Jusletter IT

In July 2018, the European Parliament (EP) passed a resolution stating that the Privacy Shield,² the adequacy decision authorising transfers of personal data to the US, did not protect personal data sufficiently. The EP’s criticism was largely driven by revelations surrounding illicit data transfers and processing at Cambridge Analytica and Facebook (both certified under the Privacy Shield).³ The resolution put forward a deadline for the European Commission (EC) to suspend all transfers under the Shield should its flaws not be fixed until 1 September 2018. Similar remarks were made by the Article 29 Working Party (WP29), who in its opinion on the first annual review, also urged the EC to suspend the Shield if there is no improved compliance of some key provisions by October 2018.⁴ At the same time, the freshly adopted draft for an adequacy decision on Japan faced heavy scrutiny by the European Data Protection Board (EDPB), also revealing disagreement with the EC on how to assess adequacy.⁵

The Schrems case set forward the condition that a third country must be «essentially equivalent» compared to the system of fundamental rights protection within the CFR to be considered adequate.⁶ The GDPR,⁷ and the CJEU⁸ have tried to further clarify this standard of essential equivalence. However, a clear definition has not emerged. This contribution therefore tries to propose a definition for the standard of equivalence for GDPR adequacy decisions and an outline how to ensure that an adequacy assessment is based on the CFR.⁹

Art. 44 GDPR lays down the principle that data transfers can only take place if the GDPR is complied with, meaning that in general the GDPR restricts such transfers, unless its conditions are fulfilled. The goal of these rules is to ensure that the level of protection provided in the GDPR is not undermined.¹⁰ The GDPR offers three venues for transfers, adequacy decisions (Art. 45), appropriate safeguards (Arts. 46 and 47) and derogations (Art. 49).¹¹ This paper focuses solely on adequacy decisions.

Adequacy decisions have to be taken by the EC. They can concern a whole third country, a territory of it, a specified sector within it or an international organisation. The GDPR provides a list of elements the EC has to consider in Art. 45(2) GDPR, which include respect for fundamental rights (Art. 45(2)(a)), independent supervisory authorities (Art. 45(2)(b)), and international commitments to data protection (Art. 45(2)(c)). All 12 adequacy decisions made under the Data Protection Directive (DPD) remain valid until replaced (Art. 45(9)).¹² Rec. 104 states that adequacy means that a third country has «an adequate level of protection essentially equivalent to that ensured within the Union», this standard of equivalence was developed by the CJEU in Schrems (see next section).

The CJEU decision in Schrems clarified some aspects about the content of adequacy and put forward the standard of essential equivalence for transfers. The case was based on the complaint of an Austrian law student Maximillian Schrems questioning whether his data with Facebook, where he had created a profile, was protected in a way that satisfied EU data protection law. He doubted such protection since his data was likely being transferred to the Facebook headquarters in the US, where considering the Snowdon revelations,¹³ unlimited access by US intelligence agencies seemed probable. As the CJEU summarised, Schrems challenged the Safe Harbour Principles, ¹⁴ that pronounced the US system adequate for certain transfers.¹⁵

In its decision, the CJEU declared the Safe Harbour Principles invalid, forcing the EC to undergo a new adequacy process with the US, which resulted in the Privacy Shield. The most important finding the CJEU made on adequacy is that it set a high standard for a third country to reach it, the «standard of essential equivalence»: «[T]he term ‹adequate level of protection› must be understood as requiring the third country in fact to ensure, by reason of its domestic law or its international commitments, a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union by virtue of Directive 95/46 read in the light of the Charter».¹⁶ With this, the CJEU arguably puts forward at least three conditions for an adequacy decision:¹⁷ a result-driven assessment, a level of protection of fundamental rights in the third country similar to the CFR and need for a detailed assessment of domestic law and international commitments.

The CJEU proscribes a result-driven assessment by its contradictory statement, that a foreign country does not need identical protection but essential equivalent protection of fundamental rights. As «identical» is often considered a synonym for «equivalent»,¹⁸ «identical» has to be interpreted as referring to identical legislative tools, while «equivalent» must then mean achieving the same result potentially using other means.¹⁹ Such an interpretation is supported by the CJEU assertion that the means for achieving essential equivalence might differ as long as they prove to be effective in practice.²⁰

A second step is to define the result that needs to be achieved with said result-driven assessment. According to the CJEU, the result needs to be «a level of protection of fundamental rights and freedoms (…) essentially equivalent to (…) Directive 95/46 read in light of the Charter». In this authors opinion, the CJEU is trying to assert, that first, the relevant source for EU fundamental rights is the CFR and secondly, not all fundamental rights of the CFR are relevant for the adequacy assessment, but only those that can be sufficiently linked to EU data protection legislation (then the DPD).²¹ The use of the plural for fundamental rights by the CJEU is intentional. It is not «just» the right of data protection or «just» the right of privacy of the CFR that need to be considered, but all fundamental rights that can be linked to data protection.²²

The final part of the CJEU’s conditions for adequacy states that adequacy must be guaranteed by «domestic law or international commitments». This part served as the main argument for the CJEU in Schrems to invalidate Safe Harbour.²³ This condition sets forth the requirement to sufficiently look at the domestic law and international commitments of the third country being assessed. Judging from the criticism on Safe Harbour in Schrems, it should include a fairly complete listing of relevant legislation including an explanation how they apply in practice. It also includes to a certain extent, an obligation of the third country to report on relevant legislative developments.²⁴

The standard of equivalence established in Schrems, does not include details on how such an adequacy assessment should take place. This is partly justified, since it is a result-orientated analysis, an exact procedure for adequacy would only leave little room for different means to achieve the necessary fundamental rights protection.²⁵ However, since the result of essential equivalence should be a high protection of fundamental rights, those fundamental rights themselves require that the adequacy process includes certain elements. After analysing the GDPR, EU fundamental rights law and Opinion 1/15, this author puts forward that the CFR requires the GDPR adequacy assessment to include three elements to anchor it within the EU fundamental rights system: an identification of the fundamental right(s) at stake in an adequacy decision, linking these fundamental rights to data protection with analysis of the additional elements of Art. 8 (meaning Arts. 8(2) and (3) CFR)),²⁶ and finally an analysis of the adequacy decision as limitation to the previous identified fundamental right.²⁷ These elements should form the starting point for every GDPR adequacy assessment, from which then additional elements can be explored.

In this context, it is important to note that the WP29 has put forward its own guidelines on how to assess adequacy (since then confirmed by the EDPB) and essential guarantees for access by the public sector in a third country.²⁸ In its opinion on the draft adequacy decision for Japan, the EDPB follows these documents for its assessment.²⁹ While the guidance of the WP29 includes useful (additional) elements that should be considered, it is this authors opinion that it prescribes a too rigid list of factors to fulfil the Schrems requirement of «equivalent» but not «identical», while at the same time not being rooted firmly enough in the different fundamental rights protected in the CFR and the EU data protection instruments (which, as will be explained shortly, are more than data protection and privacy). Hence, the proposed approach will differ in its starting point from the one put forward by the WP29/EDPB.

The first element required by EU fundamental rights law of a GDPR adequacy assessment is an identification which fundamental rights are protected within it. As indicated, the GDPR transfer provisions do not serve only the fundamental rights of privacy and data protection.³⁰ The CJEU, when defining the standard of equivalence in Schrems, did not limit it to the fundamental rights of Arts. 7 and 8 CFR by listing only them.³¹ Both Schrems and Opinion 1/15 considered more fundamental rights in addition, namely the right to an effective remedy and to non-discrimination.³² Within the GDPR, such an approach is supported by Art. 45(2)(a), which prescribes «respect for human rights and fundamental freedoms», as an element to take into account for an adequacy assessment, also not limiting the analysis to privacy and data protection. The identification of the fundamental rights to consider can differ depending on the EU data protection instrument forming the basis of the adequacy decision. For the GDPR, the following rights can be identified in addition to Arts. 7 and 8 CFR: effective judicial remedy,³³ freedom of expression,³⁴ and non-discrimination.³⁵

Secondly, the additional elements of Arts. 8(2) and (3) CFR have to be assessed as they provide the core elements of EU data protection. Considering that Schrems includes in essential equivalence only those fundamental rights expressed in the DPD, all fundamental rights identified must sufficiently be linked to data protection, hence aid these core elements. It is argued by the author that the assessment is therefore always whether X identified fundamental right in connection with Arts. 8(2) and (3) CFR is sufficiently achieved in the third country, thus specifying identified rights for a data protection context. Arguably, this would make Arts. 8(2) and (3) fundamental rights that (probably always) come into effect only in combination with other fundamental rights.³⁶

As an argument for this interpretation, one can consider the way the CJEU treated the data subject rights of access and rectification in Schrems. Both of those data subject rights are listed in Art. 8(2) CFR and hence core EU data protection elements. The CJEU however found that a non-existence of those rights constituted a breach of the essence of Art. 47 CFR (right to an effective remedy).³⁷ It would have been more logical if that finding was a breach of Art. 47 in connection with Art. 8(2) CFR, since if the non-existence of those two core elements of Art. 8(2) is not a breach of Art. 8(2), what is? Additionally, this would have linked Art. 47 more concretely to the data protection context. A further argument for this interpretation can be found in Opinion 1/15, where the CJEU after having analysed a potential limitation of Arts. 7 and 8 CFR, makes two additional analysis before its conclusions, namely which rights where available for air passengers, including the right of access and rectification but also judicial redress (Art. 8(2) in conjunction with Art. 47 CFR) and on the independence of supervision by the Canadian authorities (Art. 8(3) in connection with Arts. 8(1) and 7).³⁸ These additional assessments are part of the whole assessment for compatibility with the fundamental rights of Arts. 7 and 8 CFR, as only afterwards does the CJEU make its final conclusion.

Hence, the existence of the data subject rights of access and rectification, legitimate grounds for processing, and purpose limitation (Art. 8(2)) and the existence of independent institutional supervision (Art. 8(3)) are to be assessed in connection with each identified fundamental right to link them to the data protection context as necessary under the standard of equivalence. For fundamental rights other than data protection or privacy, this assessment might be limited to asking whether for example in a journalistic context (freedom of expression), the rights of access and rectification are made possible as far as feasible. Regarding the supervisory authority, the assessment could be whether the mandate and competence of the authority is sufficiently broad to also deal with issues of freedom of expression or non-discrimination.

Finally, once the fundamental rights at stake have been identified and linked to data protection, the data transfer authorised by the potential adequacy decision, must be considered an interference with those fundamental rights. Since Opinion 1/15, it is clear that transferring personal data is always an interference with fundamental rights.³⁹ While the CJEU only mentions Art. 7 CFR in Opinion 1/15, this can arguably extended to all fundamental rights protected within EU data protection legislation, as they all can be potentially undermined by a transfer of the personal data to a third country. As the adequacy decision is hence an interference (limitation) to EU fundamental rights, Art. 52(1) CFR, setting forward justifications of such a limitation, applies and needs to be assessed separately for each identified fundamental right. This requires an assessment if the essence of the identified right has been breached, whether the limitation comes in the form of law and serves objectives of general interest recognised by the EU, and whether the interference is proportional to these objectives.

After having proposed a definition for the standard of equivalence and outlined the starting point of an adequacy assessment, this section will shortly apply them to the Privacy Shield and the draft adequacy decision regarding Japan.

Regarding the identification of fundamental rights at stake, the Privacy Shield explicitly mentions Arts. 7 and 8 CFR,⁴⁰ while the draft Japan adequacy decision mentions no specific CFR provisions, but notes that «substance of privacy rights» is relevant for adequacy.⁴¹ Both decisions show that the EC did not consider essential equivalence as including all fundamental rights. This can also be concluded from the fact, that in both decisions a provision to protect non-discrimination is lacking. Opinion 1/15 states that the right to non-discrimination within a data protection context, would require a comparable provision to Art. 22 GDPR (protection from discriminatory automated decisions).⁴² As is pointed out by the EDPS, WP29 and EDPB, no such provision is to be found in the Shield or the draft Japan adequacy decision.⁴³

Turning to the second element, fulfilment of the additional requirements of Arts. 8(2) and 8(3) CFR in conjunction with the fundamental right at issue to link them to a data protection context, the EDPS notes for the Shield an issue with independent oversight (Art. 8(3)) of intelligence bodies, as non-US citizens have a different protection than US citizens. This could be seen as an issue of Art. 7 in conjunction with Art. 8(3) CFR. In a similar vein, the WP29 doubts the independence of the Ombudsperson for intelligence activities, suggesting another necessary analysis of Arts. 7 and 8(3) combined.⁴⁴ In addition, the EDPS criticises a lack of analysis regarding the effective exercise of data subject rights in a non-surveillance context, leading to a potential issue with Art. 47 in conjunction with Art. 8(2).⁴⁵ Similar concerns (though to a lesser extent) with oversight and effective remedies are noted by the EDPB for Japan.⁴⁶ While these examples should not suggest any in-depth assessment into these claims, they can demonstrate that even though the EU data protection institutions do not explicitly state that they are assessing adequacy decisions for the elements of Arts. 8(2) and (3), they arguably do so in practice.

The final element, whether the interference these adequacy decisions pose to fundamental rights, can be justified under Art. 52(1) CFR, requires a complex analysis that cannot be made in the limited confines of this paper. Instead the most forceful of the limitation elements shall be shortly highlighted – a potential breach of essence of a fundamental right. If such a breach is found a justification of the limitation of a fundamental right is not possible, hence the assessment can conclude.⁴⁷ Regarding the essence of a fundamental right, Schrems is one of the two CJEU cases actually finding a breach (really breaches) of essence,⁴⁸ namely of Art. 7 through the access to content of electronic communications with a lack of safeguards, and of Art. 47 by giving no legal remedies for access or rectification to the data subject.⁴⁹ Both of those issues seem insufficiently addressed within the Shield. As the EP points out, access by US intelligence services continues to take place and supervision is unclear and/or lacks the personnel,⁵⁰ suggesting still a breach of essence of Art. 7 CFR, especially in light of the recent judgment of the European Court of Human Rights (ECtHR) in Big Brother.⁵¹ Regarding the essence breach of Art. 47 CFR, while the Shield provides more remedies, a full equivalence with GDPR data subject rights seems to be lacking. The right of access for example, seems to be restricted to information stored within a company.⁵² For the Japan adequacy decision, the EDPB considers that access by public authorities for national security purposes is theoretically restricted and there exist oversight mechanism with individual redress opportunities, however, it is not clear how those work and are effective in practice. In any case, comparing the situation to the one in Schrems, there seems to be enough theoretical possibilities to argue that no breach of essence has occurred, though the interference might still not be justified under Art. 52(1) CFR.⁵³

As a conclusion, this author puts forward that the standard of equivalence for EU adequacy decisions needs to be firmer linked to the fundamental rights of the CFR. So far, the EC has tried to assess adequacy without a clear basis in EU fundamental rights law.⁵⁴ Transatlantic transfers show that an assessment of data transfers as a limitation to fundamental rights is lacking. Merely reworking Safe Harbour, as the EC did with the Privacy Shield,⁵⁵ cannot lead to a result that ensures essential equivalence. Judging from the latest draft adequacy decision concerning Japan, an in-depth analysis regarding fundamental rights is still not being conducted. As a solution, the author proposes an assessment anchored in the test for a limitation of a fundamental rights laid down by the CJEU and in the CFR that would be capable of producing results of essential equivalence.