Kuner, Christopher

<intR>²Dok

The Sinking of the Safe Harbor verfassungsblog.de /the-sinking-of-the-safe-harbor-2/Christopher Kuner Do 8 Okt 2015The judgment of the Court of Justice of the European Union (CJEU) in Schrems v. Data ProtectionCommissioner (Case C-362/14) is a landmark in EU data protection law, but one about which I have seriousmisgivings. While I share the Court’s concern regarding the surveillance practices of the US government (andother governments for that matter) and some of its criticisms of the EU-US Safe Harbor Arrangement, I takeexception to its lack of interest in the practical effects of the judgment and the global context in which EU lawmust operate.The judgment largely affirms the opinion of Advocate General Bot of 23 September, and holds that the nationaldata protection authorities (DPAs) must have the power to reach their own conclusions about EuropeanCommission decisions concerning the adequacy of data protection in third countries under Article 25 of EUDirective 95/46 (paras. 38-66 of the judgment). In finding Commission Decision 2002/520 establishing the SafeHarbor to be invalid (para. 106), the Court affirms the need for a high standard of data protection as set out in itsprevious case law such as Digital Rights Ireland (Joined Cases C-293/12 and C-594/12), and holds that whiledata protection standards in third countries need not be “identical” to those in the EU, they must be “equivalent”(para. 73). It goes on to conclude that US law fails to limit interference with EU fundamental rights (para. 88),and that Decision 2002/520 contains gaps in protection with regard to data transferred under the Safe Harbor(para. 89).As the Commission stated in the Communication introducing its proposed General Data Protection Regulation(GDPR) that will replace the Directive, the current fragmentation of data protection law in the EU has already ledto “uneven protection for individuals”, and the Court’s confirmation that individual DPAs may interpretCommission decisions (para. 53) will only make the situation worse. The judgment’s emphasis on the need forthe DPAs to be “completely independent” (see paras. 40, 57, and 99) will complicate the adoption of a legalframework for their cooperation in the proposed European Data Protection Board foreseen in the GDPR.The judgment also creates uncertainty concerning data transfers conducted under other legal mechanisms (e.g.,standard contractual clauses or binding corporate rules). The Court stresses that adequacy must be determinedbased on the “domestic law and international commitments” of a third country (para. 96), suggesting that itdepends not just on the details of particular data transfer mechanism, but on the totality of fundamental rightsprotection in a third country’s legal system.Since these other data transfer mechanisms grant no greater protection against access by the intelligenceservices than did the Safe Harbor (as I have argued previously), the judgment implicitly seems to throw them intoquestion as well. Indeed, many or perhaps even most countries around the world exempt the activities of theirintelligence services from their national data protection law and lack an effective oversight structure forsurveillance activities, leading one to ask how under the Court’s reasoning adequate protection for data transferscan ever exist.Thousands of former Safe Harbor member companies (including those with their headquarters in the EU) willnow have to begin a lengthy process to implement alternative mechanisms for transferring data to the US,creating a legal vacuum for the protection of data transfers. The fact that the Court failed to use its power, whichit has exercised on other occasions (see Société Regie Networks, Case C-333/07), to mitigate the temporaleffects of the judgment and give companies a “grace period” to implement alternatives to the Safe Harbor showsits lack of interest in how EU data protection law functions “on the ground”.Motivating third countries to adopt EU data protection standards requires that the bar not be set so high that theyhave no realistic chance of meeting it. The CJEU has held that EU law is an autonomous and unique legal order(see Opinion 2/13, para. 158), suggesting that by definition few countries outside the European region will beable to emulate it.1/2Setting an unrealistic standard for adequacy and inciting individuals to have adequacy decisions reviewed by theCJEU (see paras. 61-65) makes a system that is already slow and cumbersome, with only 12 decisions issuedin 17 years (11 minus the Safe Harbor), even more glacial. The issuance of adequacy decisions by theCommission has become an example of what Martti Koskeniemi refers to as human rights “petrified into alegalistic paradigm”, and has little to do with real data protection. It is hard to understand why the EU legislatorhas apparently not included any improvements to the process for issuing adequacy decisions ( which couldinclude, for example, deadlines, greater transparency, input from stakeholders, etc) in the GDPR.The Court could have required reform of the Safe Harbor while still upholding fundamental rights, such as byadopting a Solange approach coupled with a demand to make improvements within a certain time period.Instead, it makes the transfer of personal data to third countries dependent on their strict adherence to EUstandards, which is not feasible in a pluralistic world with over two hundred countries and many differentconceptions of rights.The late Ulrich Beck wrote that “in order to pursue their national interest, countries need to…surrender parts oftheir autonomy in order to cope with national problems in a globalized world”. Data protection is a prime exampleof an area of law where national and local approaches are no longer sufficient. The EU and the US share deepcultural and historical ties, and as liberal democracies their legal systems have many similarities. In theory,providing legal protection for data transfers across the Atlantic should be one of the easier tasks of privacylawmaking, and if we cannot do this, then how can it ever be provided for data transfers to countries like Chinaand India? The idea that EU data protection law can survive in a constitutional biotope walled off from contactwith other legal systems is illusory, and will only undermine the global protection of personal data that theSchrems judgment aims to promote.LICENSED UNDER CC BY NC NDSUGGESTED CITATION  Kuner, Christopher: The Sinking of the Safe Harbor, VerfBlog,  2015/10/08,http://verfassungsblog.de/the-sinking-of-the-safe-harbor-2/.2/2

The Sinking of the Safe Harbor

https://intr2dok.vifa-recht.de/servlets/MCRFileNodeServlet/mir_derivate_00001377/verfassungsblog.de-The%20Sinking%20of%20the%20Safe%20Harbor.pdf

The Sinking of the Safe Harbor

Abstract

Similar works

Full text

Available Versions

<intR>²Dok