Privacy & Information Security Law Blog

On September 23, 2015, Advocate General of the European Court of Justice Yves Bot issued his Opinion in the case of Max Schrems, which is currently pending before the Court of Justice of the European Union (the “CJEU”). In the opinion, the Advocate General provided his views concerning two key issues related to the U.S.-EU Safe Harbor Framework: (1) the powers of national data protection authorities to investigate and suspend international data transfers made under the Safe Harbor Framework and (2) the ongoing validity of the European Commission’s Safe Harbor adequacy decision (Decision 2000/520).

Powers of National Data Protection Authorities

The Advocate General stated that a decision by the European Commission on the adequacy of the level of data protection provided by a country outside of the EU does not eliminate or reduce the powers granted to the national data protection authorities (“DPAs”) under the EU Data Protection Directive 95/46/EC (“Data Protection Directive”). Consequently, national DPAs have the power to investigate transfers of personal data to a country outside of the EU (such as the U.S.) if the DPAs think the transfer undermines the protection of European citizens’ rights with respect to the protection of their personal data, regardless of the existence of an adequacy decision of the European Commission (such as the Commission’s Safe Harbor Decision). Where such investigation reveals systematic deficiencies in the level of data protection provided by the country to which the personal data are transferred, relevant DPAs must be able to take the necessary steps to safeguard the fundamental rights of EU citizens, such as suspending data transfers to the relevant country.

Validity of U.S.-EU Safe Harbor Framework

Although the question was not specifically referred to the CJEU, the Advocate General concluded that the CJEU also should make a decision on the validity of the Commission’s adequacy decision. The Advocate General stated that it is apparent from the findings of the Irish High Court and the Commission itself that the law and practice of the U.S. permit the large-scale collection of EU citizens’ personal data, without providing effective judicial protection to EU citizens. According to the Advocate General, this demonstrates that the U.S.-EU Safe Harbor Framework does not provide sufficient guarantees for the protection of the rights of EU citizens granted under the Data Protection Directive and the EU Charter of Fundamental Rights. Although the Safe Harbor Framework provides limited derogations allowing the use of transferred data for law enforcement purposes and the protection of national security, the Advocate General stated that the mass and indiscriminate surveillance carried out by U.S. intelligence services is a disproportionate interference with the fundamental rights of EU citizens. According to the Advocate General, the U.S.-EU Safe Harbor Framework also does not provide sufficient guarantees against such mass and indiscriminate surveillance as no independent authority in the U.S. is able to monitor breaches of the Safe Harbor principles committed by public authorities, such as U.S. security agencies. Therefore, the Advocate General concluded that the European Commission should suspend the application of the Safe Harbor Decision, as the level of protection provided by the U.S. for data transferred under the U.S.-EU Safe Harbor Framework is no longer adequate.

Next Steps

The CJEU will now begin its deliberation in the Schrems case and the final judgment is expected in the coming months. Although the CJEU will take into account the Advocate General’s opinion, it is not legally binding on the Court. It is yet to be seen whether the CJEU will reach the same conclusions as the Advocate General on the powers of the national DPAs, and comment on the ongoing validity of the U.S.-EU Safe Harbor Framework. After the CJEU has issued a final judgment, the Irish High Court will decide the Schrems case in accordance with the CJEU’s ruling.

In the interim, it is likely that this Opinion will increase the pressure on U.S. and EU government authorities to reach agreement on a revised U.S.-EU Safe Harbor Framework. The U.S.-EU Safe Harbor Framework remains a valid mechanism for the transfer of personal data to the U.S. pending the decision of the CJEU.

View the full text of the Advocate General’s Opinion.

For a summary, please see the press release of the CJEU.