Article 7 - Respect for private and family life
Article 8 - Protection of personal data
Article 47 - Right to an effective remedy and to a fair trial
Key facts of the case:
Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Regulation (EU) 2016/679 — Article 2(2) — Scope — Transfers of personal data to third countries for commercial purposes — Article 45 — Commission adequacy decision — Article 46 — Transfers subject to appropriate safeguards — Article 58 — Powers of the supervisory authorities — Processing of the data transferred by the public authorities of a third country for national security purposes — Assessment of the adequacy of the level of protection in the third country — Decision 2010/87/EU — Protective standard clauses on the transfer of personal data to third countries — Suitable safeguards provided by the data controller — Validity — Implementing Decision (EU) 2016/1250 — Adequacy of the protection provided by the EU-US Privacy Shield — Validity — Complaint by a natural person whose data was transferred from the European Union to the United States.
Outcome of the case:
I propose that the Court answer the questions for a preliminary ruling referred by the High Court, Ireland, as follows:
Analysis of the questions for a preliminary ruling has disclosed nothing to affect the validity of Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council, as amended by Commission Implementing Decision (EU) 2016/2297 of 16 December 2016.
81) It will be recalled that the Court held, in paragraph 63 of that judgment, that a supervisory authority is required to deal with all due diligence with a complaint in which a person whose personal data have been or could be transferred to a third country which has been the subject of an adequacy decision disputes the compatibility of that decision with the fundamental rights enshrined in the Charter. In the words of paragraph 65 of that judgment, where the supervisory authority considers that the objections advanced in that complaint are well founded, it must, in accordance with the third indent of the first subparagraph of Article 28(3) of Directive 95/46 (to which Article 58(5) of the GDPR corresponds), read in the light of Article 8(3) of the Charter, be able to engage in legal proceedings. In that regard, it is incumbent upon the national legislature to provide for legal remedies enabling the person concerned to put forward those objections before the national courts in order for them, if they share the supervisory authority’s doubts, to make a reference for a preliminary ruling on the validity of the decision at issue.
82) Like the referring court, I consider that those findings apply by analogy when a supervisory authority, when assessing a complaint brought before it, doubts the validity not of an adequacy decision but of a decision, such as Decision 2010/87, setting out standard contractual clauses for the transfer of personal data to third countries. Contrary to the view put forward by the German government, it is not determinative that those doubts are raised by the complainant in arguments before the supervisory authority or that that authority questions, of its own motion, the validity of the decision at issue. In fact, the requirements arising under Article 58(5) of the GDPR and Article 8(3) of the Charter, on which the Court’s reasoning is based, apply irrespective of the legal basis of the transfer referred to in the complaint lodged with the supervisory authority and of the reasons leading that authority to question the validity of the decision at issue in the context of the adjudication of that compliant.
...
109) The reasoning and the conclusions adopted by the Court in the judgment in Schrems are also based on that premiss. In particular, in that judgment the Court evaluated the validity of the ‘safe harbour’ decision with regard to Article 25(6) of Directive 95/46 read in light of the Charter in so far as that decision concerned transfers of personal data to the United States where they might be collected and processed for national security protection purposes. ( 41 )
112) It observes that, in the judgment in Schrems, the Court interpreted Article 25(6) of Directive 95/46 (the content of which is essentially reproduced in Article 45(3) of the GDPR), in that it provided that the Commission can adopt an adequacy decision only after it has ensured that the third country concerned guarantees an adequate level of protection, as supposing that the Commission establish that that country ensures a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union by virtue of that directive, read in the light of the Charter. ( 42 )
115) Like the DPC, Mr Schrems and Ireland, I consider that the ‘appropriate safeguards’ provided by the controller or processor to which Article 46(1) of the GDPR refers must ensure that the rights of the persons whose data are transferred benefit, as in the context of a transfer based on an adequacy decision, from a level of protection essentially equivalent to that which follows from the GDPR, read in the light of the Charter.
117) Articles 45 and 46 of the GDPR are aimed at ensuring the continuity of the high level of protection of personal data ensured by that regulation when they are transferred outside the European Union. In fact, Article 44 of the GDPR, entitled ‘General principle for transfers’, opens Chapter V, on transfers to third countries, by announcing that all the provisions in that chapter are to be applied in order to ensure that the level of protection guaranteed by the GDPR is not undermined where data are transferred to a third State. ( 44 ) That rule is designed to ensure that the standards of protection resulting from EU law are not circumvented by transfers of personal data to a third country for the purpose of being processed there. ( 45 ) Having regard to that objective, it is immaterial that the transfer is based on an adequacy decision or on guarantees provided by the controller or processor, in particular by means of contractual clauses. The requirements of protection of fundamental rights guaranteed by the Charter do not differ according to the legal basis for a specific transfer. ( 46 )
158) To my mind, however, that objection cannot justify a finding that Decision 2010/87 is incompatible with Article 47 of the Charter. The validity of that decision does not depend on the level of protection that exists in each third country to which data might be transferred on the basis of the standard contractual clauses which it sets out. If the law of the third State of destination prevents the importer from complying with those clauses by requiring it to grant those authorities access to the data without any possibility of an appropriate remedy, it is for the supervisory authorities, where the exporter has not suspended the transfer pursuant to Clause 5(a) or (b) in the annex to Decision 2010/87, to adopt corrective measures.
160) As is clear from all of those considerations, my analysis has not revealed any element of such a kind as to affect the validity of Decision 2010/87 by reference to Articles 7, 8 and 47 of the Charter.
180) In addition, in ruling on the problems described above, the Court would to my mind disrupt the normal course of the procedure that will have to take place after it has delivered its judgment in the present case. In the context of that procedure, the DPC will be required to deal with Mr Schrems’ complaint taking account of the answer that the Court will give to the eleventh question. If the Court deems, as I propose and contrary to what the DPC has maintained before it, that Decision 2010/87 is not invalid by reference to Articles 7, 8 and 47 of the Charter, the DPC should in my view be given the opportunity to re-examine the file in the procedure pending before her. If the DPC should consider that she is not in a position to adjudicate on Mr Schrems’ complaint unless the Court first determines whether the ‘privacy shield’ decision constitutes an obstacle to her powers to suspend the transfer at issue, and confirm that she entertains doubts as to the validity of that decision, it would be open to her to bring the matter before the national courts again in order for them to make a reference to the Court on that point. ( 75 )
181) That would initiate a procedure allowing any party referred to in the second paragraph of Article 23 of the Statute of the Court to submit observations to the Court relating specifically to the question of the validity of the ‘privacy shield’ decision, identifying, where appropriate, the particular assessments which he disputes and the reasons why in his view the Commission exceeded the reduced discretion at its disposal. ( 76 ) In the context of such a procedure, the Commission would have the opportunity to respond precisely and in detail to each of the criticisms that might be directed against that decision. Although the present case has already given the parties and interested persons who have submitted observations to the Court the opportunity to discuss certain relevant aspects for the purpose of evaluating the compatibility of the ‘privacy shield’ decision with Articles 7, 8 and 47 of the Charter, that question, in view of what is at stake, is deserving of a thorough and exhaustive exchange.
205) In accordance with Article 51(1), the Charter applies to the Member States only when they are implementing Union law. Consequently, the validity of an adequacy decision having regard to the restrictions on the exercise of the data subjects’ fundamental rights originating in the rules of the third country of destination depends on a comparison between those restrictions and the restrictions which the provisions of the Charter allow the Member States to impose solely in so far as similar rules of a Member State fall within the scope of EU law.
209) The answer to that question requires that the standards — namely those derived from the Charter, or indeed from the ECHR — to which rules applicable to the surveillance of electronic communications comparable to those which the Commission examined in the ‘privacy shield’ decision must correspond, within the Union, be identified in advance. The determination of the applicable standards depends on whether rules such as section 702 of the FISA and EO 12333 would, if they emanated from a Member State, fall within the limitation placed on the scope of the GDPR pursuant to Article 2(2) of that regulation, read in the light of Article 4(2) TEU.
223) I conclude that, following the reasoning adopted by the Court in the judgments in Tele2 Sverige and Ministerio Fiscal, the GDPR and therefore the Charter apply to national rules that require a provider of electronic communications services to lend its assistance to the authorities responsible for national security by making data available to them, where appropriate after having filtered them, even independently of any legal obligation to retain the data.
224) In addition, that interpretation seems to follow, at least implicitly, from the judgment in Schrems. As the DPC, the Austrian and Polish Governments and the Commission have emphasised, the Court, when examining the validity of the ‘safe harbour’ decision, held in that judgment that the law of the third country to which an adequacy decision relates must provide, against the interferences by its public authorities with data subjects’ fundamental rights for national security purposes, safeguards essentially equivalent to those arising under, in particular, Articles 7, 8 and 47 of the Charter. ( 104 )
226) Conversely, once those data have come into the possession of the State authorities, the retention and subsequent use of those data by those authorities for national security purposes are in my view, for the same reasons as those set out in point 211 of this Opinion, covered by the derogation provided for in Article 2(2) of the GDPR and therefore do not come within the scope of that regulation or, accordingly, of the Charter.
228) It will be necessary, in the first place, to examine whether the United States ensures a level of protection essentially equivalent to that which follows from the provisions of the GDPR and the Charter against the restrictions resulting from the application of section 702 of the FISA, in that that provision allows the NSA to require providers to make personal data available to it.
249) It also follows from that judgment, in my view, that the law of the third State of destination may reflect its own scale of values according to which the respective weight of the various interests involved may diverge from that attributed to them in the EU legal order. Moreover, the protection of personal data that prevails within the European Union meets a particularly high standard by comparison with the level of protection in force in the rest of the world. The ‘essential equivalence’ test should therefore in my view be applied in such a way as to preserve a certain flexibility in order to take the various legal and cultural traditions into account. That test implies, however, if it is not to be deprived of its substance, that certain minimum safeguards and general requirements for the protection of fundamental rights that follow from the Charter and the ECHR have an equivalent in the legal order of the third country of destination. ( 115 )
250) In that regard, in accordance with Article 52(1) of the Charter, any limitation on the exercise of the rights and freedoms recognised by the Charter must be provided for by law and respect the essence of those rights and freedoms and, subject to the principle of proportionality, be necessary and actually correspond to an objective of general interest recognised by the Union or the need to protect the rights and freedoms of others. Those requirements correspond essentially to those set out in Article 8(2) of the ECHR. ( 116 )
251) In accordance with Article 52(3) of the Charter, in so far as the rights guaranteed in Articles 7, 8 and 47 correspond to those enshrined in Articles 8 and 13 of the ECHR, they share their meaning and scope, it being understood that EU law may nonetheless afford them wider protection. From that aspect, and as my narrative will reveal, the standards resulting from Articles 7, 8 and 47 of the Charter, as interpreted by this Court, are in certain respects stricter than those arising under Article 8 of the ECHR according to the interpretation of those provisions by the European Court of Human Rights (‘the ECtHR’).
253) Having made that clear, I shall now examine the validity of the ‘privacy shield’ decision by reference to Article 45(1) of the GDPR, read in the light of the Charter and the ECHR in that they guarantee the rights to respect for private life and to the protection of personal data (section (b)) and to effective judicial protection (section (c)).
278) As I shall explain in greater detail below, ( 154 ) I tend to share those doubts as to the sufficiency of the framework of the choice of selectors for the purposes of meeting the criteria of foreseeability and proportionality of the interferences. However, the existence of that framework, imperfect though it may be, precludes the conclusion that section 702 of the FISA permits generalised access by the public authorities to the content of the electronic communications and thus amounts to a breach of the very essence of the right enshrined in Article 7 of the Charter.
279) I would also emphasise that, in Opinion 1/15, the Court considered that the essence of the right to protection of personal data, guaranteed in Article 8 of the Charter, is preserved when the purposes of the processing are limited and the processing is accompanied by rules designed to ensure, inter alia, the security, confidentiality and integrity of the data, and also to protect them against unlawful access and processing. ( 155 )
301) In the light of those considerations, it is not certain that, on the basis of the elements set out in the ‘privacy shield’ decision, the surveillance measures based on section 702 of the FISA are accompanied by safeguards, relating to the limitation of persons who might be subject to a surveillance measure and of the objectives for the purpose of which data may be collected, that are essentially equivalent to those required under the GDPR, read in the light of Articles 7 and 8 of the Charter. ( 180 )
308) In those circumstances, I have doubts about the validity of the finding that the United States guarantees, in the context of the activities of their intelligence services on the basis of section 702 of the FISA and EO 12333, an adequate level of protection within the meaning of Article 45(1) of the GDPR, read in the light of Articles 7 and 8 of the Charter and of Article 8 of the ECHR.
342) In the light of all of the foregoing considerations, I entertain certain doubts as to the conformity of the ‘privacy shield’ decision to Article 45(1) of the GDPR, read in the light of Articles 7, 8 and 47 of the Charter and of Article 8 of the ECHR.
