Kuner, Christopher

<intR>²Dok

Mi 26 Jul2017Data Protection, Data Transfers, and InternationalAgreements: the CJEU’s Opinion 1/15 verfassungsblog.de /data-protection-data-transfers-and-international-agreements-the-cjeus-opinion-115/Christopher Kuner Mi 26 Jul 2017On 26 July the EU Court of Justice (CJEU) issued Opinion 1/15, which is its most significant ruling on theinternational dimensions of data protection law since its 2015 judgment in Case C-362/14 Schrems (previouslydiscussed in a Verfassungsblog debate). In Opinion 1/15, the Grand Chamber of the Court found that the draftagreement between the EU and Canada for the transfer of passenger name record (PNR) data may not beconcluded in its current form, since several of its provisions are incompatible with EU fundamental rights law. Asthe Court’s first ruling on the compatibility of a draft international agreement with the EU Charter of FundamentalRights, the judgment has important implications for many areas of EU law.BackgroundOn 6 September 2005 the European Commission adopted an adequacy decision under Article 25 of the EU DataProtection Directive 95/46 finding that the Canadian Customs Border Services Agency (CBSA) provided anadequate level of protection for the transfer of PNR data for flights from the EU to Canada. In 2006 an agreementbetween the EU and Canada concerning the processing of advance passenger information (API) and PNR dataalso came into force. The Canadian adequacy decision and the EU-Canada agreement then expired inSeptember 2009, but Canada declared that it would continue to apply these protections voluntarily.A new agreement for the processing and transfer of PNR data between the EU and Canada was initialed by theEU Council of Ministers and Canada on 6 May 2013 (referred to here as the Draft Agreement) and signed on 25June 2014, following which the Council sought approval of it by the European Parliament. On 25 November2014, the Parliament adopted a resolution seeking an opinion from the CJEU pursuant to Article 218(11) on twoquestions, which application was lodged with the Court on 10 April 2015. The two questions were as follows:‘Is the envisaged agreement compatible with the provisions of the Treaties (Article 16 TFEU) andthe Charter of Fundamental Rights of the European Union (Articles 7, 8 and Article 52(1)) asregards the right of individuals to protection of personal data?Do Articles 82(1)(d) and 87(2)(a) TFEU constitute the appropriate legal basis for the act of theCouncil concluding the envisaged agreement or must that act be based on Article 16 TFEU?’The Opinion of Advocate General Mengozzi was issued on 8 September 2016 (an excellent analysis of it can befound on the blog of Gabriela Zanfir-Fortuna). In it, the Advocate General responded negatively to bothquestions, as he found several provisions of the Draft Agreement incompatible with the Charter. He also foundthat the correct legal basis of the Agreement was provided by Articles 16(2) (the right to data protection) and87(2)(a) (police cooperation among the Member States in criminal matters) of the Treaty on the Functioning ofthe European Union (TFEU), but not by Article 82(1)(d) TFEU (judicial cooperation in criminal matters in theUnion).Summary of the judgmentThe following is a summary of the judgment’s main points; the references in parentheses are to the relevantparagraphs of the judgment unless otherwise stated.The Court first noted that an international agreement must be entirely compatible with the treaties andconstitutional principles of the EU (para. 67). After finding that the request for an Opinion of the Parliament was1/5admissible, the Court then considered what the correct legal basis for the Draft Agreement should be, which hasto be determined based on objective legal factors including the aim and content of the measure envisaged (para.76). The CJEU found that the Draft Agreement has the dual objectives of protecting public security and dataprotection, both of which are inextricably linked (para. 94). Thus, agreeing with the Advocate General, the CJEUfound that both Article 16(2) TFEU and Article 87(2)(a) TFEU were the correct legal bases of the DraftAgreement, but that Article 82(1)(d) TFEU could not serve as a legal basis (as will be discussed later on, thismay have an impact on other PNR agreements of the EU).The Court then considered the compatibility of the Draft Agreement with the rights to respect for private life andthe protection of personal data under the TFEU and the Charter. It found that PNR data may reveal considerabledetail about an individual, such as their travel habits, relationships, and financial situation, which may alsoinclude sensitive information. It stressed that the data were to be systematically analysed by automated meansbefore arrival in Canada, and that they could be stored for up to five years. Thus, the Court observed that thetransfer of PNR data to Canada and the rules foreseen in the Draft Agreement would entail an interference withthe fundamental rights to respect for private life under Article 7 (para. 125) and to the protection of personal dataunder Article 8 of the Charter (para. 126).Since Article 7 and Article 8 are not absolute rights (para. 136), the Court then examined whether suchinterferences could be justified. It found that the processing of PNR data under the Draft Agreement pursued adifferent objective from that for which it was collected by air carriers, and thus requires a different legal basis,such as separate consent by passengers or some other legal basis laid down by law (para. 143). The Court nextfound that an international agreement may meet the requirements of being a ‘law’ as defined in Article 8(2) andArticle 52(1) of the Charter (paras. 145-147). It went on to note that in this case such interferences are justifiedby the need to fight terrorism and serious transnational crime in order to ensure public security, and that thetransfer of PNR data to Canada and its subsequent processing may be appropriate to meet that objective (paras.151, 153).The CJEU then analysed the protections provided in the Draft Agreement, and had the following criticisms:–The Draft Agreement was not sufficiently precise in specifying the PNR data to be transferred (para. 163).–It did not provide sufficient protections for the transfer of sensitive data (which, under Article 8 of the Directive95/46, includes ‘racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-unionmembership’ or data processing concerning ‘a person’s health or sex life’) (para. 167). In addition, it stated that‘a transfer of sensitive data…requires a particularly solid justification, based on grounds other than the protectionof public security against terrorism and serious transnational crime’ (para. 165).–With regard to automated analyses of PNR data, because of the margin of error, any positive result must besubject to ‘individual re-examination by non-automated means’ before any measure adversely affecting apassenger is taken (para. 173).–Language permitting Canada to process PNR data on a case-by-case basis to ‘ensure the oversight oraccountability of the public administration’ and to ‘comply with the subpoena or warrant issues, or an order made,by a court’ lacked sufficient clarity and precision (para. 181).The Court also noted that the coverage of all air passengers flying between the EU and Canada is notunacceptably broad, particularly since Article 13 of Convention on Civil Aviation (the Chicago Convention) requiresignatories (which include Canada and all EU Member States, but not the EU itself) to comply with admissionand departure formalities of passengers from their territory, which can include security checks laid down byCanadian law (paras. 188-189).The Court then discussed at length the compatibility of the Draft Agreement with EU law requirements for dataretention. With regard to the retention and use of PNR data before the arrival of passengers, during their stay inCanada, and on their departure, the Court found that some elements of the retention of data under the DraftAgreement were acceptable, such as the use of data for security checks and border control checks (para. 197);verifying the reliability and topicality of models for the automated processing of data (para. 198); or cases when2/5data are collected by the Canadian authorities during the individuals’ stay in Canada indicating that use of it maybe necessary to combat terrorism and serious transnational crime (para. 199). However, the Court stated that theuse of PNR data should be subject to prior review by a court or an administrative body, and that otherwise it maybe found to go beyond what is strictly necessary (paras. 201-203).With regard to the retention and use of PNR data after passengers’ departure from Canada, the Court found thatit was not strictly necessary (paras. 206 and 211), but that it may be stored in Canada in cases where certainpassengers may present a risk of terrorism of serious transnational crime. It stated that the five-year retentionperiod in the Draft Agreement does not exceed the limits of what is strictly necessary (para. 209), but that use ofsuch data should be subject to prior review by a court or ‘independent administrative body’ (para. 208).With regard to the disclosure of PNR data to government authorities, the Court reiterated the standard it set forthin Schrems that data transfers to third countries require a level of protection that is ‘essentially equivalent’ to thatunder EU law (paras. 134 and 214), and held that this also applies to PNR transfers to Canada. The Court wenton to say that this requires either an international agreement between the EU and a third country, or anadequacy decision of the Commission (para. 214). It held that individuals must have a right to have their datarectified (para. 220), and that they must be notified individually when their data are used by a judicial authority orindependent administrative body (para. 223) unless this would jeopardise an investigation (para. 224). Finally,the Court held that the Draft Agreement did not sufficiently guarantee that oversight of compliance with its ruleswould be carried out by an independent authority within the meaning of Article 8(3) of the Charter (para. 231).Data protection and international agreementsOpinion 1/15 sets out for the first time the conditions under which international agreements may be used tolegalize international data transfers. Article 216(1) TFEU allows authority for the conclusion of an internationalagreement to be ‘provided for in a legally binding Union act’, which would allow EU legislation to set out criteriafor data protection agreements with third countries. However, no EU data protection legislation that I am aware ofdeals with the use of international agreements as a legal basis for the transfer of data, including the current EUData Protection Directive 95/46 or the EU General Data Protection Regulation that will replace the Directive inMay 2018 (with the exception of Recital 102 of the GDPR, which states somewhat feebly that internationalagreements must include ‘appropriate safeguards for the data subjects’). This seems like a missed opportunityby the EU legislator.The CJEU states that the transfer of PNR data from the EU to Canada may be satisfied either by an internationalagreement of the EU or by a Commission adequacy decision (para. 214), which raises the question of therelationship between the two, and seems to suggest that an adequacy decision may not always be necessary.The Court also provides an incentive for the expanded use of international agreements to transfer personal databy clarifying that they may meet the requirements of being a ‘law’ under Article 8(2) and Article 52(1) of theCharter. The Court’s affirmation of the possibility of using an international agreement to transfer data without anadequacy decision may lead to political tensions between the EU institutions in areas such as data sharing forlaw enforcement purposes, where the Commission now has the power to issue adequacy decisions under Article36 of the new ‘Police Directive’ 2016/680.Affirming the fundamental right to data protectionThe Court’s judgment in Opinion 1/15 generally followed Advocate General Mengozzi in extending its rulings incases such as Schrems and Joined Cases C-293/12 and C-594/12 Digital Rights Ireland  to internationalagreements. It also cites liberally to its relatively recent decision in Joined Cases C-203/15 and C-698/15 Tele2Sverige and Watson and Others, leaving no doubt that it views Tele2 as part of the mainstream of judgmentsaffirming the fundamental right to data protection. At the same time, the Court pulled back a bit from theprohibition in Tele2 against ‘general and indiscriminate retention’ of data (see para. 103 of that judgment), andfound that interference with the fundamental rights to privacy and data protection may, under the rightcircumstances, be justified by a general objective of the EU such as the fight against terrorism, even though thisinvolved a data retention period of five years.3/5In some parts of the judgment dealing with fundamental rights the Court seems hesitant to give clear direction.This can be seen, for example, in the section dealing with data retention (paras. 190-211), where the Courtstates rules, then exceptions to them, and then exceptions to the exceptions, so that even a careful reader mayhave difficulty understanding exactly what it means. One can only conclude that any parties having to apply thejudgment in practice (such as law enforcement authorities) may be left scratching their heads.Implications for other international agreementsThe Court found that the correct legal bases for Draft Agreement were Article 16(2) TFEU and Article 87(2)(a)TFEU, but not Article 82(1)(d) TFEU. This could spell trouble for other PNR agreements of the EU that rely onArticle 82(1)(d) TFEU as a legal basis, such as those with Australia and the United States. It may also createrisks for the EU-US Privacy Shield, given that the Court was critical of supervision under the Draft Agreement asbeing carried out ‘by an authority which does not carry out its tasks with complete independence’ (para. 68), apoint on which the Privacy Shield has also been criticized. Finally, it seems that many international agreementsof the EU could potentially be open to challenge in light of the strict standard the Court applied.Third country law in the CJEUThe judgment throws further light on how the Court deals with third country law in its data protection cases,which I have commented on elsewhere. The interpretation of Canadian law was crucial to the Court’s judgmentas to whether it fulfilled the criteria of EU law that were the substance of the European Parliament’s questions,and from what I have been told, there were significant disagreements between the European Parliament andsome of the Member States about issues of Canadian law.The Opinion of Advocate General Mengozzi shows that the Court used different sources to gain informationabout Canadian law, including explanations by the European Commission (para. 318 of his Opinion), Canadiangovernment web sites (footnote 92), and a letter from the Canadian Mission to the EU (para. 312), but this hardlyseems sufficient given the importance of the case. One can ask why the Court didn’t take expert evidence orconduct further investigation into Canadian law and practice, which is permissible in opinions (see Articles 196-200 of the Rules of Procedure of the Court of Justice  applicable to opinions). Indeed, the Court states that it didput a number of questions in writing to the Member States and the European Data Protection Supervisor, thoughit does not explain what they concerned (para. 45).ConclusionsThe judgment has narrowed the EU’s leeway to negotiate international agreements in a variety of importantareas involving the transfer of personal data, such as international trade, data sharing with third countries, andarrangements post Brexit. It also demonstrates the difficulties caused by the failure to deal more explicitly in EUlegislation with the place of international agreements in the data protection framework.The political implications of the judgment are also significant. By examining the Draft Agreement in such minutedetail, both the Court and the Advocate General in effect performed a redline revision of it. In the judgment, thiswent into such a level of detail that the Court objected to the use of the term ‘etc.’ in one heading of the Annex tothe Draft Agreement referring to PNR data elements, which reads ‘Available frequent flyer and benefitinformation (free tickets, upgrades, etc.)’ (para. 157).One wonders how many international agreements of the EU could withstand this degree of second-guessing. Itis in the nature of international agreements that they tend to be finely-balanced, with a concession in oneprovision offset by a gain in another one. Following the judgment, some third countries may be hesitant to investthe time and resources necessary to conclude an international agreement on data protection with the EUknowing that it may later be picked apart by the Court. The ultimate effects of the judgment will be seen in thecoming years as the EU seeks to negotiate further agreements on data protection and data sharing with thirdcountries and international organisations.4/5LICENSED UNDER CC BY NC NDSUGGESTED CITATION  Kuner, Christopher: Data Protection, Data Transfers, and International Agreements:the CJEU’s Opinion 1/15, VerfBlog, 2017/7/26, http://verfassungsblog.de/data-protection-data-transfers-and-international-agreements-the-cjeus-opinion-115/.5/5

Data Protection, Data Transfers, and International Agreements: the CJEU’s Opinion 1/15

https://intr2dok.vifa-recht.de/servlets/MCRFileNodeServlet/mir_derivate_00002259/verfassungsblog.de-Data%20Protection%20Data%20Transfers%20and%20International%20Agreements%20the%20CJEUs%20Opinion%20115.pdf

Data Protection, Data Transfers, and International Agreements: the CJEU’s Opinion 1/15

Abstract

Similar works

Full text

Available Versions

<intR>²Dok