(Judgement of the Court of Justice of the EU in case С-362/14, Schrems)
Katina Boncheva
On October 6, 2015 the Court of Justice of the EU (CJEU) annulled the Commission’s Decision of July 26, 2000, according to which the United States of America (USA) ensure adequate protection of personal data, through the so-called “Safe Harbour Privacy Principles”. The Decision was adopted under Article 25, paragraph 6 of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, empowering the Commission to find that a third country outside the European Union ensures an adequate level of protection of privacy and of fundamental freedoms and rights of individuals. Such an ascertainment enables the transfer of personal data from the European Union to this third country.
The Court clearly stated that the mass and undifferentiated public authorities’ access to the content of electronic communications is a violation of the core of the right to privacy protected by Article 7 of the Charter of Fundamental Rights of the European Union (the Charter). Thus, during the heavy moral and political crisis in the Union, in a time of terrorism and populism, the Court recalled what the true European values are- basic but fragile human rights and freedoms.
The decision finds that when national supervisory authorities are dealing with a claim concerning the protection of individual’s rights and freedoms in regard to the processing of personal data and it is contested in the bringing of the claim, as in the main proceedings, the compatibility of that decision with the protection of the privacy and of the fundamental rights and freedoms of individuals, it is incumbent upon the national supervisory authority to examine the claim with all due diligence.
If a national supervisory authority comes to the conclusion that the arguments put forward in support of such a claim are unfounded and therefore rejects it, the person who lodged the claim must, as is apparent from the second subparagraph of Article 28(3) of Directive 95/46, read in the light of Article 47 of the Charter, have access to judicial remedies enabling him to challenge such a decision adversely affecting him before the national courts. t. If the court considers that there are grounds for invalidity of the Commission’s decision, it must stay the proceedings and refer to the Court for a preliminary ruling on its validity.
If however the national supervisory authority considers that the claim is well founded that authority must be able to engage in legal proceedings and it is incumbent upon the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers as well founded before the national courts in order for them, if they share its doubts as to the validity of the Commission decision, to make a reference for a preliminary ruling for the purpose of examination of the decision’s validity.
The Court interpreted the meaning of the term “adequate protection” as used in Article 25, paragraph 2 and 6 of Directive 95/46/EC. The court accepts the Advocate General’s opinion, according to which the term “should be interpreted as meaning that the third party is required to effectively guarantee under its domestic law or its international commitments, level of protection of fundamental rights and freedoms which is essentially equivalent to the level guaranteed in the EU under Directive 95/46/EC, read in conjunction with the Charter.” According to ECJ, from the express wording of Article 25, paragraph 6 of Directive 95/46/EC follows that precisely the legal order of the third party to which the decision of the Commission is aimed at must ensure an adequate level of protection equivalent to the level guaranteed in the Union. Therefore, in the adoption of decisions under Article 25, paragraph 6 of the Directive, the Commission must assess the content of the applicable third party domestic legislation, its international commitments and judicial practice. The Commission should periodically examine whether the findings of “sufficient protection” are still valid and substantiated from factual and legal point of view.
The CJEU found that legal order allowing for mass and undifferentiated access of public bodies to the content of personal electronic communication must be viewed as violating the core substance of the fundamental right to respect for private and family life which is protected under articles 7 and 8 of the Charter. In addition, any legal order not providing legal means for the protection of individual’s access to pertinent personal data as well as the ability to edit or to delete such personal data is to be treated as violating the core substance of the fundamental right to an effective remedy and to a fair trial under article 47 of the Charter. In this regard the actual presence of effective judicial remedies guaranteeing compliance with EU law is inherently needed for the rule of law in the given country.
Based on the above the Court finds that the Commission has not met its obligation to come up with a duly motivated ascertainment that USA in its domestic law or international commitments effectively ensures adequate level of protection. This is why the CJEU has found article 1 of the decision of 26th of July 2000 invalid.
The Court finds article 3 of the Decision of 26th of July2000 invalid too because by adopting it the Commission has exceeded the scope of its competency powers. Having regard to the well-established independent decision making powers of national supervisory authorities the Court finds that this article denies them of their powers derived from article 28 of Directive 95/46/EO because it excludes the possibility of them taking action on domestic level to ensure compliance with article 25 of that Directive.
Due to the inseparability of articles 1 and 3 from articles 2 and 4 of the Decision of 26th of July 2000 the CJEU found that the entire decision was invalid.
***
Link to the article in Bulgarian language: SAFE HARBOUR OR PEARL HARBOUR?
***