Debate: Data Protection Commissioner v Facebook Ireland Limited, Maximillian Schrems  - Case C- - The adequate protection of personal data by the United Kingdom
Date: THURSDAY, 20 MAY 2021
Speaker: Didier Reynders
Language: EN

On 16 July last year, the European Court of Justice invalidated the EU-US Privacy Shield, concluding that insufficient protections were in place on the US side. The Schrems II ruling is a strong reaffirmation of the fundamental right to data protection under EU law. The Court confirmed that protection must travel with data, and that the level of this protection must meet EU standards.  In this ruling, the Court also provided us with precise requirements that need to be fulfilled when adopting adequacy decisions, such as the ones we have proposed with respect to the UK, and the one we are discussing with the US, in view of a possible successor to the Privacy Shield. This being said, the two resolutions that we are discussing today concern two situations that are very different. The one concerning the draft UK adequacy decisions is about managing and remedying possible future divergence, since the UK data protection rules are currently aligned with the EU ones. In contrast, the other resolution is about building convergence with important international partners, such as the US, through the development of additional and strong data protection safeguards.  Complying with EU law standards, including the case-law of the EU Court of Justice, calls, in particular, for the delicate balance between national security and privacy to be addressed. This is not an easy balance to strike. As the commissioner responsible for both the rule of law and the protection of personal data, it is my responsibility and my personal commitment to ensure full compliance with all the elements of the judgment of our highest Court. Let me now briefly turn to each of the two resolutions. Let me first address the draft adequacy decisions relating to the United Kingdom. Less than three weeks ago, an overwhelming majority in this plenary voted to approve the EU-UK Trade and Cooperation Agreement (TCA) by 660 votes in favour. Data protection standards were not subject to negotiation with the UK. In fact, the TCA provides that transfers of data to be carried out in the context of its implementation will need to take place in compliance with the requirements of the laws of the transferring party (which means, for the EU, the General Data Protection Regulation (GDPR) and the Law Enforcement Directive (LED)).  In this context, the EU’s interest is that the many transfers that will necessarily take place in application of the TCA, in a wide range of areas, from trade to law-enforcement cooperation, will be based on a comprehensive instrument, requiring a high level of protection. Such an instrument should also allow us to react if this level of protection is undermined. This is what our draft adequacy decisions provide for. First, they recognise that today the UK system continues to be based on the same rules that were applicable when the UK was a Member State of the EU. This is the result of a deliberate choice of the UK legislator, which has decided to fully incorporate the principles, rights and obligations of the GDPR and the Law Enforcement Directive into the British post-Brexit legal system. It is difficult to find a system that is more equivalent to ours. In addition, the UK shares with EU Member States a number of international commitments in the area of data protection, be it under the European Convention on Human Rights, as interpreted by the European Court of Human Rights, or the specific treaty on data protection of the Council of Europe. This is particularly important as regards the balance between national security and privacy: it means that also in that area, the UK adheres to the same standards as the EU Member States. This is why we have made very clear in our draft decisions that adherence to such international instruments is a central element of an adequacy finding. Second, recognising the current alignment between the UK and the EU does not mean that we are naïve or unprepared. We fully share Parliament’s concerns on the possible future evolution of the UK system. Brexit means that the UK data protection system will be administrated in a fully autonomous way. Even very similar rules can be interpreted, applied or enforced differently. The key question is therefore, in our view, whether we can trust the UK not to lower the current level of protection. The Commission is aware of the scepticism of a number of Members of this Parliament towards the UK in this regard. As President von der Leyen said of our new relationship with the UK, ‘trust is good, but law is better’.  This is why we have significantly reinforced certain important aspects of our approach on adequacy compared to previous decisions concerning other third countries. In particular, our proposed decisions – for the first time – strictly limit the duration of the adequacy findings by including a sunset clause: the decisions will automatically expire four years after their entry into force. If we were to consider that our adequacy findings can be renewed because the UK continues to ensure an adequate level of data protection, this will need to be subject to new decisions. Such decisions will have to be adopted following the entire adequacy decision-making process, with an opinion of the European Data Protection Board and a comitology procedure. By including that time limitation, we make clear towards the UK that possible problematic divergences will have consequences. This comes on top of – and does not replace – other mechanisms that we have also reinforced, and that would allow us to react immediately at any time, without waiting for the four year-period to expire if changes are introduced in UK law, or if there are practices that would undermine the level of protection. I am thinking of the suspension and termination mechanisms provided for in our draft decisions, in addition to the sunset clause. Following the receipt in April of the opinion of the European Data Protection Board (EDPB), which was largely in agreement with the Commission’s approach, we have further strengthened these mechanisms by identifying even more clearly in the draft decisions the aspects requiring specific monitoring and for which, in the event of divergence, we would trigger the suspension or termination procedure that we had already provided for in the initial draft. This concerns, for instance, the way the UK will implement its rules on international transfers. More generally, following the EDPB’s opinion, we have clarified our decisions on a number of aspects regarding both, firstly, why we consider that today the UK ensures an adequate level of protection, and, secondly, how we intend to react if the situation changes.  This includes aspects that I know are particularly important for this Parliament, and that are discussed in the draft resolution: from certain possible limitations to some data protection rights for other objectives of public interest, such as immigration control, to the conditions, limitations and safeguards that apply in the event that national security authorities seek access to data. Once again, we believe that we can credibly address the uncertainties of the future while recognising that the starting point is an adequate one at this stage. In particular, the sunset clause sends the message to the UK that problematic divergence will have a cost. However, it will only have its intended dissuasive effect if we clearly distinguish, on the one hand, convergence – and its benefits from, on the other hand, divergence – and its risks and consequences. To sum up, based on our assessment, after having taken into account the opinion of the EDPB, as well as concerns raised by this Parliament and by the Member States, the Commission is of the view that, as things stand, at this stage, we should go ahead with the adequacy decisions. Let me now turn to the second issue of today’s debate. In response to some of the points raised in the second draft resolution, I would like to update you on what the Commission is doing following the Schrems II judgment. First, we are finalising the modernisation of standard contractual clauses for international data transfers that fully take into account the requirements of the Schrems II judgment. We are very close to final adoption, which will probably take place in the next weeks, after a successful conclusion of a comitology procedure.  As standard contractual clauses are the most-used tool by European companies for their international data transfers, this is a top priority for us. We have revised the clauses on the basis of the feedback received from the European Data Protection Board and the European Data Protection Supervisor. We have also taken into account the input we received from stakeholders during a broad public consultation. The new clauses will provide companies with a practical toolbox to assist them in their compliance efforts. Because they are a ready-made tool, they will be particularly useful for SMEs, which, as is also pointed out in the draft resolution, may have limited resources and expertise. In addition, we will be in consultation with stakeholders to develop a user—friendly practical guide on the basis of questions and answers to further facilitate the use of these new standard contractual clauses. I also fully agree on the importance, stressed in your resolution, of ensuring consistency between the standard contractual clauses and the guidance of the European Data Protection Board on Schrems II, which is currently being finalised after a public consultation. That is why, in revising the draft standard contractual clauses, we have worked very closely with the Board to align our approaches and to provide companies with legal certainty.  Finally, we are also working with the US on a possible successor arrangement to the Privacy Shield. What is certainly positive is that we see real engagement from the administration of President Biden, and a clear willingness to work on possible solutions. This was also reflected in my recent statement with the US Secretary of Commerce Gina Raimondo, with whom I have been in contact on a regular basis since she took office.  At the same time, we also have to recognise that the issues around access to data for national security purposes that have to be addressed are very complex. As like-minded partners, the EU and the US should be able to find appropriate solutions on fundamental principles, such as access to a court, enforceable individual rights, and safeguards against excessive interferences with privacy.  But let me be clear: there are no shortcuts and there will be no quick fix. We will only accept a solution that is fully in line with the requirements of Union law, as interpreted by the Court of Justice. This is a question of compliance with the decision of our highest Court. It is also in the mutual interest of the EU and the US that we put in place a solid, sustainable and legally certain transatlantic transfer mechanism. I know I can count on your support and the support of the entire Parliament for solutions based on strong safeguards, which can, in that way, facilitate transfers. So I will continue to work and discuss this matter with the US in such a way, and I thank you for your attention this morning on those two very important topics and I am now looking forward to our debate.