Safe Harbor Framework Under Stress

Headnote:

In a non-binding but persuasive opinion provided to the European Court of Justice, the Advocate General argued that (1) member state data protection authorities should be free to suspend data flows under the EU-US Safe Harbor and (2) that the Court should declare the Safe Harbor adequacy decision invalid.

Summary:

On Wednesday morning, Advocate General Yves Bot issued his opinion in the Schrems v. Data Protection Commissioner case currently pending before the European Court of Justice. The Advocate General opinion, though not formally binding on the Court, is generally considered highly persuasive and the Court tends to reach the same conclusion as the Advocate General in the majority of cases.

The Advocate General argued that the Court should come to two conclusions that would undermine the Safe Harbor. First, the Advocate General argued that the Data Protection Directive gives each member state data protection authority the right and the obligation to investigate complaints that call into question the “adequacy” decisions made by the European Commission. Relying on language in the Directive that describes the data protection authorities as independent “guardians of fundamental rights,” the Advocate General argued that these authorities should be free “to investigate, with complete independence, the complaints submitted to them, in the higher interest of the protection of individuals with regard to the processing of personal data.” After reviewing the interplay between the Directive and the Commission’s decision declaring the E.U.-U.S. Safe Harbor “adequate,” the Advocate General concluded that “[i]n other words, the national supervisory authorities must be able to carry out their investigations and, where appropriate, suspend the transfer of data, irrespective of the restrictive conditions laid down in [the Safe Harbor Decision].”

Second, the Advocate General considered whether the Safe Harbor decision should be allowed to continue in force. Although the Advocate General noted that that “Mr. Schrems has not formally contested in the main proceedings . . . the validity of [the Safe Harbor Decision], it is clear from that order for reference that Mr. Schrems’ main criticism seeks to challenge the finding that the United States ensures, under the safe harbour scheme, an adequate level of protection of the personal data transferred.” Accordingly, the Advocate General assessed the Safe Harbor framework against the requirements of the Data Protection Directive.

After reviewing the scope of the Safe Harbor and its various derogations for law enforcement activity and compliance with US laws, the Advocate General declared that he was “of the view that [the Safe Harbor decision] must be declared invalid since the existence of a derogation which allows in such general and imprecise terms the principles of the safe harbour scheme to be disregarded prevents in itself that scheme from being considered to ensure an adequate level of protection of the personal data which is transferred to the United States from the European Union.” The Advocate General continued, evaluating the role of the FTC, independent dispute resolution bodies, and the Foreign Intelligence Surveillance Court, before concluding that these bodies were not able to guarantee the “fundamental rights” of EU citizens. Accordingly, the Advocate General argued that the “decision must therefore be declared invalid since, owing to the breaches of fundamental rights described above, the safe harbour scheme which it establishes cannot be regarded as ensuring an adequate level of protection of the personal data transferred from the European Union to the United States under that scheme.”

The Advocate General also rejected the European Commission’s argument that the Safe Harbor decision should continue in force until negotiations for a new Safe Harbor scheme could be completed. The Advocate General reasoned that the Commission “was aware of shortcomings in the application” of the Safe Harbor, and faulted the Commission because it “neither suspended nor adapted that decision, thus entailing the continuation of the breach of the fundamental rights of the persons whose personal data was and continues to be transferred under the safe harbour scheme.” The Advocate General felt this was “an additional ground on which to declare [the Safe Harbor decision] invalid” in the current proceeding before the Court.

As noted previously, the Advocate General’s opinion is not directly binding on the Court of Justice. A formal opinion from the Court usually follows a few months after the Advocate General’s opinion. The Advocate General’s opinion may also impact the ongoing negotiations between the EU Commission and the United States related to a new version of the Safe Harbor. On a related front, negotiators recently finalized an “Umbrella Agreement” between the United States and the EU covering requests for personal information related to criminal investigations. This agreement will be effective once Congress passes the Judicial Redress Bill. In addition to these international discussions, trialouge negotiations between the European Union’s Commission, Council and Parliament around the proposed Data Protection Regulation began over the summer, and are expected to conclude before the end of the year.

Please contact your usual Drinker Biddle lawyer for more information, or reach out to Peter Blenkinsop or Mary Devlin Capizz.