Antitrust Law Daily Wrap Up, PRIVACY NEWS: EU Court of Justice declares EC’s U.S. Safe Harbor Framework decision invalid, (Oct 6, 2015)

By Linda O’Brien, J.D., LL.M.

The Court of Justice of the European Union has declared invalid a 2000 decision of the European Commission (EC), finding that a third country ensured an adequate level of protection of personal data transferred to that country under the Safe Harbor Framework, according to an announcement today. The Court ruled that the existence of the EC decision could not reduce or eliminate the power of national supervisory authorities under the Charter of Fundamental Rights of the European Union and Data Protection Directive of the European Parliament to protect personal data.

Maximillian Schrems, an Austrian citizen, was a user of the online social networking service Facebook since 2008. Data provided by Schrems to Facebook was transferred from Facebook’s Irish subsidiary to servers located in the United States. Schrems filed a complaint with the Irish supervisory authority, the Data Protection Commissioner, contending that, in light of 2013 disclosures concerning the activities of U.S. intelligence services, the law and practice of the United States did not offer sufficient protection against surveillance by public authorities of data transferred to that country. The Irish authority rejected the complaint on the ground that a decision of the EC in July 2000 found that under the Safe Harbor Framework the United States ensured an adequate level of protection of personal data transferred to that country.

Schrems appealed to the High Court of Ireland, which requested a preliminary ruling on whether the EC decision had the effect of preventing the Irish authority from investigating the complaint that the third country did not ensure an adequate level of protection and, where appropriate, from suspending the contested transfer of data.

The Court of Justice held that where a claim is filed with national supervisory authorities, they may examine whether the transfer of a person’s data to a third country complies with the requirements of EU legislation on privacy protection even where the EC has adopted a decision finding that third country affords an adequate level of protection of personal data. No provision of the Directive prevents oversight by the national supervisory authorities of transfers of personal data to third countries which have been the subject of a Commission decision. Even if the EC adopted a decision, the national supervisory authorities, when dealing with a claim, must be able to examine with complete independence whether the transfer of a person’s data to a third country complies with the requirements set forth in the Directive.

The EC was required to find that the United States in fact ensured, by its domestic law or international commitments, a level of protection of fundamental rights essentially equivalent to those guaranteed within the EU under the Directive read in light of the Charter. The Commission did not make such a finding, but merely examined the safe harbor scheme. National security, public interest, and law enforcement requirements of the United States prevail over the safe harbor scheme and enables interference by U.S. public authorities with the fundamental rights of persons when the protective rules set forth in that scheme conflict with such requirements, the Court observed.

The Court also noted that the EC’s safe harbor decision denies the national supervisory authorities their powers where a person calls into question whether the decision is compatible with the protection of privacy and the fundamental rights and freedoms of individuals. The EC did not have the competence to restrict the national supervisory authorities’ powers in that manner. As a result of the Court’s judgment, the Irish supervisory authority is required to examine Schrems’ complaint with due diligence and decide whether the transfer of the data of Facebooks’ European subscribers to the United States should be suspended on the ground that the U.S. does not afford an adequate level of protection of personal data.

“We are reviewing the European Court of Justice's opinion and evaluating its implications. We share the commitment of our EU counterparts to protect consumers' personal information and privacy,” FTC Chairwoman Edith Ramirez commented in a statement. “The Federal Trade Commission has worked closely with the Department of Commerce and our European partners on enforcing and improving the Safe Harbor Framework, and FTC enforcement actions have helped safeguard the privacy of many European consumers. We will continue to work together with our European colleagues to develop effective solutions that protect consumer privacy with respect to cross-border data transfers."

Companies: Digital Rights Ireland Ltd.

News: Privacy