The General Court of the European Union upholds the Data Privacy Framework

 

 

Dr Samira Allioui, Research fellow, Centre d'études internationales et européennes, Université de Strasbourg

Photo credit: Ibrahim Rustanov, via Wikimedia Commons

French Member of Parliament Philippe Latombe, who also sits on the board of the French data protection authority, the Commission Nationale de l’Informatique et des Libertés, brought an action, in his personal capacity, in the General Court of the European Union calling for the annulment of the Data Privacy Framework. On Wednesday, September 3, the General Court of the European Union dismissed MP Philippe Latombe's appeal against the Data Privacy Framework adequacy decision, the agreement governing data transfers between the EU and the United States, at the heart of a long legal saga. Since Latombe's case was brought as an action for annulment and not as a preliminary question by a national court, he not only had to prove that the deal was substantively wrong, but also that he was directly affected in order to be entitled to bring an action at all.

The DPF is the successor to the EU-U.S. Privacy Shield (the Privacy Shield), after the adequacy decision on the EU side adopted in light of the Privacy Shield was declared invalid in 2020 by the CJEU following litigation by privacy advocate Maximilian Schrems, acting through not-for-profit NOYB (none of your business), in the landmark case of Schrems II. The Privacy Shield was the successor to the EU-U.S. Safe Harbor Framework, which was declared invalid in 2015 in Schrems I. In response, the United States established the Data Protection Review Court (DPRC). The European Commission approved the DPF in July 2023.

Personal data transferred from the European Union to third countries is no longer subject to the GDPR in those countries. This requires compliance with certain safeguards prior to transfer, with the aim of ensuring adequate data protection in the destination country. An adequacy decision is one of the mechanisms for ensuring this protection, and the GDPR provides for a Commission decision recognizing, after a thorough examination, that the law of a third country offers guarantees deemed adequate.

It is clear that even though American law has since evolved towards greater oversight of intelligence services, one particular issue has long been a problem in US-EU relations: access to effective remedies in the United States, allowing Europeans affected by transatlantic transfers to challenge the processing of their data. This issue was already the subject of progress in 2022 with Executive Order 14086, which paved the way for a challenge mechanism. This allowed the European Commission to adopt a new adequacy decision in 2023, the very one that is being challenged in the Latombe case.

The new ruling

This new ruling is therefore part of a series of developments relating to transatlantic transfers. The fundamental issue is the adequacy of the safeguards provided abroad, and therefore the degree of requirement that the European Union must have vis-à-vis the states to which data are transferred. However, on this point, the reasoning followed by the General Court of the European Union contrasts sharply with the rulings handed down by the Court of Justice of the European Union in the Schrems I and II cases. In the Schrems II ruling, the Court insisted that "the third country must offer guarantees to ensure an adequate level of protection essentially equivalent to that guaranteed in the European Union," while also using the terms "essential equivalence" and "substantial equivalence" interchangeably. Only the latter expression—"substantial equivalent"—is adopted by the General Court, although it gives it a scope that appears to be weakened.

In its assessment of the adequacy of American law, the Court appears to be less demanding than the Court of Justice. In recent years, the latter has initiated a particularly demanding jurisprudential movement in matters of personal data protection, giving rise to numerous tensions with Member States, which themselves struggle to comply with the requirements of the Court of Justice. While the Schrems I and II judgments were perfectly in line with this trend, the Court's judgment seems to propose another direction, perhaps more favorable to national security issues.

In any case, in its analysis of the conditions to be met to conclude that foreign law is adequate, the Court draws its inspiration primarily from the ECtHR case of Big Brother Watch v. United Kingdom. On the contrary, the major decisions of the CJEU – we are thinking in particular of the La Quadrature du Net I case – dealing with the activities of intelligence services are not considered relevant by the Court. The latter were particularly demanding, where the ECtHR recognizes certain margins of appreciation for States, in particular due to the very sensitive nature of intelligence and national security issues.

The next developments?

Since this is a General Court ruling, it is likely that there will be an appeal to the CJEU. Let us assume, however, that the Court upholds the existing adequacy decision. Another fundamental question would inevitably arise. The General Court is not taking into account recent developments in US law, particularly since the return of President Donald Trump. However, some of the guarantees applicable in US law, highlighted by the General Court, already appear to be weakened. Let us give an example: the Privacy and Civil Liberties Oversight Board (PCLOB) which role is fundamental, particularly because it is involved in the appointment of members of the Data Protection Review Court, whose independence and impartiality are discussed at length in the General Court's ruling. However, President Donald Trump has terminated the terms of several PCLOB members, preventing it from functioning. The impact this could have on transatlantic data transfers has already been the subject of debate in the European Parliament and the United States. The saga surrounding transatlantic data transfers could thus, despite the Court's ruling, be the subject of new twists and turns.

Today, more than 2,800 US companies are DPF-certified, allowing them to continue relying on the adequacy decision (Article 45 of the GDPR) as the legal basis for their transatlantic transfers Data Privacy Framework. However, while this prevents massive disruptions to data flows, the stability of the framework is not guaranteed. It must be actively monitored, given regulatory or judicial events that may disrupt it.

Plus, if Mr. Latombe can still appeal the General Court's decision to the CJEU, it is uncertain whether the CJEU would follow the General Court's reasoning. It should be recalled here that the CJEU has in the past held that adequacy decisions must be assessed on the basis of the legal and factual situation at the time of the appeal, while in Latombe, the General Court departed from this standard and stated that decisions must be assessed on the basis of the situation at the time of their adoption (i.e., under the previous administration). Finally, the European Commission could, in theory, decide to suspend or repeal the DPF if it considers in the future that US law no longer provides sufficient protection for European Economic Area personal data.

Data Protection, the UK and the EU: the draft adequacy decisions

 

Lorna Woods, Professor of Internet Law, University of Essex

 

Background

 

Under the General Data Protection Regulation (GDPR) and the data protection Law Enforcement Directive (LED) personal data may not be transferred outside the EU unless adequate safeguards are in place (eg via standard contractual clauses). The most comprehensive way this can be demonstrated – and the easiest for individual controllers and processors – is via an adequacy decision under Article 45 GDPR and Article 36(3) LED respectively.  So far, twelve countries have, either fully or partially, been deemed adequate for GDPR purposes, including Andorra, Argentina, Canada (commercial organisations), Guernsey, Israel, Switzerland, and most recently, Japan – though note that in respect of its decision for Japan extra safeguards were required. While the Commission had found the US to be adequate, the Court of Justice disagreed (in the Schrems II judgment, discussed here).

 

With the UK now Brexited, it falls to be considered as a third country for data protection purposes and appropriate arrangements for data transfers need to be in place.  The UK Government planned for an adequacy decision, but by the end of the transitional period the Commission had not completed its assessment. A stop-gap measure was agreed in the EU-UK Trade and Cooperation Agreement (agreed by the EU and the UK on December 24, 2020: see overview of that agreement here) so that data flows between the two remain unrestricted either: (a) for a period of 4 months from 1  January 2021 (with an automatic extension for two further months unless either the UK or the EU objects); or (b) until an adequacy decision is granted by the Commission, whichever is earlier and always provided the UK makes no substantive changes to its data protection laws.  The European Data Protection Supervisor (EDPS) however expressed some concern about this agreement.

 

On 19th February, the European Commission published two draft decisions in respect of the adequacy of the UK for data protection purposes, one in relation to the GDPR, the other for the LED.  While the decisions are of interest because of the Brexit context, they are also the first decisions drafted since the Schrems II decision and therefore may provide illumination on the Commission’s response to that decision. (Update, June 28 2021: the Commission has now officially adopted the final adequacy decisions for the UK, See the update at the end of this blog post). 

 

The Decisions

 

The decisions are long, the GDPR decision being longer than that in relation to the LED, so no doubt commentators are still reading and reflecting on the detail. The following intial comments can be made. The decisions follow a broadly similar structure.  Both identify the context and the principles to be applied in their first paragraphs. For the GDPR this was Rec 104 GDPR, the jurisprudence of the CJEU, notably Schrems II and the EDPB “Adequacy Referential”; in relation to the LED Decision the Court’s case law is relevant, as is the specific “Adequacy Referential” the EDPB only recently adopted (02/02/2021) in relation to the LED. While adequacy might be the same, the context in relation to the GDPR and the LED differs, and different legal provisions are in issue.  The main body of the decision in each case reviews the UK system.  In its over view of the constitutional framework, the draft decision emphasises the Human Rights Act and the fact that the UK is a signatory to the European Convention on Human Rights as well as the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (“Convention 108”). 

 

These international agreements are important to the Commission in providing some stability to the UK’s ongoing data protection commitments. In its press release, the Commission commented that while it has left the EU,

 

… the UK remains a member of the European “privacy family”. Continued adherence to such international conventions is of particular importance for the stability and durability of the proposed adequacy findings.

 

This is perhaps particularly important given the UK government’s stated aim to take its own approach to data protection, and the fact that under Brexit legislation the Government has considerable latitude to change the law in primary legislation by statutory instrument. Although the decision notes this power, it does not dwell on the possible implications (see GDPR decision [13] and [16]; LED Decision [12]-[15]).

 

The decision also considers the data protection framework, specifically covering geographic and material scope, safeguards and rights, oversight, onward transfers, access by public bodies as well as duration and review of the decisions.  Much of this latter part reflects the GDPR, which given the history of the legislation, is hardly surprising, a point the decision notes while re-emphasising the importance of the ECHR and Convention 108 [GDPR decision 18]; similar comments are made as regards the LED (LED Decision [22]).  On the whole the discussion of the Data Protection Act notes that there is little difference between it and requirements of the GDPR, though some points where the DPA is not that clear (what are the safeguards for historical and statistical processing, which can data brokers presume that you just want a credit score see e.g [73]-[74]) are not raised – these may be small points within a generally acceptable framing. The Commission does note the exception for ‘the maintenance of effective immigration control’ which had been the subject of (unsuccessful) challenge. The Commission recognises that the exception is formulated broadly, but nonetheless accepts it based on the conditions limiting its scope (see [65]). Whether the EDPB takes a similar approach remains to be seen; certainly some MEPs have been critical.

 

The decisions also considered mechanisms for redress and oversight (provided in Parts 5 and 6 DPA, common to both). It refers to the ability of a data subject to: complain to (and about) the ICO; to bring a claim against controllers and processors for material and non-material damages; and to bring a claim in UK courts under the UK’s Human Rights Act 1998 and ultimately in the European Court of Human Rights.

 

The Commission decision seems to recognise the UK’s data protection authority (the Information Commissioner’s Officer, or ICO) as an effective oversight body (though the ICO is no longer described as “independent” in the DPA following the Brexit amendments to Art 51 GDPR, replacing ‘independent public authorities’ with the words ‘the Commissioner’), flagging the fines imposed on British Airways and Marriot as examples of regulatory practice, as well as noting the investigation into Cambridge Analytica. There are also references to the number of cases investigated, seemingly a factor in the Commission’s assessment. There is no mention of the fact that many of the codes that are part of the implementation regime are not yet drafted (eg journalism code).  Others have been critical of the ICO, notably in relation to its action against real time bidding and the ad tech sector (and also in relation to the possibility of complaining about the ICO). In relation to the law enforcement sector, the ICO has had limited success in enforcing the DPA (in relation to information access requests) against the police and concerns have been raised about the way the police deployed Microsoft Office 365 (which backs up to the United States), as well as police use of rape victims’ data stored on mobile phones so that the Victims’ Commissioner proposed that victims should have access to free legal advice to protect their privacy.  In this there might be differences between the law and practice.

 

In general, onward transfer of data might be a concern, especially if the UK signs up to trade agreements which make provisions restricting transfer of data problematic (this was part of the issue in the Japan decision). In this section (GDPR decision [75]-[82]), while there is plenty of detail about the UK system, there is less direct comparison with the requirements of Schrems II (and the LED Decision is similar). Moreover, the discussion accepts the safeguards in relation to the transfer of data to the UK for law enforcement purposes; yet, the EDPB has expressed concerns.

 

One of the big concerns surrounding the UK adequacy agreement related to the operations of the security and intelligence services, surveillance and national security. Presumably in an attempt to head off challenges in the light of Schrems II and other decisions on surveillance, the Commission devotes a considerable amount of space to a description of the UK arrangements.  The use of personal data for law enforcement purposes and in the context of national security lie outside the GDPR; even for personal data within the GDPR a general exemption applies for national security or defence purposes, though the Commission noted this must be applied on a case by case basis rather than as a blanket exception (see [66]-[69]).

 

The issue of access to data by public authorities in the public interest is dealt with in a separate section (para [112] onwards), with the decision noting that the baseline is set in Schrems II as well as the more recent cases of Privacy International (Case C-623/17) and La Quadrature du Net (Cases C-511-12/18 and C-520/18) – which were discussed here.  While the decision states the principles applying to an interference with an individual’s right to privacy and to data protection, it does so at a general level and does not engage with the case law surrounding mass surveillance and bulk collection of data, despite its citation of La Quadrature du Net. It instead focuses on the oversight mechanisms and formal controls, as well as the right of an individual to bring action before a court.

 

The EDPB by contrast specifically notes that in the view of the CJEU completely indiscriminate data retention would offend against the principle of necessity; it moreover states that necessity and proportionality both need to be demonstrated (rather than asserted). Nonetheless, the decision engages in a thorough overview of the regime both as far as the ICO’s powers are concerned as well as the processes set up under the Investigatory Powers Act (IPA). It concludes (at [268]) that any interference with the fundamental rights of the individuals whose personal data are transferred from the European Union to the United Kingdom by United Kingdom public authorities for public interest purposes, in particular law enforcement and national security purposes, will be limited to what is strictly necessary to achieve the legitimate objective in question, and that effective legal protection against such interference exists.

 

It does not consider the partial nature of the response to the Tele2/Watson ruling (discussed [195] – and here on this blog), in which the Government specifically introduced a separate definition of serious crime to cover metadata and failed to deal with the issue of informing subjects of surveillance operations. It seems to accept the practices of the agencies even though there are a number of cases suggesting illegality in the light of the ECHR.  Given the criticisms of the US regime in Schrems II, there are some suggestions that this aspect of the decision might be subject to challenge.

 

One final point to note about the decision is that it is expressed to be valid for four years, in the interests of ‘future proofing’ the arrangements. While the Commission is under an obligation to keep under review the other adequacy arrangements (art 45(3) GDPR), in no other case as yet is there a time limit to the decision. This may reflect concerns regarding the UK government’s plans for data protection in the future; the EDPS suggested however that ‘any substantial deviation that would result in lowering the level of protection would constitute an important obstacle to a finding of adequacy’. Does this hint that backsliding in and of itself might be seen as a problem?

 

What Next?

 

The announcement from the Commission that it had published draft decisions finding the UK to meet the adequacy standard for both instruments was therefore greeted positively by the UK government and the ICO as well as by industry.  On the whole, the decision focussed on the positive aspects of the UK regime, emphasising where there was protection rather than where the weaknesses lie. This is understandable; no system is perfect and the requirement is not to replicate exactly the GDPR and the LED. Moreover, given the similarities of the UK regime at the moment, it would set a very high standard if the UK were not to be seen as adequate – where would this leave the position vis a vis other countries (eg Japan)? 

 

Yet, this is not yet a done deal; the EDPB will publish its opinion as required under Article 70 GDPR which, though not binding, will be influential (as was also the case in the Japan adequacy decision).  The decision must also be submitted to the Article 93 Committee and be made available to the European Parliament and the Council under the comitology procedures.  Further, there is still a risk that, in the light of earlier litigation (eg Digital Rights Ireland, Schrems I, Tele2/Watson and Schrems II – see discussion of the first two cases here and here), any adequacy decision could be challenged focussing on that difficult topic of national security and the extent to which the State is allowed to carry out surveillance in bulk.  While the bulk of challenges have come from privacy activists, there remains the possibility that the European Parliament could, were it so minded, mount such a challenge (which would reduce some of the standing issues); individual regulatory authorities could also bring litigation.

Adequacy Decisions – Update (June 30, 2021)

The European Union has adopted the adequacy decisions in respect of the UK, available here. The decision comes just in time to avoid the need to use Standard Contractual Terms and Binding Corporate rules for transfers to the UK from the EU; the stop gap measure would have reached its end at 30th June 2021. The news has been well-received but a couple of points are worth noting.

 

First, the UK’s current regime implements the GDPR and the LED, however imperfectly and it would therefore have been somewhat surprising if the political institutions at EU level did not recognise this as adequate. Indeed, the Adequacy Agreement specifically refers to this point [recital 12, 16]. The UK government’s emphasis on developing its own data policy against this background is unfortunate; the challenges to key elements of the GDPS in the TIGGR particularly so. The decision is also predicated upon the UK’s adherence to the European Convention of Human Rights and submission to the jurisdiction of the European Court of Human Rights. Continued adherence to such international obligations is therefore a particularly important element of the assessment on which this Decision is based. [recital 277]

 

Secondly, the agreement, unusually, has a sunset clause. It will automatically expire after 4 years and the Commission has the right to review it during this term. Certain points of concern are apparent.  For example, data transfers for the purposes of migration control are excluded by Article 1 from the scope of the adequacy agreement (though the SCCs and BCRs remain available), specifically referring to ORG v SoS for the Home Department [recital 6]; this reflects the concerns surrounding the immigration exemption.  Article 3 contains monitoring arrangements relating to the actual practice of data protection, including examples of when the ICO fails to ensure compliance with the DPA18; where public authorities interfer with the rights of individuals more than is strictly necessary or where there is no legal redress [Article 3(2) and (3)]. These would seem to point to concerns around data sharing by public authorities and limitations on individual rights to facilitate eg big data analytics.

 

Taken together, this suggests that the adequacy agreement is not a done-deal for ever more and that particularly some parts of the EU have concerns about the current government’s plans to reduce protection.  There remains the question of what those outside the EU political institutions will do. A challenge to the Adequacy Agreement remains possible, notwithstanding its attempt to deal with the problem of mass surveillance. It remains the fact that the UK surveillance regime would in future pass the adequacy threshold set down in Schrems I.

 

Barnard & Peers: chapter 26

Photo credit: By Christoph Scholz - EU Puzzle mit Grossbritannien (link to licence)

Data protection, the death penalty and mutual legal assistance in criminal law: Elgizouli v Secretary of State for the Home Department [2020] UKSC 10

Lorna Woods, Professor of Internet Law, University of Essex

Introduction

Elgizouli is the first UK Supreme Court judgment on the Data Protection Act 2018 (DPA).  The headline news is that ‘substantial compliance’ with the requirements set down in the Act is insufficient to make data transfers to third countries lawful. The judgment concerns Part Three, which implements the Law Enforcement Directive (Directive (EU) 2016/680) and focusses on procedural protections, but in terms of approach may have implications for the UK courts’ approach to the DPA and General Data Protection Regulation (GDPR) more generally, especially as it relates to the protection of individual rights found in the European Court of Human Rights (ECHR).

Facts

Eligizouli’s son was implicated in the murder in Syria of UK and UK citizens. As part of its investigations into the group responsible for the murders, the US made a mutual legal assistance (MLA) request to the UK, asking for information to be transferred. Theresa May, as Home Secretary, requested that the information would not be used either directly or indirectly in a prosecution that could lead to the imposition of the death penalty, an assurance the US did not give. Nonetheless, Sajid Javid, a subsequent Home Secretary, agreed to provide the information.

Eligizouli brought an action for judicial review, raising two questions: (1) whether the common law precluded the Secretary of State from exercising his or her powers in this way; and (2) whether such a transfer was lawful under the DPA understood in the light of EU law.  Specifically, the appellant argued that the Home Secretary’s decision was an unlawful breach of:

1)      the first data protection principle in section 35 of the Act;

2)      the second data protection principle in section 36;

3)      the provisions governing international transfers of personal data for law enforcement purposes in sections 73 to 76; and

4)      the special processing restrictions in section 80.

It was further argued that the Home Secretary had paid no regard to the duties imposed on him by the DPA. At first instance, the Divisional Court had held that the Home Secretary had demonstrated “substantial compliance” with the Act and that “special circumstances” could be relied on in relation to the transfer.

Judgment

The Supreme Court (by a majority) found that the common law had not evolved to a point where it recognised a principle prohibiting the provision of MLA that would facilitate the death penalty.  The Court was, however, unanimous in holding that the Home Secretary’s decision was unlawful under the DPA, specifically as regards the conditions under which data can be transferred to another jurisdiction and the leading judgment was given by Lord Kerr (although he was in  the minority on the common law point). Lady Hale’s judgment constitutes, in her words, a ‘short guide to the judgments’ [2].

There was agreement between all parties that Part 3 was in issue – that is, that there would be processing of personal data for a “law enforcement purpose” by a controller which is also a “competent authority” for the purposes of the Part 3 of the DPA.  It was also common ground that the Home Secretary did not expressly consider his duties under the DPA.

The main focus of the judgment was the conditions surrounding the transfer of the data to the US; the relevant provisions are found in ss. 73-76. Specifically, data cannot be transferred unless the three conditions in s 73(1)(a) are met. The first, in s. 73(2), is that “the transfer is necessary for any of the law enforcement purposes”. Section 73(3) contains the second condition. It lists three circumstances in which a transfer may take place:

1)      when it is based on an adequacy decision (simplifying data transfers) as set out in s. 74;

2)      if there is no such adequacy decision, then there are appropriate safeguards in accordance with s. 75; or

3)      if neither (1) nor (2) apply, is based on special circumstances in accordance with s. 76.

The third condition relates to the recipient of the information. 

The Court was agreed that the Home Secretary’s decision was not based on an adequacy decision, nor were there appropriate safeguards in the sense of s. 75. As Lady Hale remarked, “[t]his transfer was not based on an adequacy decision or on there being appropriate safeguards, because there were none” [10]. The issue of whether the decision was lawful would therefore depend on whether special circumstances existed; the Court did not consider whether special circumstances could only be relied on if neither of the other two categories apply. Section 76(1) specifies that special circumstances will apply if the transfer is necessary for one of five listed purposes:

1)      to protect the vital interests of the data subject or another person;

2)      to safeguard the legitimate interests of the data subject;

3)      for the prevention of an immediate and serious threat to the public security of a member State or a third country;

4)      in individual cases for any of the law enforcement purposes, or

5)      in individual cases for a legal purpose.

Section 31 DPA defines the law enforcement purposes. It would seem that s. 76(1)(d) and (e) are relevant here, but they are subject to a further control. Section 76(2) specifies they “do not apply if the controller determines that fundamental rights and freedoms of the data subject override the public interest in the transfer”. Further, according to s 76(3), the transfer must in all cases be documented.

Special circumstances, according to the Court, requires a specific assessment of whether these conditions are satisfied. The Court stated that the purpose of section 73 was to “set out a structured framework for decision-making, with appropriate documentation” [219] and, as the ICO submitted, requires:

 ‘conscious and contemporaneous’ consideration of the statutory tests prior to any transfer taking place. Further, the record-keeping requirement, including the requirement to set out the ‘justification for the transfer’ … cannot sensibly be read as requiring no more than ex post cosideration of whether a transfer was justified [218].

This was lacking here and the fact that the Home Secretary did not have regard to his duties as data controller meant that the special circumstances basis for transfer was not available [158]. Lord Carnwath sugggested here that the decision was based on political expediency rather than strict necessity as required by the statute [227] – Lord Kerr took a similar view.

There was a further question about impact of ‘fundamental rights and freedoms’ in s 76(2) – this per Lady Hale includes right to life in Art 2 ECHR. She argued, albeit obiter dicta, that this points towards an interpretation of s 76(2) so as to preclude a transfer of personal data to facilitate a prosecution which could result in the death penalty [26]. Lord Carnwath states that a failure to consider the point is a further reason that the Home Secretary’s decision cannot stand [228]; Lord Hodge sees the force of this point but as it was not fully argued reserves his position.

Lord Kerr took a different view, arguing that the processing (ie through the transfer of data as part of the MLA) was not lawful and fair – ie did not comply with the data protection principles in s. 34 DPA. He came to this conclusion because he, alone out of the judges, had taken the view that the common law would prevent the Home Secretary from acting in this way.

Comment

On one level the judgment could be seen as narrow; providing protection only through procedural mechanisms, leaving the Home Secretary free to make the same decision again, having directed her mind to the issues. Similarly, in its approach to the common law and the need for incremental development, the court is showing deference to the primacy of the legislature (see paras 170 and 233), especially in the context of the exercise of prerogative powers.  However, in its interpretation of the DPA and more particularly in the way it approached how the provisions should be interpreted, the judgment has a broader significance.  Indeed, its approach is in marked contrast to that of the lower courts, which may now change direction.

The Supreme Court here is emphasising the importance of data controllers actively engaging with the requirements imposed by the DPA; here the concerns stemmed from the fact that the Home Secretary “did not address his mind to the 2018 Act at all” [6]. So it seems that to be able to use any of the gateways in s. 73, consideration must be given to the protections in place, whatever the mechanism used. In terms of both the gateway based on appropriate safeguards and that which requires special circumstances, Lord Carnwath makes an important distinction between a decision which takes factors into account and one which is based on there being appropriate safeguards or special circumstances [219]. This distinction operates to raise the threshold of the standards required. The Supreme Court did not address the question of whether the three gateways operate in a hierarchy; that is each must be considered and discounted before moving on to the next. This would, as the respondents argued, place an additional burden on them.

The Supreme Court also confirmed the approach to understanding ‘necessary’ in s. 76(1) regarding the objectives in relation to which special circumstances may arise, which should be understood in the light of recital 72 to the LED. While the Divisional Court had used recital 72 to try to justify seeing this particular case as not being problematic (the recital gives the example of mass surveillance), The Supreme Court emphasises that any transfer must be ‘strictly necessary’ (rather than ‘necessary’ as in the DPA). Lady Hale referred to the judgment of Warby J in Guriev v Community Safety Development (UK) Ltd ([2016] EWHC 643 (QB)) who said

The test of necessity is a strict one, requiring any interference with the subject’s rights to be proportionate to the gravity of the threat to the public interest” (para 45)

While this may leave questions about the meaning of necessary and proportionality and their relationship to one another (a common question), it is clear that the scope of s. 76 is to be narrowly interpreted – as indeed is the general approach under EU law to derogations – and that the proportionality of the transfer must be considered.

Lady Hale’s obiter views on s 76(2) DPA (which the rest of the Court accepted had force) also indicate that the Supreme Court is taking a strict approach to compliance here.  Her argument accepts that even if a transfer is necessary and proportionate it may still be overridden by the rights of the data subject – as found in a range of instruments, including the ECHR. These rights are not limited to data protection and privacy rights but include any of the rights so protected. Lady Hale expressly identifies the right to life (Art 2 ECHR). This means that the protection awarded is not just procedural but could include an assessment of the substance of the rights. Significantly, she made the point that fundamental rights are protected whatever the person’s nationality or place of residence and, implicitly, that these protections may have an extraterritorial effect. That is, they protect not just the rights of data subjects who remain within the jurisdiction once their data are transferred but possibly also those data subjects who are outside the jurisdiction when their data are transferred by a controller within the jurisdiction.

The judgment is clearly important for the transfer of data under the LED, but the provisions on data transfer in that context bear some similarity to the structure to that of Art 49 GDPR dealing with transfers in specific situations. It is not hard to imagine that a similar analytical methodology could be applied by the British courts if confronted with such a case.

The final question is what impact, if any, might this decision have on the possibility of a data protection adequacy decision for the UK from the EU Commission after Brexit (which would simplify the transfer of data from the EU to the UK). On the one hand, this shows that the administration got things very wrong, which might count against an adequacy decision; conversely, the approach of the Supreme Court might provide reassurance that there is effective oversight of data protection rights by independent courts in the UK. It could then come down to how the Government reacts to the Supreme Court’s judgment.

Photo credit: David Iliff, via Wikicommons

Brexit and Data Protection: The Tale of the Data Protection Bill and UK-EU Data Transfers

Elif Mendos Kuşkonmaz, PhD student at Queen Mary, University of London[*]

Introduction

A Bosnian folk song tells the death of a severely ill Ottoman Pasha. After hearing of the Pasha’s death, his wife also passes away from sorrow. Now that the UK voted to leave the European Union (EU) on 23 June 2016, will data protection laws also pass away from sorrow after the UK leaves the EU?

The Data Protection Act 1998 (DPA), which is the UK’s current key regulatory regime for data protection, implements the EU’s Data Protection Directive of 1995 into the UK national law. This Directive is replaced by the General Data Protection Regulation (GDPR) adopted in April 2016, which introduces a task force (European Data Protection Board), new responsibilities for data controllers and processors, and new rights for data subjects such as right to transfer data from one server to another and right to be forgotten. All EU Member States have to transpose this Regulation by 25 May 2018 (before the UK is due to leave the EU). Accompanying the GDPR, a new Directive in relation to data protection in the field of police and justice sectors was also introduced at the EU level. This Directive creates a comprehensive framework for data processing activities performed for the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. All EU Member States have to transpose this Directive into their national laws by 6 May 2018.

As an EU regulation, the GDPR will be directly applicable in the UK without the need for an Act of Parliament from 25 May 2018 forwards as the UK is expected to leave the EU officially some point after March 2019 and its EU membership continues until then. Still, there exists some provisions under the GDPR that Member States can adapt in their national laws such as permitted derogations from data protection principles (Article 23 on derogations from transparency obligations and data subject rights for purposes of national security, defence, public security etc., and Articles 85-91 on derogations for specific data processing situations such as necessary for freedom of expression, employee data, and scientific and historical research purposes). So, in anticipation of dealing with these issues, first, a statement of intent was published by the UK Government on 7 August 2017 as a form of commitment to the GDPR. Then, the Data Protection Bill was introduced to the House of Lords on 13 September 2017. (Also, see here for the House of Lords’ report on Brexit and data protection). This Bill will replace the Data Protection Act 1998, and will regulate the areas where the UK has competence to do so such as the permitted derogations mentioned above and areas that fall outside the scope of the GDPR like data processing for law enforcement purposes or for national security interests. So, in light of these recent developments, it is clear that the data protection in the UK will not experience an immediate death.

The Data Protection Bill in a nutshell

As a whole, the Data Protection Bill contains the general definitions under the GDPR and the derogations from data protection principles provided under it. These derogations include data processing for journalism, for research, and by employees under certain conditions.

It also covers the areas that are not covered by the GDPR. The first area is the data processing in the context of law enforcement (Part 3 of the Data Protection Bill), which is in fact covered by the Data Protection Directive on processing of personal data for law enforcement purposes (the ‘Law Enforcement Directive’). Unlike the GPDR, this Directive is not directly applicable in the UK.

Therefore, with the inclusion of the data processing by competent public authorities in relation to law enforcement purposes, the Data Protection Bill transposes the Law Enforcement Directive into UK law. It is said that the principles for such processing resembles the 2014 Regulations, through which the UK transposed the previous EU data protection rules for data processing in the context of law enforcement. On the basis of the broad definition of a competent authority for data processing under the Bill, data can be processed not only by criminal justice agencies in the UK, but also other organisations with law enforcement functions such as such as Her Majesty’s Revenue and Customs, the Health and Safety Executive and the Office of the Information Commissioner. The competent authority definition under the Law Enforcement Directive provides for such broad definition (Article 3(7) of the Law Enforcement Directive). Another area that is covered by the Bill and not by the GDPR is data processing for intelligence services (Part 4 of the Data Protection Bill). It is said that the provisions on this processing are based upon the Council of Europe’s Convention on automatic processing of data (Convention 108) and changes which are being made to that Convention [note 40 of the Explanatory Notes for the Data Protection Bill]. This part of the Bill is complementary to the other legislation in relation to intelligence services such as the Investigatory Powers Act 2016 (discussed below) [note 47], and therefore constantly refers to this legislation. It also provides for national security exemptions for certain provisions it sets forth for data processing by intelligence services (Chapter 6 of the Part 4 of the Data Protection Bill).

Consequently, when the Data Protection Bill receives Royal Assent (in principle, in May 2018 on the same day the GPDR is due to be applicable) the GDPR, which will be converted to UK law with the EU (Withdrawal) Bill upon Brexit, has to read alongside the Data Protection Bill. For references in the GDPR such as ‘Union law’ and ‘Member State law’ that will be no longer relevant after Brexit, Schedule 6 of the Data Protection Bill introduces amendments.

The Data Protection Bill has received both positive and negative comments. The positive ones hinged on the relief it has brought to data controllers based in the UK. That said, it is argued that the Bill contains some complex and legally questionable provisions, like this sentence: ‘Terms used in Chapter 2 and in the GDPR have the same meaning in Chapter 2 as they have in the GDPR’ (Section 4). Or this sentence: ‘GDPR applies to the processing of personal data to which this Chapter applies but as if its Articles were part of an Act extending to England and Wales, Scotland and Northern Ireland’ (Section 20(1)). Nevertheless, the second reading of the Data Protection Bill in the House of Lords is due on 10 October 2017 and there might be further changes to it before it becomes law.

What is at stake for the future of UK-EU cross-border data transfer after Brexit?

For the importance of the UK-EU cross-border data transfers the numbers speak for themselves. 43% of EU tech companies are based in the UK and 75% of the UK’s data transfers are with the EU Member States. It is for this reason that the UK Government has consistently referred to the importance of maintaining the data flow between the UK and the EU after Brexit [note 8.38]. However, even if one assumes that the Data Protection Bill successfully aligns UK law with the EU data protection framework, this does not mean that the Bill is a panacea for the future of this flow post-Brexit. This point was also accepted by the UK Government in their position paper on the exchange and protection of personal data after Brexit [note 4]. Upon the UK’s exit from the EU, the UK will be considered as a third country within the meaning of the abovementioned framework and any data transfer from the EU to there will have to comply with the rules on data transfer to a third country under the same framework.

Like the Data Protection Directive of 1995, the GDPR allows for transfer of personal data outside the EU/EEA, for instance if the European Commission decides that third country to which data are transferred ensures an ‘adequate level of protection’ for those data (Article 45 of the GDPR) or if the UK businesses (either as data processors or controllers) individually adopt other adequacy mechanisms such as standard contractual clauses and binding corporate rules (Articles 46 and 47 of the GDPR). In its position paper on the exchange and protection of personal data after Brexit, the UK Government referred to the Article 45 adequacy finding and mentioned that the future UK-EU data transfers could built upon this adequacy model [paras. 22, 32-41]. Moreover, it noted that the UK should be found as compliant with EU data protection framework as it introduced the Data Protection Bill, which implemented the GDPR and the Law Enforcement Directive [ibid, para. 23]. As discussed below, achieving a positive adequacy decision for the UK is not as uncontentious as the UK Government think it is.

At the outset, the UK should be found to afford an adequate level of data protection, which was defined in the CJEU’s Schrems decision (discussed here) as ‘essentially equivalent’ data protection to that of afforded under EU law. The crux of this decision is that in the Court’s view, US law failed to offer that level of protection because it included expansive national security derogations for the use of personal data by the US intelligence agency, which in turn meant that EU citizens were stripped of their privacy and data protection rights once their data reached the shores of the US under the then valid Safe Harbour principles scheme. It is evident from this decision that the activities of intelligence agency of a third country with respect to personal data transferred from the EU comes under the scrutiny of the European Commission in its quest for an adequacy decision for that country. Indeed, the GDPR requires the European Commission to consider a wide array of issues such as the rule of law, respect for fundamental rights, and legislation on national security, public security, and criminal law in that country (Article 45(2) of the GDPR). So, the UK Government’s assumption that the implementation of the GDPR will suffice for a positive adequacy finding for the UK is false because UK laws on data processing by intelligence agencies’ for national security purposes will come under the scrutiny of the European Commission.

Regretfully, the surveillance practices of UK intelligence services may imperil a positive adequacy decision. The discussions surrounding the Investigatory Powers Act (IPA), and its predecessor the Data Retention and Investigatory Act 2014 (DRIPA) is illustrative in this matter. The latter Act provided for the storage of telecommunications’ data for later to be used by police and security agencies. Following the CJEU’s Digital Rights Ireland decision (discussed here) finding practices of indiscriminate data retention in the context of fight against terrorism and transnational crime incompatible with EU fundamental rights of privacy and data protection, the DRIPA was challenged in the joined cases of Tele2 and Watson before the CJEU on the ground that it provided for such practices, and thus violated the mentioned rights. Consequently, the CJEU found the DRIPA unlawful as the data retention scheme established under it exceeded the limits of what is strictly necessary and was not justified. (See here for Prof Lorna Woods’s take on the Tele2 and Watson decision).

The IPA, which took the place of DRIPA, retains the contested provisions of the DRIPA, and in some situations provides for more controversial data processing. For example, the IPA provides for the retention of telecommunications data for preventing or detecting crime or preventing disorder (Article 87(1) of the IPA), which does not comply with the CJEU’s finding in Tele2 and Watson that ‘only the objective of fighting serious crime is capable of justifying such access to the retained data [para. 172]’. Therefore, the IPA sits at odds with the CJEU’s finding in Tele2 and Watson.

In fact, a legal challenge to the IPA in this matter has already been brought before the UK High Court by the UK based civil liberties organisation Liberty. Equally relevant is that Investigatory Powers Tribunal referred the question on the compatibility of the acquisition and use of bulk communications data under s.94 of the Telecommunications Act 1984 with EU law to the CJEU. (See here for Matthew White’s review on the matter).

Here, the status of the EU Charter of Fundamental Rights (Charter) and the jurisdiction of the CJEU after Brexit requires further attention. The EU (Withdrawal) Bill provides that pre-Brexit case-law of the CJEU stays binding after Brexit with certain exceptions (Clause 6. When departing from pre-Brexit case-law of the CJEU, the Supreme Court must apply the same test it applies when deciding whether to depart from its own case law, and Parliament or the executive can override that prior CJEU case law). However, the EU (Withdrawal) Bill in its current form excludes the Charter (Clause 5(4)), and puts an end to the jurisdiction of the CJEU (Clause 6) after Brexit. Still, this does not mean that the UK can ignore the decisions of CJEU given after Brexit because the EU data protection framework, which the European Commission will refer to when considering the adequacy question, will be interpreted in light of those decisions. The UK Government, on the other hand, seems to sweep these issues under the carpet in its post-Brexit paper because neither the discussions surrounding the IPA nor the case-law of the Charter after Brexit were mentioned in its position paper on the exchange and protection of personal data. Only when dealing with the UK-EU model of data exchange, it referred that such model should ‘respect UK sovereignty, including the UK’s ability to protect the security of its citizens and its ability to maintain and develop its position as a leader in data protection [note 22.] This statement might be read as a reference to the IPA, or any future law on surveillance practices and the end of the direct jurisdiction of the CJEU.

Alternatives to the adequacy finding under Article 45 of the GDPR include subjecting the data transfers to safeguards under Article 46, which include Binding Corporate Rules under Article 47. The Government already noted that these alternatives are not its primary target due to their limited scope [Annex A]. Still, as the ongoing challenge against the standard contractual clause scheme for data transfers under the Data Protection Directive of 1995 shows, neither alternative is immune from a legal challenge before the CJEU.

One might ask whether all these will be relevant for the data transfer during the transitional period should there be a transitional period after Brexit. The short answer is: yes, they will be. Despite the UK Government’s discontent, if the transitional period is based on the UK’s joining of the European Economic Area (EEA) and the European Free Trade Association (EFTA)– the so-called Norway option-, the data will continue to flow from the EU without an adequacy decision by way of retaining the GDPR as parts of UK law after Brexit since the GDPR has EEA relevance (ie, non-EU EEA states will apply the GDPR as such).

Other than that, the UK may seek to conclude a transitional agreement as part of the Article 50 negotiations, as indicated in the Prime Minister’s recent Florence speech (discussed here). That agreement will not be immune from the adequacy requirements discussed above because it will have to match the EU standards, and particularly the EU data protection framework and its rules on data transfers.

Data Protection in the field of police and justice sectors

As mentioned above, the UK aims to transpose the Law Enforcement Directive in to UK law with the Data Protection Bill. Yet, as in the case of GDPR, maintaining the data exchange between law enforcement authorities in the UK and in the EU will not be undisputed upon Brexit.

Any obstacle to this data exchange after Brexit has been considered as a gift for criminals and as a threat for public safety. So, it should not come as a surprise that the UK Government highlighted the importance of facilitating this data exchange for cross-border law enforcement cooperation in its position paper on security, law enforcement, and criminal justice [note 21]. Just like the GDPR, the Data Protection Directive on law enforcement requires an adequate level of data protection standards for data transfers to a third country (Article 36 of the Law Enforcement Directive). So, any future agreement between the EU and the UK on law enforcement information exchange would have to comply with these standards. The UK Government voiced its intention to ‘build on’ the adequacy scheme for the future of data exchange for law enforcement. Still, it was of the opinion that the implementation of the Law Enforcement Directive through the introduction of the Data Protection Bill is enough for the UK to secure a positive adequacy decision. I discussed earlier the scope of the adequacy assessment and the matters that may affect the likelihood of securing such decision. Besides, in the recent judgment by the CJEU on the compatibility of the EU-Canada Agreement on transferring passenger information in the fight against terrorism with the EU Treaties and Charter, the Court set a list of procedural requirements for the transfer of information in that context. In this regard, these requirements must be met for law enforcement data transfers to be compatible with the Charter. (See here Prof Lorna Wood’s review of Opinion 1/15.)

What is the EU’s position on data protection?

While all these developments and discussions are unravelling in the UK, the EU’s position on the matter focuses on the use and protection of personal data obtained or processed before Brexit for good reason – the need to determine what happens to data processed before Brexit Day. Accordingly, the EU Commission published a position paper as part of its approach to Article 50 negotiations in relation to such use and protection, updated on 21 September 2017. On the whole, the paper provides for the continuity of the application of the general principles of the EU data protection framework in force on Brexit day to personal data in the UK processed before that day. It also notes the continuity of the principal data subject rights’ such as right to be informed, right of access, and right to rectification. Moreover, it seeks the confirmation that the personal data with specific retention periods under sectorial laws must be erased upon the exhaustion of those periods, and that the ongoing investigations in relation to compliance with data protection principles on the Brexit day should be completed. It does not go unnoticed that the paper mentions to the CJEU as the legal authority to interpret the general principles that it refers to. As a whole, the position paper indicates that amidst the ambiguousness and the complexity that the future partnership with the UK on data protection holds, the EU Commission seeks to secure that this uncharted water will not be detrimental to data subjects whose data were transferred to the UK before Brexit.

Conclusion

The UK Government introduced the Data Protection Bill, which seeks to adjust its national laws on data protection with the GDPR and the Law Enforcement Directive. This development may mean that at least some EU data protection requirements will be implemented in UK law on the day the UK leaves the EU. Still, it should not be read as a solution for the issue of maintaining the UK-EU data transfer after Brexit because the GDPR’s and the Directive’s provisions on third country data transfer will be relevant for such transfer. After the CJEU’s Schrems decision, an adequacy finding and other legal mechanisms to enable that movement could trigger the extent of national security derogations and their interferences with fundamental rights of the persons whose data are transferred from the EU to the UK. Certain provisions of the IPA and the CJEU’s findings in Tele2 and Watson cannot be reconciled, and this may hinder a positive adequacy finding for the UK. The same conclusion can be drawn for any future EU-UK data transfer deal for law enforcement purposes.

Barnard and Peers: chapter 27

Photo credit: Cyberadvice

---

[*] Many thanks to Prof Steve Peers for his valuable comments.