Europe Five Facebook: The Kickoff Of The Halt For Nsa Spying On Eu Citizens?

Steve Peers

Since the revelations nigh the extent of spying yesteryear the American National Security Agency (NSA) revealed yesteryear Edward Snowden, doubts receive got increased nigh the adequacy of the information protection regime inwards the United States, inwards exceptional as regards its behaviour on on European Union citizens, who are bailiwick to the to a greater extent than favourable regime established yesteryear the Data Protection Directive. One appear of these doubts concerns the powerfulness of the NSA to examine the content of communications processed yesteryear social media companies based inwards the USA, such as Facebook.

Today’s decision by the Irish Gaelic High Court to shipping questions inwards the ‘Europe v Facebook’ example to the CJEU raises the possibility that the NSA’s access to European Union citizens’ personal information mightiness presently come upwardly to an end. But it’s non clear if the CJEU volition address the most essential issues directly, because the example raises a number of complex legal issues that demand to live examined inwards to a greater extent than detail.

As a starting point, the basic legal regime governing transfers to Facebook is the ‘Safe Harbour’ system, which takes the shape of a Commission Decision finding that all American companies certifying their participation inwards a scheme for complying amongst basic information protection principles keep an ‘adequate’ grade of information protection. This is i of the ‘adequacy decisions’ that the Commission tin brand pursuant to the rules on the information protection Directive on transfers of personal information exterior the European Union (see farther my recent weblog post on the planned reforms to this system). Despite the doubts arising from the Snowden revelations, the Commission’s most recent report on the Safe Harbour scheme did non propose that the scheme should be 

Not everyone accepts these assertions, however. An Austrian citizen, Mr. Schrems, complained nigh the transfer of his personal information as a Facebook user pursuant to the Safe Harbour rules to the Irish Gaelic information protection authority, which was competent inwards this affair because Facebook has a subsidiary inwards Ireland. The national authorisation argued that it could non convey a conclusion on this complaint, because it was leap yesteryear the Commission’s decision. Moreover, it argued that the electrical load was ‘frivolous’.

Mr. Schrems in addition to then challenged the authority’s conclusion earlier the Irish Gaelic High Court. In its ruling today, the national guess thence decided to shipping a inquiry to the CJEU. Essentially, the inquiry is whether the national information protection authorisation is leap yesteryear the Commission’s Decision, in addition to whether that authorisation tin behaviour its ain examination.

The starting fourth dimension obvious inquiry inwards this example is whether the American scheme infringes European Union information protection law. Basing itself on the recent Digital Rights judgment of the CJEU, inwards which that Court ruled that the EU’s information retentivity Directive was invalid, the national courtroom clearly believes that it does. While acknowledging the of import anti-terrorist objectives of the law, the judge, when examining national constitutional police states that it is ‘very difficult’ to run into how such majority surveillance ‘could locomote yesteryear whatever proportionality seek out or locomote whatever constitutional scrutiny’. Indeed, such surveillance has ‘gloomy echoes’ of the majority surveillance carried out inwards ‘totalitarian states such as the [East Germany] of Ulbricht in addition to Honeker’.

The guess as believes that the US scheme is a violation of European Union law, amongst no adequate or accessible safeguards available to European Union citizens, in addition to no consideration of European Union police issues built inwards to the review procedure that does exist.

Is this analysis correct? There are 2 key issues hither which the national courtroom doesn’t consider: the orbit of the information protection directive, in addition to the derogations from that Directive. On the inquiry of scope, the CJEU previously found inwards its Passenger Name Records (PNR) judgment that the EU/US understanding which provided for the transfer of information from airlines to the US authorities was exterior the orbit of the information protection Directive, because it regulated essentially only the activities of police enforcement authorities, in addition to the Directive does non apply to the ‘processing of personal data…in the course of study of an action which falls exterior the scope’ of European Union law, such as…public security, defence, State security…and…criminal law’. On the other hand, the CJEU ruled that the information retentivity directive was correctly based on the EU’s internal marketplace powers, since it essentially regulated the action of private industry, albeit for world safety objectives. While inwards this case, it mightiness live argued that the American police inwards inquiry falls inside the starting fourth dimension type of law, the Safe Harbour agreement clearly falls inside the second. So it is a kind of hybrid question, but on residuum the number falls inside the orbit of the Directive, since the stair out at number is essentially the Safe Harbour agreement.

Secondly, the external transfer rules inwards the European Union Directive do non refer expressly to the number of derogations from information protection rights on world safety grounds. Yet presumably just about such derogations tin exist, given that the Directive itself provides for world safety derogations as regards the measure European Union rules. Surely the safety exceptions applied yesteryear 3rd countries don’t receive got to live just the same as those applied yesteryear the Directive. But just about shape of minimum measure must apply. For the reasons laid out yesteryear the national judge, however, in that location is a strong declaration that the US rules autumn below the measure of anything which the European Union tin convey as ‘adequate’.  

Because the national guess takes these 2 issues for granted, in that location is no inquiry sent to the CJEU on whether the American regime is either inside the orbit of the Directive, or violates the minimum standards of adequacy which the European Union tin convey as regards 3rd states. But both these issues are absolutely essential inwards the debate over the post-Snowden human relationship betwixt the US in addition to EU. It would thence live desirable if the CJEU addressed them nonetheless.

Next, just about other problematic number hither is which laid of European Union information protection rules should apply: the external transfer rules, or the to a greater extent than stringent measure rules? The national court, along amongst the information protection authority, applies the external transfer rules, given Facebook’s certification nether the Safe Harbour system. However, it is doubtful whether this is correct.

As is good known, inwards the recent Google Spain judgment, the CJEU ruled that the measure rules applied to Google’s search engine function, given that it had an ‘establishment’ inwards Spain, according to the Court’s interpretation of the rules. As I in addition to then argued on this blog, it likely follows from that judgment that the measure rules apply at to the lowest degree to just about social networks similar Facebook. In whatever event, the number volition arise in i trial again when the revised jurisdiction in addition to external transfer rules, mentioned above, apply.  However, the complainant in addition to the national courtroom assume that the external transfer rules apply. Perhaps the CJEU should too examine this number of its ain motion.

Another problematic number is the inquiry of how to challenge the inadequacy of information protection inwards practise inwards the US, which is the bailiwick of the only inquiry sent to the CJEU. The Safe Harbour understanding addresses this indicate directly, since it allows national information protection authorities to suspend information transfers as regards an private company, inwards accordance amongst existing national law, if either the US authorities or the US enforcement scheme has found a violation of that agreement, or if:

there is a substantial likelihood that the Principles are beingness violated; in that location is a reasonable footing for believing that the enforcement machinery concerned is non taking or volition non convey adequate in addition to timely steps to settle the example at issue; the continuing transfer would do an imminent run a endangerment of grave terms to information subjects; in addition to the competent authorities inwards the Member State receive got made reasonable efforts nether the circumstances to render the organisation amongst notice in addition to an chance to respond.

However, Irish Gaelic national police does non render for such a system, but just sets out an irrebutable presumption that the Commission’s adequacy conclusion is sufficient. This dominion may good receive got played a constituent inwards convincing Facebook in addition to the subsidiaries of other US companies to develop inwards Republic of Ireland inwards the starting fourth dimension place.

The challenge argued that the national information protection authorisation nevertheless had to exercise such powers, in addition to so the national guess asked only whether this was possible. Logically, in that location tin live only i answer, yesteryear extension from the NS judgment: Member States cannot do an irrebutable presumption that prevents the exercise of Charter rights, so the national information protection authorisation must receive got the powers inwards question.

In the alternative, or arguably additionally, it must live possible to challenge the validity of the Commission’s adequacy conclusion inwards the national courts, which would in addition to then receive got an obligation, if they idea that challenge was well-founded, to shipping questions on that indicate to the CJEU. (See the Foto-Frost judgment).

The side yesteryear side problematic number is the role of the national constitutional protection for human rights. Clearly the national guess believes that the American scheme breaches the protection for the right to privacy guaranteed inwards the Irish Gaelic constitution. Nevertheless, the national courtroom proceeds to examine the number primarily from the perspective of European Union law. So if the CJEU rules against the challenge to the American police on the merits, or does non address those merits for procedural reasons, should the national courtroom decease along to apply Irish Gaelic law?

In principle, national constitutional police cannot apply here, since European Union law, as the national courtroom recognises, has extensively harmonised this issue. This agency that, according to the Melloni judgment of the CJEU, only the EU’s human rights standards, inwards the shape of the Charter, tin apply. National constitutional standards cannot. But national courts inwards Republic of Ireland (and elsewhere) mightiness live unwilling to convey that outcome.

National police would only apply if the CJEU rules that this number falls solely exterior the scope of the Directive, as discussed above. If, on the other hand, the processing falls inside a world safety derogation from the Directive, the European Union Charter would apply, yesteryear analogy amongst the CJEU’s recent judgment inwards Pfleger (discussed here), inwards which it ruled that the Charter applies to national derogations from European Union complimentary motion law. This parallels the declaration (discussed here) that national information retentivity police falls inside the orbit of European Union law, next the Digital Rights judgment, because it is a derogation from the EU’s e-privacy Directive.

Finally, the consequences of whatever hereafter finding yesteryear the national information protection authorisation that transfers nether the Safe Harbour conclusion must live suspended as regards Facebook must live considered. Assuming that the US had non changed its police inwards the meantime, Facebook would receive got a dilemma: should it comply amongst its US legal obligations, or human face upwardly the recess of transfers of information from Europe? Possibly it could avoid this dilemma yesteryear ensuring that it only processed European Union residents’ information inside the EU, potentially avoiding the orbit of US law. But this mightiness live expensive, in addition to inwards whatever trial the US mightiness seek to extend the orbit of its police to encompass such cases. These issues would inevitably arise for other major US companies as well.

Any existent prospect that Facebook transfers from the European Union mightiness live blocked would drive a major earthquake inwards EU/US relations, making the concerns nigh the recent Google Spain judgment await similar a tiddler tremor. It may live that the only solution is for the US to convey to a greater extent than seriously its ongoing discussions amongst the European Union on information protection issues, amongst a sentiment to reaching a solution that reconciles its safety concerns amongst the basic principles of privacy protection.

Barnard & Peers: chapter 9 

Share this post