Do Facebook Too The Usa Violate Eu Information Protection Law? The Cjeu Hearing Inwards Schrems

 

 

Simon McGarr, solicitor at McGarr solicitors

 

Last week, the CJEU held a hearing inwards the of import illustration of Schrems v Data Protection Commissioner, which concerns a legal challenge brought yesteryear an Austrian constabulary pupil to the transfers of his personal information to the USA yesteryear Facebook, on the grounds that his information would live on dependent area to volume surveillance nether U.S.A. law, every bit revealed yesteryear Edward Snowden. His legal challenge was truly brought against the Irish Gaelic information protection commissioner, who regulates such transfers pursuant to an understanding betwixt the European Union in addition to the U.S.A. known every bit the ‘Safe Harbour’ agreement. This understanding takes the cast of a Decision of the European Commission made pursuant to the EU’s information protection Directive, which permits personal information to live on transferred to the USA nether certainly conditions. He argued that the information protection authorization has the obligation to suspend transfers due to breaches of information protection standards occurring inwards the USA. (For to a greater extent than exceptional on the background to the case, meet the tidings of the master copy Irish Gaelic judgment here).

 

The next summarises the arguments made at the hearing yesteryear the parties, including the intervening NGO Digital Rights Ireland, every bit good every bit several Member States, the European Parliament, the Commission in addition to the European Data Protection Supervisor.  It in addition to so sets out the question-and-answer session betwixt the CJEU judges (and Advocate-General) in addition to the parties. The adjacent stair inwards this of import litigation volition live on the sentiment of the Advocate-General, due June 24^th.


Please note: these notes are presented for information purposes only. They are non an official tape or a verbatim work organisation human relationship of the hearing. They are based on fossil oil contemporaneous notes in addition to the arguments made at the hearing are paraphrased or compressed. Nothing hither should live on relied on for whatsoever legal or judicial purpose, in addition to all the next is liable to transcription error.

  

Schrems v Data Protection Commissioner

Case C-362/14

 

Judges:

M.V Skouris (president); M.K. Lenaerts (Vice President); M.A. Tizzano; Mme R. Silva de Lapuerta; M. T. Von Danwitz (Judge Rapporteur); M. S. Rodin; Mme K. Jurimae; M. Influenza A virus subtype H5N1 Rosas; M. E. Juhász; M. A. Borg Barthet; M. J. Malenovsky; M. D. Svaby; Mme M. Berger; M. F. Biltgen; M. C. Lycourgos; M. F. Biltgen

 

M. Y. Bot (Advocat General)

 

Max Schrems

 

Noel Travers SC for Mr. Schrems told the courtroom that personal information inwards the U.S.A. is dependent area to volume in addition to indiscriminate volume surveillance. The DRI v Ireland illustration struck downwards the European Union information retentivity directive, establishing a regulation which applies a fortiori to this case. However, the courtroom held that Data Retention did non impact the essence of the correct nether Article 8, every bit it concerned only metadata. The surveillance carried out inwards the U.S.A. accesses the content of information every bit good every bit the metadata, in addition to without judicial oversight. This interference is so serious that it does violate the essence of Article 8 rights, different the information retentivity directive. Mr. Travers held that the Safe Harbour conclusion is opposite to the Data Protection directive’s ain stated purpose, in addition to that it was accordingly invalid.

 

Answering the Court’s enquiry every bit to whether the conclusion precludes an investigation yesteryear a Data Protection Authority (DPA) such every bit the Irish Gaelic Data Protection Commissioner, he submitted that compliance amongst fundamental rights must live on component of the implementation of whatsoever Directive. Accordingly, national authorities, when called upon inwards a electrical load to investigate breaches must remove hold the powerfulness to produce so.

 

Article 25.6 of the information protection Directive allows for findings on adequacy regarding a 3rd province “by ground of its domestic constabulary or of the international commitments it has entered into”. The Safe Harbour Principles (SHPs) in addition to FAQs are non a constabulary or an international understanding nether the pregnant of the Vienna Convention. And the SHPs produce non apply to U.S.A. populace bodies. The Safe Harbour Principles are laid out inwards an annex to a Commission Decision, but that annex is dependent area to U.S.A. courts for interpretation in addition to for compliance. Where in that location is a requirement for compliance amongst law, it is amongst U.S.A. law, non European Union law.

 

Irish Data Protection Commissioner

 

For the Data Protection Commissioner, Mr. Paul Anthony McDermott said that amongst powerfulness must come upwards limitations. All national regulators are firstly fountain yesteryear domestic law.  The Data Protection Commissioner is also fountain yesteryear the Irish Gaelic Constitutional partitioning of powers. She cannot strike downwards laws, Directives or a Decision.

 

Mr. Schrems wanted to debate Safe Harbour inwards a full general way- it wasn’t alleged in addition to so that Facebook was inwards breach of condom harbour or that his information was inwards danger. The Irish Gaelic High Court had a limited Judicial Review challenge inwards front end of it. Mr. Schrems didn’t challenge Safe Harbour, or the State, or European Union constabulary directly, in addition to the Irish Gaelic High Court declined the application yesteryear Digital Right Republic of Ireland to advert the validity of the Safe Harbour Decision to Luxembourg. Mr. McDermott asked the courtroom to honour the parameters of the case.

 

Europe has decided to bargain amongst the transfer of information to the U.S.A. at a European level. The purpose of the Safe Harbour understanding is to accomplish a negotiated compromise. The words “negotiate”, “adapt” in addition to “review” appear inwards the Decision. It is clear hence that a marker of compromise is envisaged. Such matters are non to live on dealt amongst inwards a courtroom but, every bit they involve both legal in addition to political issues, yesteryear diplomacy in addition to realpolitik.

 

The Data Protection Commissioner tin remove hold regard to the European Union Charter of Fundamental Rights when she’s balancing matters but it doesn’t trump everything. It doesn’t allow her to ignore domestic constabulary or European law, Mr. McDermott concluded.

 

Digital Rights Ireland

 

For Digital Rights Republic of Ireland (DRI), Fergal Crehan BL said that spell it was clear that the Decision permits some fellow member states, nether existing legislation, to enquiry the adherence of private organisations to the Safe Harbour Principles, that the Decision purported to require Member states to choose it every bit a total in addition to final determination every bit to the adequacy of the constabulary in addition to practices of the U.S.A. of America. In this regard at to the lowest degree DRI agreed amongst the submissions of the Commission. However, the Decision inwards fact could non require fellow member states to produce so. Citing Case 34/78 Yoshida, in addition to related cases, he said that the Decision was clearly an item of tertiary legislation, relying on the Directive for its legitimacy. It follows that the Decision must comply, non only amongst the Charter, but also amongst the Directive from which it takes its being.

 

The constabulary of the European Union requires independent supervision of the Fundamental Right to Data Protection. This is established inwards Article 8.3 of the Charter, in addition to fleshed out inwards the Directive, especially at Article 28. Accordingly, yesteryear purporting to abridge this supervisory power, it is the SHD which runs opposite to the norms of primary and secondary European Union law, in addition to hence it is the SHD which must yield.

 

To the Court’s enquiry every bit to whether such powers tin live on made dependent area to requirements such every bit those at 3(1)(b) of the Decision, he give a similar answer. The powers granted to Data Protection Authorities inwards the Directive cannot live on limited yesteryear a Decision, where that Decision is made on human foot of the Directive, without inverting the hierarchical norms of the European Union legal order. Insofar every bit the Decision purports to produce so, it was invalid.

 

Turning to the Court’s enquiry every bit to whether the Decision live on reviewed, nether Article 46 of Regulation 45/2001, yesteryear the European Data Protection Supervisor (EDPS), he noted that Article 41 of that Regulation sets out the EDPS' remit every bit non only the "processing of personal information by a Community establishment or body", but also advising Community institutions on all matters concerning the processing of personal data.

 

To the court’s enquiry every bit to whether a conclusion on adequacy was limited to an exam of laws in addition to international agreements, he noted that the Directive provides that “The adequacy of the flat of protection afforded yesteryear a 3rd province shall live on assessed inwards the calorie-free of all the circumstances surrounding a information transfer operation”

 

Accordingly, the Commission must consider the adequacy of practise every bit good every bit law. It would live on both absurd in addition to alone inadequate to the requirements of the Directive were the Commission to simply opened upwards the statute volume of a 3rd country, in addition to assess adequacy solely on the ground of a legal gild which mightiness non agree to reality.

 

In the judgment of this Court inwards NS v Secretary of State for the Home Department, it was held,:

 

“a 3rd province tin only live on considered every bit a ‘safe 3rd country’ where non only has it ratified the Geneva Convention in addition to the ECHR but it also observes the provisions thereof.

 

It was farther held inwards NS that mere ratification of conventions yesteryear a Member State cannot outcome inwards the application of a conclusive presumption that that State observes those conventions. The same regulation is applicable both to Member States in addition to 3rd countries

 

Echoing Mr. Schrems, DRI submitted that an “adequate flat of protection” must include effective judicial protection, noting that the Charter of Fundamental Rights provides, at Article 41 for the Right to Good Administration, in addition to at Article 47 for the Right to An Effective Remedy.

 

However, FAQ xi of the SHD offers organisations a alternative of enforcement mechanisms, none of which involve submission to “an independent in addition to impartial tribunal previously established yesteryear law” every bit required yesteryear the Charter. Even where options 2 or three laid out inwards FAQ xi could live on said to satisfy the Charter requirement, the fact that they are optional, in addition to may live on shunned yesteryear the Safe Harbour Organisation inwards favour of alternative 1, a private sector mechanism, chosen in addition to paid for yesteryear the Safe Harbour Organization, meant the Decision fails to furnish effective independent judicial protection.

 

DRI also noted that spell information subjects may brand complaints to the U.S.A. Federal Trade Commission, the FTC is non obliged to investigate them, in addition to has never done so on fifty-fifty 1 occasion. This weakness of the Decision inwards the surface area of Enforcement was the dependent area of constant criticism yesteryear the Article 29 Working Party [the advisory trunk ready yesteryear the information protection directive] at every phase inwards the development of the Safe Harbour Agreement.

 

Mr. Crehan noted that the Decision does non require Safe Harbour Organizations to comply amongst the Safe Harbour Principles inwards practice. Rather it states, at article 1.3, that where an organisation self-certifies, certainly weather condition shall live on considered to remove hold been met. The key status is that the organisation receiving the information has disclosed its commitment to comply amongst the Safe Harbour Principles. The Commission notably did non choose the mayhap to a greater extent than logical approach of making compliance itself a status nether Article 1.2. The outcome of this formulation is that an organisation is deemed compliant yesteryear ground solely of its making a commitment to comply. The decision, he said, was non a "finding", inwards the everyday feel of that word; it was simply a conclusion to cease looking.

 

The findings of the Commission inwards its Communications on the functioning of Safe Harbour were findings, inwards the truthful in addition to literal feel of the word. These ran opposite to that which the Commission purported to “find”, inwards the Safe Harbour Decision. The outcome was an extraordinary province of affairs where a “finding” was existence defended inwards the rattling confront of the commission’s ain subsequently findings to the contrary.

 

DRI acknowledged the difficulties that mightiness live on caused yesteryear a province of affairs where each in addition to every national authorization was to brand its ain intervention, each mayhap coming to different conclusions, in addition to submitted that the EDPS mightiness live on best placed to intervene inwards a coordinating role.

 

Irish government

 

For the Republic of Ireland, Mr. David Fennelly BL submitted that the Safe Harbour Decision is binding on the Member States in addition to remains binding spell it is inwards force. Article 25 of the Directive must live on read inwards a holistic way. The protection of personal information must live on safeguarded inwards an appropriate way, but that in that location tin live on variations inwards the way of safeguarding. In regulating European Union information beyond the borders, the European Union can’t unilaterally impose its standards on 3rd countries. That’s why Article 25 does non require “equivalent” flat of protection, but an “adequate” flat of protection.

 

Ireland noted amongst concern the Commission’s findings regarding the working of Safe Harbour, but also noted that the Commission did non cry upwards these were sufficiently serious to justify them either repealing or suspending the Decision.

 

The scheme created nether Article 25 says that findings must live on made through negotiations, in addition to Member States are fountain yesteryear the positive adequacy finding in addition to can’t brand whatsoever findings or produce anything which would undermine the Commission’s negotiations.

 

Belgium

 

Counsel for Belgium submitted that in that location is no hierarchy of norms inside the Directive, placing Chapter 4, which provides for the Safe Harbour Decision, inwards a higher house Chapter 6, which provides for the powers of DPAs. Chapter vi is a full general chapter which may live on supplemented yesteryear chapter iv but is non necessarily subordinate to it. The independence of national supervisory authorities is vital. The primary goal of the adequacy conclusion is to convey legal certainty. The Decision has no temporal limit, in addition to spell circumstances tin change, in that location was no requirement to review the Safe Harbour Decision inwards the calorie-free of those novel circumstances.

 

A fellow member state, Kingdom of Belgium submitted, must non brand an interpretation of their domestic constabulary that is inwards defiance of the European Union Charter Rights. So protection of Charter Rights mightiness require that whatsoever limitations on DPAs live on negated.

 

Austria

 

Counsel for The Republic of Republic of Austria noted that adequacy decisions are non straight applicable nether European Union Member States’ law, but are rather directed to Member States, requiring them to choose necessary measures. Art 25.6 of the Directive doesn’t incorporate whatsoever limited requirement on the Commission to human activity inwards the calorie-free of ongoing circumstances. However, other forms of European Union constabulary house an implicit requirement on the Commission to review matters. If the Commission doesn’t act, the adequacy decisions tin live on looked at yesteryear national supervisory authorities. Article three of the Decision provides for an “emergency exit” yesteryear granting powers to Data Protection authorities. But the Decision provided so narrow an exit, amongst so many different requirements for it to live on invoked, that the national supervisory authorities inwards outcome are prevented from enacting their powers.

 

How should these requirements live on interpreted? It can’t precisely live on a theoretical legal examination, but rather it needs to live on a practical issue. Contrary to Ireland’s submissions, Republic of Austria saw this non every bit trying to strength European Union constabulary on 3rd parties but rather every bit taking European Union citizens’ rights every bit a starting betoken in addition to seeking to remove hold them protected. Legal in addition to judicial protection for European Union citizens is a primal issue.

 

There is no adequacy conclusion nether Article 25.6 of the Directive. Safe Harbour is non a condom harbour for European Union citizens but rather a condom harbour for information pirates. Safe Harbour has non amended U.S.A. constabulary or created whatsoever international requirements, so in that location is no legal ground for the Safe Harbour Decision. It should live on repealed, though mayhap amongst a transitional menses for legal certainty.

 

Poland

 

Counsel for Poland referred to Digital Rights Ireland’s betoken that the Decision was based on the Directive in addition to must live on interpreted inwards the calorie-free of the Directive. Therefore the Decision cannot forbid national supervisors from acting nether their directive powers, every bit the Directive is of a higher rank so cannot live on limited yesteryear the Decision. There tin live on a presumption of adequacy created yesteryear the Desicion, but the presumption must live on rebuttable.

 

The safeguard machinery is in that location to allow national supervisors to suspend flows, but it is likewise limited. Supervisory authorities must live on permitted to behaviour investigations, in addition to if they discover in that location is a problem, they must remove hold the correct to suspend information transfer. The Directive says that the adequacy of the protection inwards 3rd countries must live on considered inwards the calorie-free of all the circumstances – non precisely the rules, but also the facts.  This must include the availability of effective judicial oversight.

 

Slovenia

 

Counsel for Slovenia also submitted that national information protection authorities (DPAs) were non prevented from investigating yesteryear the Decision. To ensure an adequate flat of protection inwards 3rd parties, the Commission is non limited only to the assessment of legal norms but also their practical implementation. European Union citizens remove hold got judicial protections in addition to if in that location are whatsoever breaches nether Safe Harbour, in that location must live on judicial remedies at the flat of the European Union law. The Commission’s findings betoken to a violation of human rights inwards honour of transfers in addition to in that location should non live on a requirement on the component of Mr. Schrems to attempt out an actual breach but to exhibit a rigid possibility of a breach.

 

United Kingdom

 

Counsel for the UK submitted that Member States must choose all measures necessary to give outcome to the Decision’s assessment. Article 25 of the Directive empowers the Commission to found a mutual seat for the Union, so every bit non to remove hold conflicting findings. This is integral to international relations on information to allow for international trade.

 

DPAs tin investigate the lawfulness of information processing. However, 1 time the Commission has given its decision, the number of lawfulness has been dealt with. But examining adequacy of private information transfers remains inside the local authorities’ remit. In this way the Directive is hence inwards compliance amongst the Charter.

 

The Commission’s findings on the functioning of Safe Harbour were expressions of policy. They remove hold no legal status, in addition to in that location is non a requirement to human activity on human foot of them. Had in that location been such a requirement, the Commission would remove hold done so. Rather, they are component of an ongoing tidings on how to meliorate the arrangements in addition to this Court isn’t the correct house to usurp the Commission Decision. He also noted that if the Court did strike the Decision down, in that location would live on serious outcome on transfers to the U.S.A. risking disruption to trade.

 

European Parliament

 

Counsel for the European Parliament noted that the Commission may brand a finding of adequacy ‘only if’ in that location is adequate protection. The default is a presumption that in that location is non adequate protection. The Commission only creates a presumption, which tin live on rebutted inwards the confront of evidence.

 

The Commission cannot, yesteryear its Decision, forbid supervisory authorities from exercising their powers nether Article 28 of the Directive. The legislature did non give whatsoever powers to the Commission nether Article 28. Article 25, which allows for the finding on adequacy, does non furnish powers to limit the supervisory authorities.

 

The Commission must choose into work organisation human relationship all circumstances inwards determining adequacy. It may exercising powerfulness having regard to 2 exceptional issues (law in addition to international commitments), but that doesn’t preclude the Commission from taking anything else into account. Rules of constabulary to live on taken into work organisation human relationship must include effective judicial protection.

 

US constabulary in addition to practise allows for large scale, unnecessary in addition to disproportionate collection of European Union data, in addition to does non furnish adequate protection for European Union citizens’ data. The Commission hence cannot hold in that location is adequate protection. The Commission was required to suspend Safe Harbour. They remove hold failed to respond to the Parliament’s telephone weep upwards to produce so. The EDPS in addition to national authorities must in addition to should intervene inwards the confront of clear evidence of a serious violation of European Union rights.

 

Commission

 

Finally, Counsel for the European Commission made his submissions. He submitted that every adequacy conclusion has a procedural safeguard, allowing that suspension is permitted where a specific information transfer is not, inwards fact, adequate. The limitations on DPAs inwards the Decision produce non bound the correct to supervision nether Charter Article 8.3 but rather give shape to it. The review powers of the EDPS are only to produce amongst information processing yesteryear European Union institutions, in addition to the EDPS also is non empowered to review the Commission’s adequacy decisions.

 

In finding on adequacy, the Commission is non restricted to reviewing the laws on the books but also the constabulary inwards action. There is a requirement for appropriate redress - taking work organisation human relationship of different traditions inwards 3rd countries. Redress tin live on sought earlier the FTC or the Dept of Transport or U.S.A. courts or domestic courts. Echoing Ireland, counsel for the Commission argued that ‘adequate’ does non hateful ‘equivalent’.

 

Talks amongst the U.S.A. are ongoing in addition to making precisely about progress, but they are complex in addition to political. The Commission cannot conclude that in that location is an adequate flat of protection of all information transfers made nether the Safe Harbour principles. However, the Commission must live on allowed to remove hold a margin of discretion. It has to residuum citizen’s rights amongst the demand for legal certainty, for merchandise in addition to for the EU’s international relationships.

 

European Data Protection Supervisor

 

Counsel for the European Data Protection Supervisor, Mr. Dockson, stated that Safe Harbour, quite apart from electrical flow concerns regarding volume surveillance, was adopted inwards the confront of doubts. The Article 29 working grouping remove hold tried to teach inwards work. However, eighteen months after criticisms were issued yesteryear the group, they stay unacted upon. Mass surveillance of the form when the Decision was made was non imagined. The Safe Harbour scheme was non designed to allow for the flat of surveillance at nowadays obtaining inwards the US. 

 

Echoing counsel for Mr. Schrems, he noted that DRI v Ireland clarified when the essence to the correct to privacy was infringed. There is serious inference where in that location is access to the content of the data. In DRI v Ireland, the Court criticised the failure to require the belongings of information inside the EU, nether the command of an Independent information protection authority. In the US, such protections are wholly absent.

 

Regarding the role of the EDPS’ authority, Mr. Dockson referred to the European Parliament’s consideration of EDPS powers. Independence of information protection authorities is crucial. Independence cannot live on curtailed yesteryear a Commission comitology Decision.

 

The improvements yesteryear the U.S.A. inwards the coming months must live on sufficient. If in that location is non a positive outcome, in addition to so in that location is a demand to suspend the Decision.

 

Court questioning

 

Counsel’s observations having finished, the Judge-Rapporteur led the Court’s questioning.

 

He asked Counsel for the Commission whether the EDPS could or should intervene if the Commission is inactive. Counsel for the Commission replied firstly that the Commission is non inactive, in addition to added that national authorities cannot intervene inwards honour of 3rd countries spell the Commission Decision stands.

 

The Advocate-General in addition to so took upwards the questioning. He referred to Recital v of the Decision, which requires that adequacy shall live on “ensured”. The Decision itself precisely states that it shall live on “considered ensured”.

 

Per Pg 35 of the Decision, where U.S.A. constabulary provides for a breach, in addition to so that breach is allowed. So everything that is inwards the Safe Harbour understanding tin live on laid aside yesteryear U.S.A. national law? If so, how tin yous in addition to so plead that these regulations ensure adequacy? Having taken precisely about advice, counsel for the Commission stated that what must live on assessed is a situation, non precisely a scheme of laws. The U.S.A. ensured that they would enforce the Safe Harbour Principles.

 

The Judge-Rapporteur (JR) at nowadays intervened:

 

There is no explicit competence given to the Commission to bound the powers of DPAs. Article three does non remove hold whatsoever bearing on adequacy.

 

Commission: There is a security valve inwards all these adequacy decisions, which tin only live on a full general finding. Rules tin live on adequate, but their implementation may live on problematic.

 

JR: but yous say you’re limiting the powers of the independent national authorities. Where produce yous teach that power?

 

Commission: Read Art 25 in addition to 28 together. Adequacy decisions must live on complied amongst yesteryear the Member States, in addition to the national authorities must comply.

 

JR: you’ve stated hither that yous can’t confirm today that adequacy is respected. If this is your finding, what is the implication of recital 57? Or isn’t it limiting your discretion? Shouldn’t yous explicate your justification for continuing amongst the Decision?

 

Commission: Legal certainty is a rattling of import consideration. There is a lot of reliance on the Decision currently. And also nosotros demand to consider the relations amongst the 3rd political party country.

 

JR: So, yous say you’re remaining amongst the margin of discretion. Are yous inwards essence pleading that the Safe Harbour conclusion is non dependent area to Art 8.3 of the Charter? Yes or No?

 

*Commission choose instructions*

 

Commission: It is non the chore of a national supervisory authorization to examine whether the Commission complies amongst Art 8.3 of the Charter.

 

JR: The respond is no?

 

Commission: The respond is no.

 

The Judge Rapporteur asked counsel for the Commission to consider C-518/07 Commission -v- Germany where it was held that all actions yesteryear Independent authorities must live on interpreted inwards the calorie-free of their duties.

 

After a tiffin break, the questions resumed, amongst the Court’s Advocate-General (AG) taking the lead.

 

AG: What is the pregnant of “ensure”? This verb should hateful ‘to brand certainly that’, i.e that the 3rd province could live on obliged to produce something?

 

Commission: Under Article 25 [of the Directive], read every bit a whole, it is upwards to the fellow member states to examine the adequacy of the protections. That is non an obligation on a 3rd country. It is an exam of a province of affairs. However, when the Commission reaches the conclusion that in that location is an adequate flat of protection, it has been satisfied that sufficient information protection volition live on guarantee inwards the future. What has happened inwards the illustration of the Safe Harbour conclusion is that the U.S.A. communicated a missive of the alphabet to the Commission. They ensured us they would enforce the principles.

 

AG: Influenza A virus subtype H5N1 different question, re Charter Article 8.3. You said that in that location was an surface area that was the exclusive competence of the Commission which could non live on challenged yesteryear the national authorities. In this case, how produce yous cry upwards effective protection tin live on provided if they were non permitted to consider a swathe of data?

 

Commission: Well, nosotros tin only command information protection inwards the EU, nether the Safe Harbour conclusion every bit it is applied. As it is currently applied, in that location is no guarantee that the fundamental rights of the European Union citizens are adequately protected inwards the US. The Commission has taken action.

 

AG: Let’s imagine I’m on Facebook in addition to I determine my rights remove hold been breached. But I don’t meet the Commission taking action.

 

Commission: The Commission has analysed the facts, examined the problems in addition to engaged inwards talks amongst the U.S.A. authorities. We were assured yesteryear the U.S.A. President inwards a spoken communication that in that location was to live on a review.

 

AG: - Until then, what happens?

 

Commission: National authorities demand to choose whatever actions they demand to choose for individuals. There’s a lot a information is already inwards the US.

 

President Judge: This can’t live on your primary argument. I don’t sympathise it. Because in that location are already violations, in addition to so the violations demand to continue?

 

Commission: Well, there’s lots of information flowing.

 

President Judge: yous don’t intend to modify the decision, but rather to seek to teach assurances from the US?

 

Commission: Yes, nosotros hope for concrete guarantees. But it’s likewise early on to tell.

 

President Judge: How long volition that take? Your recommendations were made inwards 2013.

 

Commission: There is precisely about hope that our recommendations may live on accepted. We shouldn’t live on pushed yesteryear changing the Safe Harbour situation. It mightiness non meliorate our seat amongst the US.

 

AG: Perhaps my seat is self-centred, but inwards the meantime my information is yet existence transferred.

 

Commission: Close your Facebook account. An private tin revoke consent.

 

AG: If I wishing to approach a National Authority, I am non able to produce so?

 

Commission: You tin approach them in addition to if they are restricted yesteryear article three of the Decision, in addition to so that Article needs to live on interpreted inwards the calorie-free of Fundamental Rights.

 

Judge Berger of Republic of Austria in addition to so addressed a enquiry to the Counsel for the Data Protection Commissioner

 

Judge Berger: Your Data Protection Authority is hopelessly understaffed in addition to yous desire to attract information technology companies to site inwards Republic of Ireland in addition to so are soft on information protection, nosotros sympathise from the media. Is this why the Data Protection Authority is so willing to exercise self-restraint inwards exercising powers?

 

DPC: No, novel resources remove hold been given.

 

Vice President Lenearts in addition to so addressed precisely about questions to counsel for the Commission.

 

Vice President: The legality of a constabulary must live on considered inwards the calorie-free of what is legal at the minute that it is made. All of this happened inwards the yr 2000. Irrespective of the actual cast of enquiry referred to the court, validity has been discussed, in addition to let’s non quarrel virtually semantics.

 

Should nosotros xv years subsequently live on fountain yesteryear the historical illustration of fact finding? Should the Commission live on seen inwards all times after that, to live on yet confirming the 2000 appraisal inwards the context  of all the facts known at subsequent moments.

 

Commission: This is novel in addition to the courtroom should tread carefully. The Court has asked virtually “old school” validity, but also it may expect in addition to meet if in that location was a subsequent duty to act.

 

Vice President: But a national courtroom is looking to this courtroom to know the province of the law. If the Commission is non acting xv years later, in addition to so the courtroom tin in addition to so assess that decision?

 

Commission: But activity does non require the removal or amendment of Safe Harbour. The Court may non substitute its ain conclusion every bit to when is the correct fourth dimension to review a measure.

 

Judge Rodin: Influenza A virus subtype H5N1 enquiry of a factual nature: What was the harm to your customer [Mr. Schrems]?

 

Schrems: The harm is the breach to his correct to privacy.

 

Judge: But produce yous remove hold whatsoever evidence that this happened re your client’s data?

 

Schrems: No, but in that location is no demand inwards illustration constabulary flowing from the primary breach to attempt out an private breach.

 

Judge: Is the correct to privacy absolute or not?

 

Schrems: No correct is absolute except mayhap that against torture, but in that location is no objective ground for access of the information inwards U.S.A. law.

 

Judge: Influenza A virus subtype H5N1 enquiry for the Commission, assuming that volume surveillance took place, mightiness in that location live on an overriding ground for it that would hateful that it was yet adequately protected?

 

Commission: Over-broad utilisation of the national security exception would impairment adequacy.

 

There followed precisely about brief replies from the primary parties. Mr. Herwig Hoffman for Mr. Schrems pointed out that the Commission has repeatedly stated that it cannot at nowadays province European Union citizens’ information is adequately protected. Private companies are non fountain yesteryear the Safe Harbour principles, where they clash amongst whatsoever U.S.A. domestic law. In gild to justify itself, the Commission has said hither that the Decision does non demand to comply amongst Art 8 of the Charter. Independence of the national DPA contains an obligation to uphold private rights. Article three of the Decision purports to fetter this independence. Striking downwards this Safe Harbour understanding volition only impact a pair of M of companies, who remove hold signed upwards to it. It volition simply house all U.S.A. companies inwards the same seat every bit non-Safe Harbour companies remove hold been upwards until now.

 

Mr. McDermott for the Data Protection Commissioner said that Mr. Schrems has non shown that he personally has been harmed inwards whatsoever way. That is hardly surprising, every bit the NSA doesn’t attention virtually accessing the essays of an Austrian Law Student. The Court could choose payoff of the fact that Mr. Schrems is non existence harmed to allow the Commission precisely about fourth dimension to consummate negotiations amongst the US. The solution is for the walls of Safe Harbour to live on built higher, non to allow the harbour to live on dismantled brick yesteryear brick yesteryear private national authorities.

 

Mr. Crehan for DRI noted that Article three provides only for investigations into compliance amongst the Safe Harbour principles. These principles are such that fifty-fifty if they are complied with, this does non honour fundamental rights.

 

The Commission, concluding, stated that if the Commission tin discover adequacy, it tin discover adequacy inwards a conditional way also. Article three does non require likewise narrow a reading in addition to if they demand to, national DPAs tin ever utilisation their authorization nether the Charter to read it every bit widely every bit they require to human activity inwards private cases.

 

However, this independence does non hateful that the Data Protection Authorities are non fountain yesteryear the constabulary in addition to so they must choose the adequacy Decision. Influenza A virus subtype H5N1 harmonised approach is necessary to ensure that different fellow member states may non brand different findings virtually the US.

 

Case concluded. Advocate General's Opinion on 24^th June.

 

Simon McGarr volition acquaint on aspects of this illustration inwards a utter titled "Regulation, Litigation in addition to the ascent of Fundamental Rights" at the forthcoming Digital Rights Europe conference, 15 April inwards Dublin.

Share this post