Getting Privacy to a new Safe Harbour. Comment on the CJEU Judgment of 6 October 2015, Schrems v Data Protection Commissioner

For a number of years, Facebook user and privacy law expert Maximilian Schrems  [1] has insisted on a better data protection on Facebook. Since 2011, Schrems filed 22 complaints  [2] against Facebook´s European headquarters in Dublin based on alleged infringement of the Irish Data Protection Act and the underlying European Union (EU) Data Protection Directive of 1995  [3] . Following nearly three years, Schrems´ initiative “Europe vs. Facebook“  [4] withdraw these complaints against Facebook; however, the “PRISM complaints”  [5] were still pursued. The latter consisted of complaints against Apple  [6] , Facebook  [7] , Skype  [8] , Microsoft  [9] and Yahoo  [10] . In his lodged complaint with the Irish supervisory authority (the Data Protection Commissioner) regarding Facebook, Mr. Schrems upheld the view that, in light of the revelations made in 2013 by Edward Snowden concerning the activities of United States´ (US) intelligence services (in particular the National Security Agency - NSA), the law and practices of the US do not offer sufficient protection against surveillance by the public authorities of the data transferred to that country. On 24 March 2015, the Court of Justice of the European Union (CJEU) heard  [11] this procedure against Facebook, which had been referred  [12] by the Irish High Court.

Facebook is bound to a legal basis called the “Safe Harbour” decision  [13] . According to the EU Data Protection Directive of 1995, personal data may only be transferred to “third countries” (countries outside the EU and the EEA), if information is sufficiently protected in the country of destination. It is under the authority of the European Commission to decide whether other countries can guarantee this level of protection. In 2000, the EU Commission defined the level of protection set out by the Safe Harbour program - adopted by the US Department of Commerce - as adequate. US companies can therefore self-certify that they comply with European data protection rules. In order to do so they must prove their commitments regarding data protection before the US Federal Trade Commission (FTC). This includes the duty to inform users which personal information they transfer for what purpose, to disclose information on its transfer to third parties, to give users the right to access stored data, and to rectify data or to delete data. Among data privacy experts however, there were doubts  [14] whether and to what extent US-based corporations would actually comply with this self-certification process, as companies are not obliged to provide evidence of these commitments and the EU itself does not oversee this process. The EU Commission also expressed its concerns: “Due to deficiencies in transparency and enforcement of the arrangement, specific problems still persist and should be addressed: a) transparency of privacy policies of Safe Harbour members, b) effective application of Privacy Principles by companies in the US, and c) effectiveness of the enforcement.“  [15] As Facebook grants the US intelligence services access to their databases, the US is not a "safe harbour" for European citizens’ personal data; thus on 23 September 2015, the EU Advocate General, Mr. Yves Bot, brought into question the continuation of Safe Harbour on which data transfers to the US are based on.  [16]

In its judgement of 6 October 2015  [17] , the CJEU declared the Safe Harbour decision of 2000 void. Although the CJEU ruled that the validity of the decision of 2000 is not a subject of the referred question itself, it indicated in margin numbers 93 and 94, that mass surveillance practices are incompatible with European fundamental rights. The CJEU claimed - in a remarkable way - decision-making power on questions of fundamental rights of EU citizens, which the EU Commission had formerly dealt with: “It is thus ultimately the Court of Justice which has the task of deciding whether or not a Commission decision is valid“.  [18] The CJEU held that “even if the Commission has adopted a decision, the national supervisory authorities, when dealing with a claim, must be able to examine, with complete independence, whether the transfer of a person’s data to a third country complies with the requirements laid down by the directive.“  [19] Thus, the CJEU found that the nature of Art. 3 of the Safe Harbour decision is illegitimate in this respect as it reduces the competence of national data protection authorities to fully assess the adequate level of data protection of self-certified companies in the US.

In light of this decision, the Irish High Court decided on 21 October 2015 that the Irish Data Protection Commissioner should investigate "Facebook Ireland Ltd" over alleged cooperation of "Facebook Inc" with US spy agencies, such as under the NSA's "PRISM" program. The initiative “Europe vs. Facebook“ legally requested Data Protection Authorities in Ireland  [20] , Belgium  [21] and Germany  [22] to enforce the CJEU´s judgement on Facebook by reviewing and suspending Facebook’s data transfers over US spy programs.

The CJEU nullified one of the potential legal bases of EU-US data flow. A broad discussion has begun among EU data privacy experts whether - after the decision of the CJEU - alternatives to Safe Harbour are still permissible. Companies that have so far transferred European users’ personal data to the US on the basis of Safe Harbour must now turn to another legal basis, such as binding corporate rules (BCR)  [23] , standard contractual clauses (SCC)  [24] or consent given by the person affected.

After Safe Harbour was invalidated, companies such as Facebook have started to use contractual agreements  [25] as an alternative in order to lawfully transfer data; this alternative is permissible insofar as these companies are not complicit in illegal “mass surveillance”. Gerard Rudden representing the complainant in Ireland stated that: “All relevant EU decisions include an exception for cases of mass surveillance. There is no ‘quick fix’ through alternative transfer methods for companies that are involved in the violation of European fundamental rights.”  [26]

The German data protection authorities are of the opinion that the standard contractual clauses are also "disputable"  [27] , because the reasons on which the CJEU based its decision on Safe Harbour apply also – at least partially - to standard contractual clauses. The CJEU found that the de facto poorly restricted access of intelligence agencies on electronic communication is inconsistent with European fundamental rights and that neither Safe Harbour, nor standard contractual clauses, would restrict this power of public authorities. Based on the argument of the Advocate General, Flemming Moos und Jens Schefzig  [28] argue that even when concluding a contract based on the standard contractual clauses an adequate level of data protection cannot be guaranteed. The Council and the European Parliament had given the Commission the power to decide, on the basis of Art. 26 (4) of the EU Data Protection Directive of 1995  [29] , that certain standard contractual clauses offer sufficient safeguards as required by Art. 26 (2). The CJEU held however that only the CJEU can declare a decision by the EU Commission void. This would therefore also concern the Commission´s decisions on standard contractual clauses. Until such a ruling by the CJEU, the standard contractual clauses would remain valid. Practitioners are therefore of the opinion that, until a new "safer safe harbour" is created, the transatlantic data flows could go on unhindered based on this available legal mechanism.  [30]

The distinction between the validity of the standard contractual clauses as such – which has to be affirmed according to the findings above – and the competence of national supervisory authorities to suspend trans-border data flows should be emphasised. SSCs and BCRs cannot override the arguments made by the CJEU on mass surveillance under the Charter of Fundamental Rights (CFR)  [31] . The CJEU held that the existence of a Commission decision cannot eliminate or even reduce the powers available to the national supervisory authorities. Thus, the same issues that lead to the invalidation of the Safe Harbour decision, could be brought before any of the national supervisory authorities in the 28 member states, in the case that a data subject claims that these contractual solutions do not properly protect the fundamental rights of the data subject. The relevant Decisions 2001/497/EC  [32] , 2004/915/EC  [33] and 2010/87/EU  [34] all have a clause that cares for exactly this situation, and allow DPAs to suspend data flows if “it is established that the law to which the data importer is subject imposes upon him requirements to derogate from the relevant data protection rules which go beyond the restrictions necessary in a democratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are likely to have a substantial adverse effect on the guarantees provided by the standard contractual clauses”  [35] . Whilst a supervisory authority assesses an adequate level of data protection, it may de facto block trans-border data flows.

After a review of the ongoing discussions on the CJEU´s decision, the author of this comment notes a lack of precise distinction in especially these three matters:

The question regarding which “future regulation” could solve the above-mentioned recurring problems of legal and political bandwidth when it comes to trans-border data flows should be raised. Peter Schaar states that “in the longer term, the only way is to enforce on a global level privacy rights guaranteed in Art. 12 of the UN Declaration of Human Rights  [42] , the EU Charter of Fundamental Rights and in other constitutions of democratic states”  [43] .

To reach that goal, one objective should be a consolidated definition of what a trans-border data flow is, to define its features by explaining various combinations (controller, processor, sub-processor, data subject), the reason for it, its legal basis and the function of the level of protection of the country of destination, and to consider the radically increased quantity of such flows.

Another objective should be to examine existing bilateral and multilateral treaties and the rules therein that tend to regulate the flow of data across national borders. The first data protection laws, mainly in Europe, did not contain provisions restricting trans-border data flows. It was only when data outsourcing became an option to avoid strict domestic privacy laws, that some countries, partly based on the Convention 108 of the Council of Europe  [44] , started to introduce rules on trans-border data flow. The history of regulation in different regions, through leading regional and international instruments of the EU, OECD, Council of Europe, APEC, and other bodies should be considered in this respect.

It is important to analyse whether there is a common type of approach within these rules. For example, European regulations are advanced and set out a high level of data protection. In the US, the emphasis is more on self-regulatory approaches, as seen currently in the Safe Harbour case, however, the increase in global data transfers also influences understandings in these areas and could be of importance in order to find a common denominator. It should then be possible to outline certain typologies of different regulatory approaches. The nature of these approaches also depend on different aspects of privacy, such as the history of privacy, theories of privacy and the varying understanding of privacy mainly between the US and Europe.

Constantly developing technological solutions will also be of importance as well as regulations developed by the private sector. It will additionally be relevant to examine to which extent trans-border data flows provide compelling challenges to cloud adoption and as a result offer a solution for any business seeking to transfer data that must exercise significant care and due-diligence to avoid infringing privacy regulations and protections by sending data to or through places that do not guarantee the same level of protection.

The next objective for stakeholders for the protection of people´s privacy should then be to find out whether the actual status quo is of a sufficiently harmonized nature. Particularly, the contents of three current major frameworks, the US, the EU and the APEC, have to be analysed and outlined to what extent these could form a basis for harmonised international rules.

Finally, it has to be answered whether an international harmonisation of trans-border data flows could be reached through an international compromise. Harmonisation has made some progress on a regional level, for example within the members of the European Union. It ought to be defined how the General Data Protection Regulation  [45] could be of influence on international transfers by regulating the territorial scope of the Regulation, highlighting the question of the application of EU rules to controllers not established in the EU when processing personal data of EU citizens.

Christopher Kuner states that “there is a nature desire to find a single, high-level solution to the legal issues raised by transborder data flow regulation, and the inability to do so is frustrating”  [46] . Data privacy experts and policy makers should thus concentrate their efforts more than ever to confront this task.

* Philipp E. Fischer, LL.M. (IP, London/Dresden) is a Ph.D. cand. (UOC, Barcelona) and works as a Data Protection Officer & Auditor (TÜV) in Munich.