natgillin/translations-raw huggingface dataset:
Finally, on the basis of the available information about the U.S. legal order, including the representations and commitments from the U.S. government, the Commission considers that any interference by U.S. public authorities with the fundamental rights of the persons whose data are transferred from the Union to the United States under the Privacy Shield for national security, law enforcement or other public interest purposes, and the ensuing restrictions imposed on self-certified organisations with respect to their adherence to the Principles, will be limited to what is strictly necessary to achieve the legitimate objective in question, and that there exists effective legal protection against such interference.
I samband med överföring av personuppgifter som har insamlats i EU kommer avtalsförhållandet med den enskilde (kunden) i de flesta fall att vara med – och därför kommer alla beslut baserade på automatiserad behandling vanligen att fattas av – den EU-registernansvariga, som måste följa EU:s dataskyddsregler.
The Commission concludes that this meets the standards of Article 25 of Directive 95/46/EC, interpreted in light of the Charter of Fundamental Rights of the European Union, as explained by the Court of Justice in particular in the Schrems judgment.
Detta inbegriper scenarier där behandlingen utförs av en organisation som är ansluten till skölden och som agerar som en förmedlare för den EU-registeransvariges räkning.
ACTION OF DATA PROTECTION AUTHORITIES AND INFORMATION TO THE COMMISSION
Se även den kompletterande principen om ”Tvistlösning och efterlevnad” (bilaga II, avsnitt III.11).
In the Schrems judgment, the Court of Justice clarified that the Commission has no competence to restrict the powers that DPAs derive from Article 28 of Directive 95/46/EC (including the power to suspend data transfers) where a person, in bringing a claim under that provision, calls into question the compatibility of a Commission adequacy decision with the protection of the fundamental right to privacy and data protection [203].
Se även den kompletterande principen om ”Självcertifiering” (Bilaga II, avsnitt III.6).
In order to effectively monitor the functioning of the Privacy Shield, the Commission should be informed by Member States about relevant action undertaken by DPAs.
Se även den kompletterande principen om ”Kontroll” (Bilaga II, avsnitt III.7).
The Court of Justice furthermore considered that, in line with the second subparagraph of Article 25(6) of Directive 95/46/EC, Member States and their organs must take the measures necessary to comply with acts of the Union institutions, as the latter are in principle presumed to be lawful and accordingly produce legal effects until such time as they are withdrawn, annulled in an action for annulment or declared invalid following a reference for a preliminary ruling or a plea of illegality.
Se även den kompletterande principen om ”Obligatoriska avtal om vidare överföring” (bilaga II, avsnitt III.10).
Consequently, a Commission adequacy decision adopted pursuant to Article 25(6) of Directive 95/46/EC is binding on all organs of the Member States to which it is addressed, including their independent supervisory authorities [204].
Se bilaga II, avsnitt I.5.
Where such an authority has received a complaint putting in question the compliance of a Commission adequacy decision with the protection of the fundamental right to privacy and data protection and considers the objections advanced to be well founded, national law must provide it with a legal remedy to put those objections before a national court which, in case of doubts, must stay proceedings and make a reference for a preliminary ruling to the Court of Justice [205].
Enskilda kommer inte att ha rätt att välja att inte delta (opt-out) om personuppgifterna överförs till en tredje part som agerar som en förmedlare för att utföra uppgifter på organisationens (i Förenta staterna) vägnar och enligt dennas instruktioner.
PERIODIC REVIEW OF ADEQUACY FINDING
Detta kräver dock ett avtal med förmedlaren, och organisationen i Förenta staterna kommer att ha ansvaret för att garantera de skydd som tillhandahålls enligt principerna genom att utöva sina instruktionsbefogenheter.
In the light of the fact that the level of protection afforded by the U.S. legal order may be liable to change, the Commission, following adoption of this decision, will check periodically whether the findings relating to the adequacy of the level of protection ensured by the United States under the EU-U.S. Privacy Shield are still factually and legally justified.
Situationerna är olika beroende på om tredjeparten är en registeransvarig eller en registerförare (förmedlare).
Such a check is required, in any event, when the Commission acquires any information giving rise to a justified doubt in that regard [206].
I det första scenariot måste avtalet med tredjeparten föreskriva att den sistnämnda ska upphöra med behandlingen eller vidta andra rimliga och lämpliga åtgärder för att rätta till situationen.
Therefore, the Commission will continuously monitor the overall framework for the transfer of personal data created by the EU-U.S. Privacy Shield as well as compliance by U.S. authorities with the representations and commitments contained in the documents attached to this decision.
I det andra scenariot är det organisationen som är ansluten till skölden – såsom den som kontrollerar behandlingen och i enlighet med vars instruktioner agenten verkar – att vidta dessa åtgärder.
To facilitate this process, the U.S. has committed to inform the Commission of material developments in U.S. law when relevant to the Privacy Shield in the field of data protection and the limitations and safeguards applicable to access to personal data by public authorities.
I sådana all måste organisationen i Förenta staterna också vidta rimliga och lämpliga åtgärder i) för att säkerställa att förmedlaren på ett effektivt sätt behandlar de personuppgifter som överförs på ett sätt som är förenligt med organisationens skyldigheter enligt principerna för integritetsskydd och ii) för att stoppa och åtgärda otillåten behandling, till följd av ett meddelande.
Moreover, this decision will be subject to an Annual Joint Review which will cover all aspects of the functioning of the EU-U.S. Privacy Shield, including the operation of the national security and law enforcement exceptions to the Principles.
Information om förvaltningen av förteckningen över organisationer som anslutit sig till skölden återfinns i bilaga I och bilaga II (avsnitt I.3, avsnitt I.4, III.6.d, och avsnitt III.11.g).
In addition, since the adequacy finding may also be influenced by legal developments in Union law, the Commission will assess the level of protection provided by the Privacy Shield following the entry into application of the GDPR.
Se t.ex. bilaga II, avsnitt I.3, avsnitt III.6.f. och avsnitt III.11.g.i.
To perform the Annual Joint Review referred to in Annexes I, II and VI, the Commission will meet with the Department of Commerce and FTC, accompanied, if appropriate, by other departments and agencies involved in the implementation of the Privacy Shield arrangements, as well as, for matters pertaining to national security, representatives of the ODNI, other Intelligence Community elements and the Ombudsperson.
Se bilaga I, avsnittet om ”Söka efter och hantera falska påståenden om deltagande i skölden”.
The participation in this meeting will be open for EU DPAs and representatives of the Article 29 Working Party.
Se bilaga II, avsnitt III.6.h. och avsnitt III.11.f.
In the framework of the Annual Joint Review, the Commission will request that the Department of Commerce provides comprehensive information on all relevant aspects of the functioning of the EU-U.S. Privacy Shield, including referrals received by the Department of Commerce from DPAs and the results of ex officio compliance reviews.
Se bilaga I.
The Commission will also seek explanations concerning any questions or matters concerning the EU-U.S. Privacy Shield and its operation arising from any information available, including transparency reports allowed under the USA FREEDOM Act, public reports by U.S. national intelligence authorities, the DPAs, privacy groups, media reports, or any other possible source.
Detta är den handläggande myndighet som utsetts av den arbetsgrupp bestående av dataskyddsmyndigheter som föreskrivs i den kompletterande principen om ”dataskyddsmyndigheternas roll” (bilaga II, avsnitt III.5).
Moreover, in order to facilitate the Commission's task in this regard, the Member States should inform the Commission of cases where the actions of bodies responsible for ensuring compliance with the Principles in the United States fail to secure compliance and of any indications that the actions of U.S. public authorities responsible for national security or the prevention, investigation, detection or prosecution of criminal offenses do not ensure the required level of protection.
Årsrapporten ska innehålla 1) totalt antal klagomål rörande skölden som mottagits under rapporteringsåret, 2) typer av mottagna klagomål, 3) åtgärder för att förbättra tvistlösningens kvalitet, t.ex. handläggningstid för klagomål, och 4) resultat av mottagna klagomål, särskilt antal och typer av vidtagna åtgärder och beslutade påföljder.
On the basis of the annual joint review, the Commission will prepare a public report to be submitted to the European Parliament and the Council.
Se bilaga II, avsnitt III.11.e.
SUSPENSION OF THE ADEQUACY DECISION
Se bilaga II, avsnitt III.11.g, särskilt leden ii och iii.
Where, on the basis of the checks or of any other information available, the Commission concludes that the level of protection offered by the Privacy Shield can no longer be regarded as essentially equivalent to the one in the Union, or where there are clear indications that effective compliance with the Principles in the United States might no longer be ensured, or that the actions of U.S. public authorities responsible for national security or the prevention, investigation, detection or prosecution of criminal offenses do not ensure the required level of protection, it will inform the Department of Commerce thereof and request that appropriate measures are taken to swiftly address any potential non-compliance with the Principles within a specified, reasonable timeframe.
Arbetsordningen för den informella arbetsgruppen bestående av dataskyddsmyndigheter bör upprättas av dataskyddsmyndigheterna på grundval av deras förmåga att organisera sitt arbete och samarbeta sinsemellan.
If, after the expiration of the specified timeframe, the U.S. authorities fail to demonstrate satisfactorily that the EU-U.S.
Se bilaga I, avsnitten ”Ökat samarbete med dataskyddsmyndigheter” och ”Åtgärder för att göra det lättare att lösa klagomål om bristande efterlevnad” och bilaga II, avsnitt II.7.e.
Privacy Shield continues to guarantee effective compliance and an adequate level of protection, the Commission will initiate the procedure leading to the partial or complete suspension or repeal of this decision [207].
Se bilaga IV, p.
Alternatively, the Commission may propose to amend this decision, for instance by limiting the scope of the adequacy finding only to data transfers subject to additional conditions.
6.
In particular, the Commission will initiate the procedure for suspension or repeal in case of:
Se bilaga I, avsnittet ”Åtgärder för att göra det lättare att lösa klagomål om bristande efterlevnad”.
indications that the U.S. authorities do not comply with the representations and commitments contained in the documents annexed to this decision, including as regards the conditions and limitations for access by U.S. public authorities for law enforcement, national security and other public interest purposes to personal data transferred under the Privacy Shield;
En organisation som är ansluten till skölden för skydd av privatlivet ska offentligt förklara att den kommer att följa principerna, offentliggöra sina integritetsskyddspolicyer i linje med dessa principer och till fullo genomföra dem.
failure to effectively address complaints by EU data subjects; in this respect, the Commission will take into account all circumstances having an impact on the possibility for EU data subjects to have their rights enforced, including, in particular, the voluntary commitment by self-certified U.S. companies to cooperate with the DPAs and follow their advice; or
Underlåtenheten att följa principerna kan leda till åtal i enlighet med avsnitt 5 i FTC-lagen, som förbjuder illojala och bedrägliga handlingar i handeln eller som påverkar handeln.
failure by the Privacy Shield Ombudsperson to provide timely and appropriate responses to requests from EU data subjects.
Enligt uppgifter från FTC har den inga befogenheter att utföra inspektioner på plats när det gäller integritetsskydd.
The Commission will also consider initiating the procedure leading to the amendment, suspension, or repeal of this decision if, in the context of the Annual Joint Review of the functioning of the EU-U.S.
Den har emellertid befogenhet att tvinga organisationer att lägga fram handlingar och lämna vittnesmål (se avsnitt 20 i FTC-lagen), och får använda domstolsväsendet för att verkställa en sådan order om överträdelse konstateras.
Privacy Shield or otherwise, the Department of Commerce or other departments or agencies involved in the implementation of the Privacy Shield, or, for matters pertaining to national security, representatives of the U.S. Intelligence Community or the Ombudsperson, fail to provide information or clarifications necessary for the assessment of compliance with the Principles, the effectiveness of complaint handling procedures, or any lowering of the required level of protection as a consequence of actions by U.S. national intelligence authorities, in particular as a consequence of the collection and/or access to personal data that is not limited to what is strictly necessary and proportionate.
FTC:s beslut och domstolsbeslut får föreskriva att företagen ska genomföra integritetsskyddsprogram och regelbundet lämna efterlevnadsrapporter eller bedömningar från oberoende tredje parter till FTC.
In this respect, the Commission will take into account the extent to which the relevant information can be obtained from other sources, including through reports from self-certified U.S. companies as allowed under the USA FREEDOM Act.
Se bilaga II, avsnitt II.1.xi och III.7.c.
The Working Party on the Protection of Individuals with regard to the Processing of Personal Data established under Article 29 of Directive 95/46/EC published its opinion on the level of protection provided by the EU-U.S. Privacy Shield [208], which has been taken into account in the preparation of this Decision.
Antalet skiljemän i arbetsgruppen ska överenskommas mellan parterna.
The European Parliament adopted a resolution on transatlantic data flows [209].
Arbetsgruppen kan dock finna att täckningen med tanke på de särskilda omständigheterna kring skiljedomsförfarandet skulle leda till omotiverade eller oproportionerliga kostnader.
The measures provided for in this Decision are in accordance with the opinion of the Committee established under Article 31(1) of Directive 95/46/EC,
Enskilda personer kan inte kräva skadestånd i skiljedomsförfaranden, men åberopande av skiljedom hindrar dock inte den enskilde från att yrka på skadeståndsanspråk i allmänna domstolar i Förenta staterna.
HAS ADOPTED THIS DECISION:
Den nationella underrättelsetjänsten (Office of the Director of National Intelligence, ODNI), fungerar som överordnat organ för underrättelsegemenskapen och är presidentens och det nationella säkerhetsrådets främsta rådgivare.
Article 1
Se Intelligence Reform and Terrorism Prevention Act från 2004, Pub.
For the purposes of Article 25(2) of Directive 95/46/EC, the United States ensures an adequate level of protection for personal data transferred from the Union to organisations in the United States under the EU-U.S. Privacy Shield.
Se Schrems-målet, punkt 91.
The EU-U.S. Privacy Shield is constituted by the Principles issued by the U.S. Department of Commerce on 7 July 2016 as set out in Annex II and the official representations and commitments contained in the documents listed in Annexes I, III to VII.
Förenta staternas konstitution, artikel II.
For the purpose of paragraph 1, personal data are transferred under the EU-U.S. Privacy Shield where they are transferred from the Union to organisations in the United States that are included in the ‘Privacy Shield List’, maintained and made publicly available by the U.S. Department of Commerce, in accordance with Sections I and III of the Principles set out in Annex II.
Se även inledningen till PPD-28.
Article 2
12333 ska presidenten, med stöd av det nationella säkerhetsrådet, och DNI utfärda sådana lämpliga riktlinjer, förfaranden och vägledningar som är nödvändiga för att genomföra dekretet.
This Decision does not affect the application of the provisions of Directive 95/46/EC other than Article 25(1) that pertain to the processing of personal data within the Member States, in particular Article 4 thereof.
En definition av begreppet ”underrättelsegemenskap” ges i avsnitt 3.5 (h) i E.O. 12333, tillsammans med nr 1 i PPD-28.
Article 3
ODNI:s utfästelser (bilaga VI), s.
Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive 95/46/EC leading to the suspension or definitive ban of data flows to an organisation in the United States that is included in the Privacy Shield List in accordance with Sections I and III of the Principles set out in Annex II in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall inform the Commission without delay.
3.
Article 4
Se avsnitt 4(b),(c) i PPD-28.
The Commission will continuously monitor the functioning of the EU-U.S. Privacy Shield with a view to assessing whether the United States continues to ensure an adequate level of protection of personal data transferred thereunder from the Union to organisations in the United States.
Enligt offentliga uppgifter bekräftade översynen 2015 de befintliga sex ändamålen.
The Member States and the Commission shall inform each other of cases where it appears that the government bodies in the United States with the statutory power to enforce compliance with the Principles set out in Annex II fail to provide effective detection and supervision mechanisms enabling infringements of the Principles to be identified and punished in practice.
Se Signals Intelligence Reform, 2016 Progress Report.
The Member States and the Commission shall inform each other of any indications that the interferences by U.S. public authorities responsible for national security, law enforcement or other public interests with the right of individuals to the protection of their personal data go beyond what is strictly necessary, and/or that there is no effective legal protection against such interferences.
ODNI:s utfästelser (bilaga VI), s.
Within one year from the date of the notification of this Decision to the Member States and on a yearly basis thereafter, the Commission will evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the Annual Joint Review referred to in Annexes I, II and VI.
6.
The Commission will report any pertinent findings to the Committee established under Article 31 of Directive 95/46/EC.
Se fotnot 63.
The Commission will present draft measures in accordance with the procedure referred to in Article 31(2) of Directive 95/46/EC with a view to suspending, amending or repealing this Decision or limiting its scope, among others, where there are indications:
ODNI:s utfästelser (bilaga VI), s.
that the U.S. public authorities do not comply with the representations and commitments contained in the documents annexed to this Decision, including as regards the conditions and limitations for access by U.S. public authorities for law enforcement, national security and other public interest purposes to personal data transferred under the EU-U.S. Privacy Shield,
4.
of a systematic failure to effectively address complaints by EU data subjects, or
Se fotnot 63.
of a systematic failure by the Privacy Shield Ombudsperson to provide timely and appropriate responses to requests from EU data subjects as required by Section 4(e) of Annex III.
ODNI:s utfästelser (bilaga VI).
The Commission will also present such draft measures if the lack of cooperation of the bodies involved in ensuring the functioning of the EU-U.S.
Detta avser särskilt den oro som de nationella dataskyddsmyndigheterna uttryckt i sitt yttrande om utkastet till beslut om adekvat skyddsnivå.
Privacy Shield in the United States prevents the Commission from determining whether the finding in Article 1(1) is affected.
Se artikel 29-gruppens (arbetsgruppen för skydd av enskilda med avseende på behandlingen av personuppgifter) yttrande 01/2016 om skölden för skydd av privatlivet i EU och Förenta staterna, utkastet till beslut om adekvat skyddsnivå (antaget den 13 april 2016), s.
Article 5
38, nr 47.
Member States shall take all the measures necessary to comply with this Decision.
Se avsnitt 2 i PPD-28.
Article 6
Se även Intelligence Community Directive 203.
This Decision is addressed to the Member States.
12333 (t.ex. att insamlad information ska motsvara de underrättelseprioriteringar som fastställts av presidenten) gäller också.
Member of the Commission
Närmare förklaringar om användningen av NSL ges i ODNI:s utfästelser (bilaga VI), s. 13–14, nr 38.
OJ L 281, 23.11.1995, p. 31.
Såsom anges där får FBI endast använda nationella säkerhetsskrivelser för att begära innehållslös information som är relevant för en undersökning avseende nationell säkerhet när syftet är att skydda nationen mot internationell terrorism eller hemlig underrättelseverksamhet.
See Opinion 4/2016 on the EU-U.S. Privacy Shield draft adequacy decision, published 30 May 2016.
När det gäller överföringar av uppgifter inom ramen för skölden för skydd av privatlivet i EU och Förenta staterna förefaller den mest relevanta rättsliga befogenheten vara lagen om elektronisk brevhemlighet (Electronic Communications Privacy Act) (18 U.S.C. § 2709), enligt vilken förfrågningar om abonnentuppgifter eller transnationella register ska innehålla en ”term som uttryckligen identifierar en person, en enhet, ett telefonnummer eller ett konto”.
Case C-362/14, Maximillian Schrems v Data Protection Commissioner (‘Schrems’), EU:C:2015:650, paragraph 39.
§ 1842 samt § 1841(2) och avsnitt 3127 i avdelning 18.
Case C-553/07, Rijkeboer, EU:C:2009:293, paragraph 47; Joined Cases C-293/12 and C-594/12, Digital Rights Ireland and Others, EU:C:2014:238, paragraph 53; Case C-131/12, Google Spain and Google, EU:C:2014:317, paragraphs 53, 66 and 74.
Befogenheten omfattar inte kommunikationens innehåll, utan inriktas snarare på information om en kund eller abonnent som använder en viss tjänst (t.ex. namn, adress, abonnentnummer, varaktighet/typ av mottagen tjänst, betalningskälla/betalningsmetod).
Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the U.S. Department of Commerce (OJ L 215, 28.8.2000, p. 7).
Det krävs en ansökan om ett beslut från FISC (eller en fredsdomare i Förenta staterna) och en särskild urvalsterm måste användas i den mening som avses i § 1841(4), dvs. en term som specifikt identifierar en person, ett konto osv., och som används för att i största möjliga utsträckning begränsa omfattningen av den information som söks.