner should investigate "Facebook Ireland Ltd" over alleged cooperation of "Facebook Inc" with US spy agencies, such as under the NSA's "PRISM" program. The initiative “Europe vs. Facebook“ legally requested Data Protection Authorities in Ireland  , Belgium  and Germany  to enforce the CJEU´s judgement on Facebook by reviewing and suspending Facebook’s data transfers over US spy programs.
The CJEU nullified one of the potential legal bases of EU-US data flow. A broad discussion has begun among EU data privacy experts whether - after the decision of the CJEU - alternatives to Safe Harbour are still permissible. Companies that have so far transferred European users’ personal data to the US on the basis of Safe Harbour must now turn to another legal basis, such as binding corporate rules (BCR)  , standard contractual clauses (SCC)  or consent given by the person affected.
The distinction between the validity of the standard contractual clauses as such – which has to be affirmed according to the findings above – and the competence of national supervisory authorities to suspend trans-border data flows should be emphasised. SSCs and BCRs cannot override the arguments made by the CJEU on mass surveillance under the Charter of Fundamental Rights (CFR)  . The CJEU held that the existence of a Commission decision cannot eliminate or even reduce the powers available to the national supervisory authorities. Thus, the same issues that lead to the invalidation of the Safe Harbour decision, could be brought before any of the national supervisory authorities in the 28 member states, in the case that a data subject claims that these contractual solutions do not properly protect the fundamental rights of the data subject. The relevant Decisions 2001/497/EC  , 2004/915/EC  and 2010/87/EU  all have a clause that cares for exactly this situation, and allow DPAs to suspend data flows if “it is established that the law to which the data importer is subject imposes upon him requirements to derogate from the relevant data protection rules which go beyond the restrictions necessary in a democratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are likely to have a substantial adverse effect on the guarantees provided by the standard contractual clauses”  . Whilst a supervisory authority assesses an adequate level of data protection, it may de facto block trans-border data flows.
The European Data Protection Directive and the corresponding implementation in the Federal Data Protection Act of Germany (BDSG) contain two requirements for a lawful data transfer to third countries: The first (“first stage“) is the need for a legal basis for the transmission as such (Art. 7 Data Protection Directive, § 4 (1) BDSG, § 4 (2) BDSG, §§ 27 ff BDSG). The second (“second stage“) assesses the question if the data recipient in a third country can prove an adequate level of data protection (Art. 25 Data Protection Directive, § 4b BDSG). Unfortunately, it is still a common misconception that a data transfer to third countries can be lawful based only on ensuring (second stage) an adequate level of data protection.
In many cases, mass surveillance will not be of importance for trans-border data transfers. When data transfers previously relied on Safe Harbour, and a US controller or processor is not subject to US mass surveillance laws, a consent given by the person affected may be a reasonable option. Or for example, in the case that personal information is sent to the US for the purpose to “perform a contract” or for the “vital interests of the data subject”. Most of the daily business transactions will therefore be able to use one of the derogations in Art 26 of the Data Protection Directive.
From a political view: for nearly two years, the EU and the US are negotiating a revision of the Safe Harbour Agreement. According to Reuters news agency, the discussions should be close to completion.  The CJEU´s decision will certainly have an impact on the ongoing negotiations. From a legal point of view: the CJEU´s decision makes it clear to national governments and EU institutions that European law is not allowed to crumble into dust only because of enhancing transatlantic trade. Through this judgment, the protection of fundamental rights in the EU has become a community project  and the CJEU´s decision is currently the third step on its long way to this. The first judgment dates back to April 2014 on data retention regulation. The second was that of May 2014 on the right to be forgotten and against Google. The third judgment is now attempting to end the discussion of the Internet as a legal vacuum. The court made it clear that future agreements relating to the traffic of data are a judicial subject.
The question regarding which “future regulation” could solve the above-mentioned recurring problems of legal and political bandwidth when it comes to trans-border data flows should be raised. Peter Schaar states that “in the longer term, the only way is to enforce on a global level privacy rights guaranteed in Art. 12 of the UN Declaration of Human Rights  , the EU Charter of Fundamental Rights and in other constitutions of democratic states”  .
To reach that goal, one objective should be a consolidated definition of what a trans-border data flow is, to define its features by explaining various combinations (controller, processor, sub-processor, data subject), the reason for it, its legal basis and the function of the level of protection of the country of destination, and to consider the radically increased quantity of such flows.
Another objective should be to examine existing bilateral and multilateral treaties and the rules therein that tend to regulate the flow of data across national borders. The ﬁrst data protection laws, mainly in Europe, did not contain provisions restricting trans-border data ﬂows. It was only when data outsourcing became an option to avoid strict domestic privacy laws, that some countries, partly based on the Convention 108 of the Council of Europe  , started to introduce rules on trans-border data flow. The history of regulation in different regions, through leading regional and international instruments of the EU, OECD, Council of Europe, APEC, and other bodies should be considered in this respect.
It is important to analyse whether there is a common type of approach within these rules. For example, European regulations are advanced and set out a high level of data protection. In the US, the emphasis is more on self-regulatory approaches, as seen currently in the Safe Harbour case, however, the increase in global data transfers also inﬂuences understandings in these areas and could be of importance in order to find a common denominator. It should then be possible to outline certain typologies of different regulatory approaches. The nature of these approaches also depend on different aspects of privacy, such as the history of privacy, theories of privacy and the varying understanding of privacy mainly between the US and Europe.
Constantly developing technological solutions will also be of importance as well as regulations developed by the private sector. It will additionally be relevant to examine to which extent trans-border data flows provide compelling challenges to cloud adoption and as a result offer a solution for any business seeking to transfer data that must exercise significant care and due-diligence to avoid infringing privacy regulations and protections by sending data to or through places that do not guarantee the same level of protection.
The next objective for stakeholders for the protection of people´s privacy should then be to find out whether the actual status quo is of a sufficiently harmonized nature. Particularly, the contents of three current major frameworks, the US, the EU and the APEC, have to be analysed and outlined to what extent these could form a basis for harmonised international rules.
Finally, it has to be answered whether an international harmonisation of trans-border data flows could be reached through an international compromise. Harmonisation has made some progress on a regional level, for example within the members of the European Union. It ought to be defined how the General Data Protection Regulation  could be of influence on international transfers by regulating the territorial scope of the Regulation, highlighting the question of the application of EU rules to controllers not established in the EU when processing personal data of EU citizens.
Christopher Kuner states that “there is a nature desire to find a single, high-level solution to the legal issues raised by transborder data flow regulation, and the inability to do so is frustrating”  . Data privacy experts and policy makers should thus concentrate their efforts more than ever to confront this task.
* Philipp E. Fischer, LL.M. (IP, London/Dresden) is a Ph.D. cand. (UOC, Barcelona) and works as a Data Protection Officer & Auditor (TÜV) in Munich.
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML.
 Reference for a preliminary ruling from High Court of Ireland (Ireland) made on 25 July 2014 – Maximillian Schrems v Data Protection Commissioner, Case C-362/14, http://curia.europa.eu/juris/document/document.jsf?text=&docid=157862&pageIndex=0&doclang=EN&mode=lst&dir=&occ=first&part=1&cid=161179.
 Press release of the Conference of German Data Protection Commissioners from 24 July 2013, https://ssl.bremen.de/datenschutz/sixcms/detail.php?gsid=bremen236.c.9283.de.
 COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU, http://ec.europa.eu/justice/data-protection/files/com_2013_847_en.pdf, p. 18.
 European Court of Justice, Case C‑362/14, JUDGMENT OF THE COURT (Grand Chamber) of 6 October 2015, http://curia.europa.eu/juris/document/document.jsf;jsessionid=9ea7d0f130d5248977b390cb4b77beacd6135154f1a0.e34KaxiLc3eQc40LaxqMbN4Oc38Oe0?text=&docid=169195&pageIndex=0&doclang=EN&mode=req&dir=&occ=first&part=1&cid=156974.
 Court of Justice of the European Union, PRESS RELEASE No 117/15, p. 2.
 Charter of Fundamental Rights of the European Union, 2000/C 364/01, http://www.europarl.europa.eu/charter/pdf/text_en.pdf.
 Süddeutsche Zeitung, 07.10.2015, Ressort: Meinungsseite.
 Kuner, C. (2013): Transborder Data Flows and Data Privacy Law, Oxford University Press, p. 186.
Philipp E. Fischer, Getting Privacy to a new Safe Harbour. Comment on the CJEU Judgment of 6 October 2015, Schrems v Data Protection Commissioner, 6 (2015) JIPITEC 229 para 1.

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 Art. 3
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 § 4
 § 4
 § 4
 Art 26
 Art. 12
 CJEU