[2017] IEHC 545
THE HIGH COURT
COMMERCIAL
[2016 No. 4809 P.]
THE DATA PROTECTION COMMISSIONER
PLAINTIFF
AND
FACEBOOK IRELAND LIMITED AND MAXIMILLIAN SCHREMS
DEFENDANTS
JUDGMENT of Ms. Justice Costello delivered on the 3rd day of October, 2017
Introduction
1. This is an unusual case. The proceedings have been brought in this court for the purposes of obtaining a ruling from the Court of Justice of the European Union (“the CJEU”) on the validity of three decisions of the Commission of the European Union (“the Commission”) insofar as they apply to data transfers from the European Economic Area (“the EEA”) to the United States of America. The decisions are: -
(1) Commission Decision 2001/497/EC of 15 June 2001 on standard contractual clauses for the transfer of personal data to third countries, under Directive 95/46/EC [2001] OJ L181/19;
(2) Commission Decision 2004/915/EC of 27 December 2004 amending decision 2001/497/EC as regards the introduction of an alternative set of standard contractual clauses for the transfer of personal data to third countries (notified under document number C(2004)5271) [2004] OJ L385/74; and
(3) Commission Decision 2010/87/EU of 5 February 2010 on standard contractual clauses for the transfer of personal data to processors established in third countries under Directive 95/46/EC of the European Parliament and of the Council (notified under document C (2010) 593) (Text with EEA relevance) [2010] OJ L39/5 (together the “SCC decisions”)
2. The plaintiff is the Data Protection Commissioner in Ireland (“the DPC”). She is the person charged with the enforcement and monitoring of compliance with the Data Protection Acts 1988 to 2003. She is also the person designated as the national supervisory authority for the purposes of monitoring the application in Ireland of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“the Directive”).
3. The DPC is investigating a complaint made by the second named defendant (Mr. Schrems), a student with an address at Schadegasse 2/13, 1060 Vienna, Austria who operates a Facebook account. She has formed the view that the complaint raises issues as to the validity of the SCC decisions having regard to the provisions of Article 7 and/or Article 8 and/or Article 47 of the Charter of Fundamental Rights of the European Union (“the Charter”). In light of the Ruling of the CJEU in Case C-362/14 Schrems v. Data Protection Commissioner, EU:C:2015:650 (“Schrems”) 6th October, 2015, and in particular para. 65 of the Ruling she instituted these proceedings in order that the validity of the SCC decisions may be determined, either by this court declining to make a reference pursuant to Article 267 of the Treaty on the Functioning of the European Union (“TFEU”) on the basis that no issue as to the validity of the SCC decisions arises, or on the basis that this court makes a reference to the CJEU and the CJEU makes a ruling on the validity of the SCC decisions.
The Parties
4. The DPC joined Mr. Schrems as a defendant to the proceedings as he is the complainant whose complaint she is investigating and which gives rise to these proceedings. Facebook Ireland Ltd. (“Facebook”) is a limited liability company which operates an online social networking service, with a registered address at 4 Grand Canal Square, Grand Canal Harbour, Dublin 2. It is part of the Facebook group of companies. Facebook Inc. is a US corporation, established under the laws of the State of Delaware and having its principal place of business at Menlo Park, California. It is the ultimate parent of the Facebook group of companies. Facebook is joined as a defendant to these proceedings as Mr. Schrems’ complaint relates to the transfer of his data by Facebook to Facebook Inc. in the United States for processing. The DPC seeks no relief against either party. She joined them as defendants as they were the parties most concerned with the issues in order that they might engage fully in the proceedings. They have each done so.
5. The case raises issues of very major, indeed fundamental, concern to millions of people within the European Union and beyond. First, it is relevant to the data protection rights of millions of residents of the European Union. Secondly, it has implications for billions of euro worth of trade between the EU and the US and, potentially, the EU and other non-EU countries. It also has potentially extremely significant implications for the safety and security of residents within the European Union. There is considerable interest in the outcome of these proceedings by many parties having a very real interest in the issues at stake.
6. Applications were made by a number of parties to be joined or heard in the proceedings. In the event four parties were joined as amici curiae to the proceedings. These were the United States of America, the Business Software Alliance (BSA), Digital Europe and the Electronic Privacy Information Centre (EPIC). Each of these parties made submissions at the hearing but were not permitted to adduce evidence before the court.
Legal Framework
The Charter of Fundamental Rights of the European Union (“the Charter”)
Respect for private and family life
Everyone has the right to respect for his or her private and family life, home and communications.
Article 8
Protection of personal data
1. Everyone has the right to the protection of personal data concerning him or her.
2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. Everyone has the right of access to data which has been collected concerning him or her, and the right to have it rectified.
3. Compliance with these rules shall be subject to control by an independent authority.
Article 47
Right to an effective remedy and to a fair trial
Everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down in this Article.
Everyone is entitled to a fair and public hearing within a reasonable time by an independent and impartial tribunal previously established by law. Everyone shall have the possibility of being advised, defended and represented.
Legal aid shall be made available to those who lack sufficient resources in so far as such aid is necessary to ensure effective access to justice.
Article 51
Field of application
Scope and interpretation of rights and principles
1. Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others....
3. In so far as this Charter contains rights which correspond to rights guaranteed by the Convention for the Protection of Human Rights and Fundamental Freedoms, the meaning and scope of those rights shall be the same as those laid down by the said Convention. This provision shall not prevent Union law providing more extensive protection.
The Treaty on the functioning of the European Union (2012/C326/47) (“the TFEU”)
Article 16
(ex Article 286 TEC)
1. Everyone has the right to the protection of personal data concerning them.
2. The European Parliament and the Council, acting in accordance with the ordinary legislative procedure, shall lay down the rules relating to the protection of individuals with regard to the processing of personal data by Union institutions, bodies, offices and agencies, and by the Member States when carrying out activities which fall within the scope of Union law, and the rules relating to the free movement of such data. Compliance with these rules shall be subject to the control of independent authorities.
The rules adopted on the basis of this Article shall be without prejudice to the specific rules laid down in Article 39 of the Treaty on European Union.
Article 267
(ex Article 234 TEC)
The Court of Justice of the European Union shall have jurisdiction to give preliminary rulings concerning:
(a) the interpretation of the Treaties;
(b) the validity and interpretation of acts of the institutions, bodies, offices or agencies of the Union;
Where such a question is raised before any court or tribunal of a Member State, that court or tribunal may, if it considers that a decision on the question is necessary to enable it to give judgment, request the Court to give a ruling thereon…..
Treaty on the European Union (2012/C326/13) (“TEU”)
Article 4
1. In accordance with Article 5, competences not conferred upon the Union in the Treaties remain with the Member States.
2. The Union shall respect the equality of Member States before the Treaties as well as their national identities, inherent in their fundamental structures, political and constitutional, inclusive of regional and local self-government. It shall respect their essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security. In particular, national security remains the sole responsibility of each Member State.
3. Pursuant to the principle of sincere cooperation, the Union and the Member States shall, in full mutual respect, assist each other in carrying out tasks which flow from the Treaties….
Article 5
(ex Article 5 TEC)
1. The limits of Union competences are governed by the principle of conferral. The use of Union competences is governed by the principles of subsidiarity and proportionality.
2. Under the principle of conferral, the Union shall act only within the limits of the competences conferred upon it by the Member States in the Treaties to attain the objectives set out therein. Competences not conferred upon the Union in the Treaties remain with the Member States.
3. Under the principle of subsidiarity, in areas which do not fall within its exclusive competence, the Union shall act only if and in so far as the objectives of the proposed action cannot be sufficiently achieved by the Member States, either at central level or at regional and local level, but can rather, by reason of the scale or effects of the proposed action, be better achieved at Union level….
The Directive
Recitals
(2) Whereas data-processing systems are designed to serve man; whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy, and contribute to economic and social progress, trade expansion and the well-being of individuals;
(10) Whereas the object of the national laws on the processing of personal data is to protect fundamental rights and freedoms, notably the right to privacy, which is recognized both in Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms and in the general principles of Community law; whereas, for that reason, the approximation of those laws must not result in any lessening of the protection they afford but must, on the contrary, seek to ensure a high level of protection in the Community;
(13) Whereas the acitivities referred to in Titles V and VI of the Treaty on European Union regarding public safety, defence, State security or the acitivities of the State in the area of criminal laws fall outside the scope of Community law, without prejudice to the obligations incumbent upon Member States under Article 56 (2), Article 57 or Article 100a of the Treaty establishing the European Community; whereas the processing of personal data that is necessary to safeguard the economic well-being of the State does not fall within the scope of this Directive where such processing relates to State security matters;
(16) Whereas the processing of sound and image data, such as in cases of video surveillance, does not come within the scope of this Directive if it is carried out for the purposes of public security, defence, national security or in the course of State activities relating to the area of criminal law or of other activities which do not come within the scope of Community law;
(43) Whereas restrictions on the rights of access and information and on certain obligations of the controller may similarly be imposed by Member States in so far as they are necessary to safeguard, for example, national security, defence, public safety, or important economic or financial interests of a Member State or the Union, as well as criminal investigations and prosecutions and action in respect of breaches of ethics in the regulated professions; whereas the list of exceptions and limitations should include the tasks of monitoring, inspection or regulation necessary in the three last-mentioned areas concerning public security, economic or financial interests and crime prevention; whereas the listing of tasks in these three areas does not affect the legitimacy of exceptions or restrictions for reasons of State security or defence;
(56) Whereas cross-border flows of personal data are necessary to the expansion of international trade; whereas the protection of individuals guaranteed in the Community by this Directive does not stand in the way of transfers of personal data to third countries which ensure an adequate level of protection; whereas the adequacy of the level of protection afforded by a third country must be assessed in the light of all the circumstances surrounding the transfer operation or set of transfer operations;
(57) Whereas, on the other hand, the transfer of personal data to a third country which does not ensure an adequate level of protection must be prohibited;
(58) Whereas provisions should be made for exemptions from this prohibition in certain circumstances where the data subject has given his consent, where the transfer is necessary in relation to a contract or a legal claim, where protection of an important public interest so requires, for example in cases of international transfers of data between tax or customs administrations or between services competent for social security matters, or where the transfer is made from a register established by law and intended for consultation by the public or persons having a legitimate interest; whereas in this case such a transfer should not involve the entirety of the data or entire categories of the data contained in the register and, when the register is intended for consultation by persons having a legitimate interest, the transfer should be made only at the request of those persons or if they are to be the recipients;
(59) Whereas particular measures may be taken to compensate for the lack of protection in a third country in cases where the controller offers appropriate safeguards; whereas, moreover, provision must be made for procedures for negotiations between the Community and such third countries;
(60) Whereas, in any event, transfers to third countries may be effected only in full compliance with the provisions adopted by the Member States pursuant to this Directive, and in particular Article 8 thereof;
Articles
Object of the Directive
Definitions
For the purposes of this Directive:
(a) 'personal data' shall mean any information relating to an identified or identifiable natural person ('data subject'); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity;
(b) 'processing of personal data' ('processing') shall mean any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction;
(d) 'controller' shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data; where the purposes and means of processing are determined by national or Community laws or regulations, the controller or the specific criteria for his nomination may be designated by national or Community law;
(e) 'processor' shall mean a natural or legal person, public authority, agency or any other body which processes personal data on behalf of the controller;
Article 3
Scope
1. This Directive shall apply to the processing of personal data wholly or partly by automatic means, and to the processing otherwise than by automatic means of personal data which form part of a filing system or are intended to form part of a filing system.
2. This Directive shall not apply to the processing of personal data:
- in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law,
- by a natural person in the course of a purely personal or household activity.
Article 13
Exemptions and restrictions
1. Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6 (1), 10, 11 (1), 12 and 21 when such a restriction constitutes a necessary measures to safeguard:
(a) national security;
(b) defence;
(c) public security;
(d) the prevention, investigation, detection and prosecution of criminal offences, or of breaches of ethics for regulated professions;
(e) an important economic or financial interest of a Member State or of the European Union, including monetary, budgetary and taxation matters;
(f) a monitoring, inspection or regulatory function connected, even occasionally, with the exercise of official authority in cases referred to in (c), (d) and (e);
Article 25
Principles
1. The Member States shall provide that the transfer to a third country of personal data which are undergoing processing or are intended for processing after transfer may take place only if, without prejudice to compliance with the national provisions adopted pursuant to the other provisions of this Directive, the third country in question ensures an adequate level of protection.
2. The adequacy of the level of protection afforded by a third country shall be assessed in the light of all the circumstances surrounding a data transfer operation or set of data transfer operations; particular consideration shall be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country.
3. The Member States and the Commission shall inform each other of cases where they consider that a third country does not ensure an adequate level of protection within the meaning of paragraph 2.
4. Where the Commission finds, under the procedure provided for in Article 31 (2), that a third country does not ensure an adequate level of protection within the meaning of paragraph 2 of this Article, Member States shall take the measures necessary to prevent any transfer of data of the same type to the third country in question.
5. At the appropriate time, the Commission shall enter into negotiations with a view to remedying the situation resulting from the finding made pursuant to paragraph 4.
6. The Commission may find, in accordance with the procedure referred to in Article 31 (2), that a third country ensures an adequate level of protection within the meaning of paragraph 2 of this Article, by reason of its domestic law or of the international commitments it has entered into, particularly upon conclusion of the negotiations referred to in paragraph 5, for the protection of the private lives and basic freedoms and rights of individuals.
Member States shall take the measures necessary to comply with the Commission's decision.
Article 26
Derogations
1. By way of derogation from Article 25 and save where otherwise provided by domestic law governing particular cases, Member States shall provide that a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2) may take place on condition that:
(a) the data subject has given his consent unambiguously to the proposed transfer; or
(b) the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of precontractual measures taken in response to the data subject's request; or
(c) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; or
(d) the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; or
(e) the transfer is necessary in order to protect the vital interests of the data subject; or
(f) the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.
2. Without prejudice to paragraph 1, a Member State may authorize a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights; such safeguards may in particular result from appropriate contractual clauses.
3. The Member State shall inform the Commission and the other Member States of the authorizations it grants pursuant to paragraph 2.
If a Member State or the Commission objects on justified grounds involving the protection of the privacy and fundamental rights and freedoms of individuals, the Commission shall take appropriate measures in accordance with the procedure laid down in Article 31 (2).
Member States shall take the necessary measures to comply with the Commission's decision.
4. Where the Commission decides, in accordance with the procedure referred to in Article 31 (2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.
Article 28
Supervisory authority
1. Each Member State shall provide that one or more public authorities are responsible for monitoring the application within its territory of the provisions adopted by the Member States pursuant to this Directive.
These authorities shall act with complete independence in exercising the functions entrusted to them.
2. Each Member State shall provide that the supervisory authorities are consulted when drawing up administrative measures or regulations relating to the protection of individuals' rights and freedoms with regard to the processing of personal data.
3. Each authority shall in particular be endowed with:
- investigative powers, such as powers of access to data forming the subject-matter of processing operations and powers to collect all the information necessary for the performance of its supervisory duties,
- effective powers of intervention, such as, for example, that of delivering opinions before processing operations are carried out, in accordance with Article 20, and ensuring appropriate publication of such opinions, of ordering the blocking, erasure or destruction of data, of imposing a temporary or definitive ban on processing, of warning or admonishing the controller, or that of referring the matter to national parliaments or other political institutions,
- the power to engage in legal proceedings where the national provisions adopted pursuant to this Directive have been violated or to bring these violations to the attention of the judicial authorities.
Decisions by the supervisory authority which give rise to complaints may be appealed against through the courts.
4. Each supervisory authority shall hear claims lodged by any person, or by an association representing that person, concerning the protection of his rights and freedoms in regard to the processing of personal data. The person concerned shall be informed of the outcome of the claim….
The European Convention on Human Rights (“the Convention”)
Right to respect for private and family life
1. Everyone has the right to respect for his private and family life, his home and his correspondence.
2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.
The Data Protection Act 1988-2003
10. (1) (a)The Commissioner may investigate, or cause to be investigated, whether
any of the provisions of this Act have been, are being or are likely to be contravened in relation to an individual either where the individual complains to him of a contravention of any of those provisions or he is otherwise of opinion that there may be such a contravention.
(b) Where a complaint is made to the Commissioner under paragraph (a) of this subsection, the Commissioner shall—
(i) investigate the complaint or cause it to be investigated, unless he is of opinion that it is frivolous or vexatious, and
(ii) if he or she is unable to arrange, within a reasonable time, for the amicable resolution by the parties concerned of the matter the subject of the complaint, notify in writing the individual who made the complaint of his or her decision in relation to it and that the individual may, if aggrieved by the decision, appeal against it to the Court under section 26 of this Act within 21 days from the receipt by him or her of the notification.
(1A) The Commissioner may carry out or cause to be carried out such investigations as he or she considers appropriate in order to ensure compliance with the provisions of this Act and to identify any contravention thereof.
(2) If the Commissioner is of opinion that a person has contravened or is contravening a provision of this Act (other than a provision the contravention of which is an offence), the Commissioner may, by notice in writing (referred to in this Act as an enforcement notice) served on the person, require him to take such steps as are specified in the notice within such time as may be so specified to comply with the provision concerned.
(3) Without prejudice to the generality of subsection (2) of this section, if the Commissioner is of opinion that a data controller has contravened section 2 (1) of this Act, the relevant enforcement notice may require him—
(a) to block, rectify, erase or destroy any of the data concerned, or
(b) to supplement the data with such statement relating to the matters dealt with by them as the Commissioner may approve of; and as respects data that are inaccurate or not kept up to date, if he supplements them as aforesaid, he shall be deemed not to be in contravention of paragraph (b) of the said section 2 (1).
(4) An enforcement notice shall—
(a) specify any provision of this Act that, in the opinion of the Commissioner, has been or is being contravened and the reasons for his having formed that opinion, and
(b) subject to subsection (6) of this section, state that the person concerned may appeal to the Court under section 26 of this Act against the requirement specified in the notice within 21 days from the service of the notice on him.
(5) Subject to subsection (6) of this section, the time specified in an enforcement notice for compliance with a requirement specified therein shall not be expressed to expire before the end of the period of 21 days specified in subsection (4) (b) of this section and, if an appeal is brought against the requirement, the requirement need not be complied with and subsection (9) of this section shall not apply in relation thereto, pending the determination or withdrawal of the appeal.
(6) If the Commissioner—
(a) by reason of special circumstances, is of opinion that a requirement specifiedin an enforcement notice should be complied with urgently, and
(b) includes a statement to that effect in the notice, subsections (4) (b) and (5) of this section shall not apply in relation to the notice, but the notice shall contain a statement of the effect of the provisions of section 26 (other than subsection (3)) of this Act and shall not require compliance with the requirement before the end of the period of 7 days beginning on the date on which the notice is served.
(7) On compliance by a data controller with a requirement under subsection (3) of this section, he shall, as soon as may be and in any event not more than 40 days after such compliance, notify—
(a) the data subject concerned, and
(b) if such compliance materially modifies the data concerned, any person to whom the data were disclosed during the period beginning 12 months before the date of the service of the enforcement notice concerned and ending immediately before such compliance unless such notification proves impossible or involves a disproportionate effort, of the blocking, rectification, erasure, destruction or statement concerned.
(8) The Commissioner may cancel an enforcement notice and, if he does so, shall notify in writing the person on whom it was served accordingly.
(9) A person who, without reasonable excuse, fails or refuses to comply with a requirement specified in an enforcement notice shall be guilty of an offence.
11. (1) The transfer of personal data to a country or territory outside the European Economic Area may not take place unless that country or territory ensures an adequate level of protection for the privacy and the fundamental rights and freedoms of data subjects in relation to the processing of personal data having regard to all the circumstances surrounding the transfer and, in particular, but without prejudice to the generality of the foregoing, to—
(a) the nature of the data,
(b) the purposes for which and the period during which the data are intended to be processed,
(c) the country or territory of origin of the information contained in the data,
(d) the country or territory of final destination of that information,
(e) the law in force in the country or territory referred to in paragraph (d),
(f) any relevant codes of conduct or other rules which are enforceable in that country or territory,
(g) any security measures taken in respect of the data in that country or territory,
and
(h) the international obligations of that country or territory.
(2) (a) Where in any proceedings under this Act a question arises—
(b) In paragraph (a) of this subsection ‘Community finding’ means a finding of the European Commission made for the purposes of paragraph (4) or (6) of Article 25 of the Directive under the procedure provided for in Article 31(2) of the Directive in relation to whether the adequate level of protection specified in subsection (1) of this section is ensured by a country or territory outside the European Economic Area.
(3) The Commissioner shall inform the Commission and the supervisory authorities of the other Member States of any case where he or she considers that a country or territory outside the European Economic Area does not ensure the adequate level of protection referred to in subsection (1) of this section.
(4) (a) This section shall not apply to a transfer of data if—
(i) the transfer of the data or the information constituting the data is required or authorised by or under—
(I) any enactment, or
(II) any convention or other instrument imposing an international obligation on the State,
(I) for the performance of a contract between the data subject and thedata controller, or
(II) for the taking of steps at the request of the data subject with a viewto his or her entering into a contract with the data controller,
(iv) the transfer is necessary—
(v) the transfer is necessary for reasons of substantial public interest,
(vi) the transfer is necessary for the purpose of obtaining legal advice or for the purpose of or in connection with legal proceedings or prospective legal proceedings or is otherwise necessary for the purposes of establishing or defending legal rights,
(vii) the transfer is necessary in order to prevent injury or other damage to the health of the data subject or serious loss of or damage to property of the data subject or otherwise to protect his or her vital interests, and informing the data subject of, or seeking his or her consent to, the transfer is likely to damage his or her vital interests,
(viii) the transfer is of part only of the personal data on a register established by or under an enactment, being—
and, in the case of a register referred to in clause (II) of this subparagraph, the transfer is made, at the request of, or to, a person referred to in that clause and any conditions to which such consultation is subject are complied with by any person to whom the data are or are to be transferred,
or
(ix) the transfer has been authorised by the Commissioner where the data controller adduces adequate safeguards with respect to the privacy and fundamental rights and freedoms of individuals and for the exercise by individuals of their relevant rights under this Act or the transfer is made on terms of a kind approved by the Commissioner as ensuring such safeguards.
(b) The Commissioner shall inform the European Commission and the supervisory authorities of the other states in the European Economic Area of any authorisation or approval under paragraph (a)(ix) of this subsection.
(c) The Commissioner shall comply with any decision of the European Commission under the procedure laid down in Article 31.2 of the Directive made for the purposes of paragraph 3 or 4 of Article 26 of the Directive.
(5) The Minister may, after consultation with the Commissioner, by regulations specify—
(a) the circumstances in which a transfer of data is to be taken for the purposes of subsection (4)(a)(v) of this section to be necessary for reasons of substantial public interest, and
(b) the circumstances in which such a transfer which is not required by or under an enactment is not to be so taken.
(6) Where, in relation to a transfer of data to a country or territory outside the European Economic Area, a data controller adduces the safeguards for the data subject concerned referred to in subsection (4)(a)(ix) of this section by means of a contract embodying the contractual clauses referred to in paragraph 2 or 4 of Article 26 of the Directive, the data subject shall have the same right—
(a) to enforce a clause of the contract conferring rights on him or her or relatingto such rights, and
(b) to compensation or damages for breach of such a clause, that he or she would have if he or she were a party to the contract.
(7) The Commissioner may, subject to the provisions of this section, prohibit the transfer of personal data from the State to a place outside the State unless such transfer is required or authorised by or under any enactment or required by any convention or other instrument imposing an international obligation on the State.
(8) In determining whether to prohibit a transfer of personal data under this section, the Commissioner shall also consider whether the transfer would be likely to cause damage or distress to any person and have regard to the desirability of facilitating international transfers of data.
(9) A prohibition under subsection (7) of this section shall be effected by the service of a notice (referred to in this Act as a prohibition notice) on the person proposing to transfer the data concerned.
(10) A prohibition notice shall—
(a) prohibit the transfer concerned either absolutely or until the person aforesaid has taken such steps as are specified in the notice for protecting the interests of the data subjects concerned,
(b) specify the time when it is to take effect,
(c) specify the grounds for the prohibition, and
(d) subject to subsection (12) of this section, state that the person concerned may appeal to the Court under section 26 of this Act against the prohibition specified in the notice within 21 days from the service of the notice on him or her…..
Overview of the legislation
7. Article 7 of the Charter provides that everyone has the right to respect for his or her private life, home and communication. This largely reflects Article 8 of the Convention. Article 8 of the Charter confers the right of protection of personal data. This is also protected by Article 16 of TFEU. Article 8 (1) of the Charter provides that everyone has the right to protection of personal data concerning him or her. Article 8 (2) provides that such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law. It provides that everyone has a right of access to data which has been collected concerning him or her and the right to have it rectified. Article 8 (3) provides that compliance with the rules of Article 8 shall be subject to control by an independent authority.
8. Article 47 of the Charter provides that everyone whose rights and freedoms guaranteed by the law of the Union are violated has the right to an effective remedy before a tribunal in compliance with the conditions laid down by Article 47. These include a fair and public hearing within a reasonable time by an independent and impartial tribunal previously established by law.
9. Article 52 recognises that the rights and freedoms recognised by the Charter may be limited but any such limitation must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, the limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the union or the need to protect the rights and freedoms of others.
10. Article 1 of the Directive requires Member States to protect the fundamental rights and freedoms of natural persons and in particular their right to privacy with respect to the processing of personal data. The Directive is primarily directed towards the processing of personal data and the free movement of such data within the EEA. Chapter IV of the Directive deals with the transfer of personal data outside of the EEA to third countries.
11. Article 25 (1) of the Directive establishes a general rule prohibiting the transfer of personal data outside the EEA unless the country to which the data is transferred “ensures an adequate level of protection” for the data protection rights of those data subjects to whom the transferred data relates. The adequacy of the level of protection available within a third country is to be assessed by reference to criteria set out in Article 25 (2) of the Directive.
12. The Commission is authorised to make a finding to the effect that a specified third country does not ensure an adequate level of protection for the data protection rights of data subjects. Article 25 (6) confers a power on the Commission to make a finding that a particular third country ensures an adequate level of protection so that in principle personal data may be transferred from any EEA member state to that third country. Where the Commission makes a finding pursuant to Article 25 (6) then the Member States are required to take the measures necessary to comply with the Commission’s decision.
13. Article 26 permits the transfer of data to third countries which do not ensure an adequate level of protection as they do not satisfy the criteria set out in Article 25. It thus permits transfers to be undertaken even if it is accepted that the third country to which the data is to be transferred does not ensure an adequate level of protection. Article 26 (1) sets out six specific circumstances in which data transfers to a third country may be permissible even though the third country in question does not ensure an adequate level of protection, such as for example whether the data subject gives consent to the transfer pursuant to Article 26 (1) (a).
14. Article 26 (2) provides that, without prejudice to Article 26 (1), a Member State may authorise a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2) where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regard the exercise of the corresponding rights. Article 26 (2) specifically states that such safeguards may in particular result from “appropriate contractual clauses”.
15. Article 26 (4) of the Directive provides that, in accordance with the procedure referred to in Article 31 (2) of the Directive, the Commission may decide that certain contractual clauses offer sufficient safeguards as required by Article 26 (2). Where the Commission makes a decision in such terms the member states are obliged to take the necessary measures to comply with the Commission’s decision.
16. Where the Commission decides that certain contractual clauses provide sufficient safeguards for the protection of individuals’ data protection rights pursuant to decisions made under Article 26 (4) and those particular contractual clauses are incorporated into contracts regulating the terms of transfer of personal data to data controllers or data processers established in a third country, such transfers are, in principle, permissible, even if the third country in question does not ensure an adequate level of protection.
17. The Directive was transposed into national law by means of the Data Protection Act 1988 and the Data Protection Amendment Act 2003 (collectively the Data Protection Acts 1988-2003). The DPC is the national supervisory authority in the State for the purposes of the Directive. Section 11 (2) of the Acts provides that where a finding has been made by the Commission to the effect that a third country ensures adequate protection for the data privacy rights of data subjects, that finding is binding in any proceedings under the Acts. Section 11 (4) (c) of the Acts provides that where the Commission has adopted a decision approving particular standard contractual clauses as fulfilling the requirements of Article 26 (4) of the Directive, the DPC shall comply with that decision.
The Factual Background
18. On the 26th of July, 2000, the Commission adopted Decision 2000/520/EC of 26th July, 2000, pursuant to the Directive on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the United States Department of Commerce (“the Safe Harbour Decision”) establishing the so called “Safe Harbour” arrangements for data transfers from the EU to the US. The Safe Harbour Decision did not identify the US as a third country recognised as ensuring “an adequate level of protection” for the purposes of Article 25 (6) of the Directive. It provided that EU-US transfers were permissible under the terms of the Safe Harbour Decision provided the entity to whom the data was being transferred self certified that it complied with (1) the Safe Harbour privacy principles; and (2) a set of “frequently asked questions”, both published by the US Department of Commerce and incorporated into the Safe Harbour Decision at Annexes 1 and 2.
19. Since the adoption of the Safe Harbour Decision, the importance of transfers of data from the EU to the US increased substantially reflecting exponential growth in the volume of EU-US data transfers generated by business undertakings of all sizes and all industry sectors and by the general explosion in the volume of data created by modern technology and the increasing importance of data transfers globally. The Safe Harbour Decision became an important mechanism by which certain data controllers established in the EU sought to transfer data to the US for processing. Due to the history of the evolution of the internet, much of the processing of data occurs in companies established in the US.
20. In June, 2013, Mr. Edward Snowden, a contractor engaged through a private company working for the United States National Security Agency (“NSA”) disclosed documents said to reveal the existence of one or more programmes operated by the NSA under which internet and telecommunications systems operated by some of the world’s largest technology companies including, by way of example, Microsoft, Apple, Facebook and others, were the subject of surveillance programmes.
21. On the 25th of June, 2013, Mr. Schrems filed a complaint with the DPC in relation to the processing of his personal data by Facebook. He contended that in the light of Mr. Snowden’s disclosures, the transfer of his personal data by Facebook to its US parent, Facebook Inc. for processing was unlawful both under national and EU law.
22. The DPC took the view that as the Commission had adopted the Safe Harbour Decision establishing and/or endorsing the Safe Harbour arrangements, the DPC was bound to accept the Safe Harbour Decision as binding upon him in light of Article 25 (6) of the Directive and s. 11 (2) of the Acts. On that basis, the DPC declined to investigate Mr. Schrems’ complaint, deeming it unsustainable in law.
23. Mr. Schrems instituted judicial review proceedings on the 21st of October, 2013, seeking orders to quash the DPC’s refusal to investigate his complaint and directing the DPC to investigate and decide his complaint on its merits.
24. On the 18th of June, 2014, the High Court (Hogan J.) held that it would be appropriate to refer a number of questions to the CJEU so that the CJEU could in turn determine, in particular, whether the DPC was bound absolutely by the Safe Harbour Decision having regard to Articles 7, 8 and 47 of the Charter notwithstanding the provisions of Article 25 (6) of the Directive. The court considered that a reference was necessary in circumstances where the essence of the complaint concerned the terms of the Safe Harbour Decision rather than the manner in which the DPC had applied it.
25. The CJEU delivered its ruling on the reference on the 6th of October, 2015. The court held that: -
(1) While noting that the CJEU alone has jurisdiction to declare an EU act invalid, and that, until such time as the Safe Harbour Decision was declared invalid by the CJEU, the [DPC] was not at liberty to adopt any measure contrary to its terms, the CJEU nonetheless found that, as a matter of EU law, the Safe Harbour Decision did not preclude the conduct of an investigation into the EU-US data transfers by the [DPC] so that the [DPC] ought properly to have investigated Mr Schrems’ complaint with all due diligence.
(2) Where a person whose personal data has been or could be transferred to a third country which has been the subject of a Commission decision pursuant to Article 25 (6) of the Directive lodges with a national supervisory authority a claim concerning the protection of his rights and freedoms in regard to the processing of that data and contests, in bringing the claim, the compatibility of that decision with the protection of the privacy and of the fundamental rights and freedoms of individuals, it is incumbent upon the national supervisory authority to examine the claim with all due diligence.
(3) In a situation where the national supervisory authority comes to the conclusion that the arguments put forward in support of such a claim are unfounded and therefore rejects it, the person who lodged the claim must, as is apparent from the second sub paragraph of Article 28 (3) of the Directive read in the light of Article 47 of the Charter, have access to judicial remedies enabling him to challenge such decision adversely affecting him before the national courts. The national courts must stay proceedings and make a reference to the CJEU for a preliminary ruling on validity where they consider that one or more grounds for invalidity put forward by the parties or, as the case may be, raised by them of their own motion, are well founded.
(4) In the converse situation, where the national supervisory authority considers that the objections advanced by the person who has lodged with it a claim concerning the protection of his rights and freedoms in regard to the processing of his personal data are well founded, that authority must, in accordance with the third indent of the first paragraph of Article 28 (3) of the Directive read in the light in particular of Article 8 (3) of the Charter, be able to engage in legal proceedings.
(5) It is incumbent upon the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers well founded before the national courts in order for them, if they share its doubts as to the validity of the Commission decision, to make a reference for a preliminary ruling for the purpose of examination of the decision’s validity.
(6) The Safe Harbour Decision of the Commission was invalid.
Thus, data could no longer lawfully be transferred from the EU to the US pursuant to the Safe Harbour Decision.
26. After the ruling of the CJEU the judicial review proceedings came back before the High Court. On the 20th of October, 2015, the High Court made an Order quashing the decision of the DPC to refuse to investigate Mr. Schrems’ complaint and remitted the complaint back to the DPC for investigation.
27. Following the ruling in Schrems and the determination of the judicial review proceedings, the DPC commenced an investigation into Mr. Schrems’ complaint. Mr. Schrems was invited to reformulate his complaint as it was no longer appropriate to focus upon the Safe Harbour Decision which had been declared invalid. The DPC informed Facebook that it had commenced an investigation into Mr. Schrems’ complaint regarding the transfer of his personal data by Facebook to Facebook Inc.
Mr. Schrems’ Reformulated Complaint
28. Mr. Schrems states that Facebook forwards his personal data to Facebook Inc. in the United States of America where his data is processed. Facebook Inc. is subject to a number of known and secret laws, rules, court decisions and executive orders that oblige it to make his personal data available and/or oblige it to disclose it to US authorities, such as, for example, the National Security Agency (NSA) and the Federal Bureau of Investigations (FBI). He alleges that US law targets data rather than people and that there is no judicial remedy that would allow the data subject to take appropriate action. He complains that non-US persons are not covered by constitutional protections in the United States. He says that Facebook Inc. is subject to “gag orders” that order it to deny and/or not to disclose any facts about government surveillance systems to which it is subject. He says that the United States authorities have access to data held by Facebook Inc., among other US based companies. He states that there is clear evidence that leads him to believe that his personal data controlled by Facebook and processed by Facebook Inc. is at the very least “made available” to US government authorities under various known and unknown legal provisions and spy programmes such as the “PRISM” programme (which I explain more fully below). He also believes that there is a likelihood that his personal data has, in addition, been accessed under these provisions as he was prevented from boarding a transatlantic flight on the 16th of March, 2012, to the United States for reasons of “national security”.
29. He states that under Article 2 (b) of the Directive making data available is a form of processing so that even if his personal data is never accessed by any US government agency, the mere fact that Facebook Inc. is obliged to make this data available to various government agencies in accordance with US law engages the provisions not only of the Directive but also of Article 8 of the Charter.
30. His complaint relates to two operations: first, the transfer and/or disclosure of his personal data from Facebook to Facebook Inc and secondly the subsequent processing. He says that “the operation of the “mass surveillance” systems in the United States is therefore only a secondary matter that has to be taken into account when assessing the legality of the relevant processing operation – which is the transfer from “Facebook Ireland Ltd.” to “Facebook Inc.””. He makes no complaint about the manner in which Facebook Inc. processes his data if it is in compliance with the SCCs.
31. In order to reformulate his complaint Mr. Schrems’ solicitors wrote to Facebook on 12th October, 2015, requesting that it identify all legal bases upon which it relies to transfer Mr. Schrems’ data to the US. In reply on the 27th of November, 2015, Facebook did not identify all such legal bases. It referred to a data transfer and processing agreement between Facebook and Facebook Inc. effective as of 20th November, 2015, (7 days earlier) and relied upon the standard contractual clauses decision of the Commission 2010/87/EU (one of the three SCC decisions). The agreement of the 20th of November, 2015, refers to other intragroup agreements in the Facebook group of companies and to the Data Hosting Services Agreement between Facebook and Facebook Inc. dated September 15, 2010. These agreements have not been disclosed. Mr. Schrems therefore argues that if these agreements alter the annex to the agreement of November, 2015 (which incorporates the standard contractual clauses) in any way then Facebook is not entitled to transfer data pursuant to Commission decision 2010/87/EU. In addition, he points out that the agreement of November, 2015 does not cover all processing operations by Facebook Inc. and it does not include the necessary arrangements with subprocessers.
32. As a result, he says that the DPC is not bound by Decision 2010/87/EU pursuant to the provisions of Article 26 (4) of the Directive or s. 11 (2) of the Data Protection Acts as Facebook in fact is not transferring his data to Facebook Inc. pursuant to that decision.
33. He then says: -
He argues that the PRISM programme violates the essence of Article 7 and 47 of the Charter and that this was established by the CJEU in the decision in Schrems and is binding on the DPC. He therefore requests the DPC to issue a prohibition notice under s. 11 (7) to (15) of the Data Protection Acts, an enforcement notice under s. 10 (2) to (9) and to take any other appropriate steps to suspend all data flows from Facebook to Facebook Inc.
The DPC’s Investigation
34. The DPC examined Mr. Schrems’ reformulated complaint as it related to interferences on national security grounds with his data privacy rights by governmental agencies in the United States. She examined whether, by reference to the adequacy criteria identified in Article 25 (2) of the Directive, the US ensures adequate protection for the data protection rights of EU citizens and if and to the extent that the US does not ensure adequate protection, whether it is open to Facebook to rely on one or more of the derogations provided for in Article 26 of the Directive to legitimise the transfer of subscribers’ personal data to the US, if indeed such transfers continued to take place.
35. Her investigation proceeded on two distinct strands. Strand 1 comprised a factual investigation focused on establishing whether Facebook continued to transfer personal data to the US subsequent to the decision of the CJEU of 6th October, 2015, in Schrems. Facebook acknowledged that it continues to transfer personal data relating to Facebook’s subscribers resident in the European Union to its US established parent and that it does so, in large part, on the basis that it has adopted the standard contractual clauses set out in the annexes to the SCC decision 2010/87/EU. It therefore argues that it ensures adequate safeguards for the purposes of Article 26 (2) of the Directive with respect to the protection of the privacy and fundamental rights and freedoms of EU resident subscribers to the Facebook platform and as regards the exercise by such subscribers of their corresponding rights.
36. In Strand 2 of her investigation the DPC has sought to examine whether, by reference to the adequacy criteria identified in Article 25 (2) of the Directive, the US ensures adequate protection for the data protection rights of EU citizens. If it does not, she enquired whether the SCC decisions in fact offer adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of their corresponding rights.
37. The DPC engaged in a review of the remedies available for breach of data protection rights in US federal law. She says there appears to be well-founded objections that there are both specific and general deficiencies in the remedial mechanisms available under US law for those EU citizens whose data is transferred to the US. From a specific perspective, the remedies provided by US law are fragmented and subject to limitations that impact on their effectiveness to a material extent.
38. She says that further, the available remedies arise only in particular factual circumstances, and are not sufficiently broad and scoped to guarantee a remedy in every situation in which there has been an interference with the personal data of an EU data subject contrary to Articles 7 and 8 of the Charter. To that extent, the remedies are not complete.
39. From a more general perspective, the requirements of US law in relation to standing in respect of US federal courts operate as a constraint on all forms of relief available.
40. She therefore has formed the view that there appears to be a well-founded objection that there is an absence of an effective remedy in US law compatible with the requirements of Article 47 of the Charter for an EU citizen whose data is transferred to the US where it may be at risk of being accessed and processed by US State agencies for national security purposes in a manner incompatible with Articles 7 and 8 of the Charter. The safeguards purportedly constituted by the standard contractual clauses set out in the annexes to the SCC decisions do not appear to address this well-founded objection that there is an absence of a remedy compatible with Article 47 of the Charter. She is of the opinion that the standard contractual clauses approved by the SCC decisions do no more than establish a right in contract, in favour of data subjects, to a remedy against either or both of the data exporter and importer.
41. She notes that the SCC decisions are not binding on any US government agency or other US public body and they do not so purport. The SCC decisions make no provision whatsoever for a right in favour of data subjects to access an effective remedy in the event that their data is (or may be) the subject of interference by a US public authority, whether acting on national security grounds or otherwise. Thus, in her opinion, the SCC decisions do not address her well-founded concerns that she has identified.
42. In the circumstances, the DPC formed the view that she could not conclude her investigation without obtaining a ruling from the CJEU on the validity of the SCC decisions. In light of the ruling in Schrems, she believed that it was appropriate that she would commence these proceedings forthwith so that the substance of the reformulated complaint, and the view reached by the DPC in relation to that portion of the complaint could be examined and determined by a court of competent jurisdiction at the earliest possible opportunity.
What the Case is not About
43. Before considering the arguments of the parties in relation to the central issue whether the court should or should not refer the question of the validity of the SCC decisions to the CJEU for a ruling, it is important to say what this case is not about.
44. The case raises issues fundamental to democratic societies and the balance to be achieved in respect of sometimes competing rights, values and duties. It concerns the right to data privacy which is recognised as a fundamental right and freedom by the Charter and the TFEU. It also concerns the right, indeed the duty, of the State to protect itself and its citizens from threats to national security, terrorism and serious crime. A degree of surveillance for the purposes of national security, counter-terrorism and combating serious crime is vital for the safeguarding of the freedoms of all citizens of the union. This necessarily involves interference with the right to privacy, including data privacy.
45. A central purpose of the European Union is the promotion of the peace and prosperity of citizens of the European Union through economic and trading activity within the single market and globally. The free transfer of data around the world is now central to economic and social life in the union and elsewhere.
46. The recent history of our continent has shown how crucially important each of these objectives is to the wellbeing of the people of Europe. Damage to the global economy has resulted in very real detriment and hardship to millions of Europeans. International terrorist atrocities have been and continue to be perpetrated in many Member States of the European Union. There are many who experienced the corrosive effects of widespread state surveillance upon their private lives and society in general who regard preservation of the right to privacy, include data protection, as fundamental to a democratic society.
47. In a democratic society, a balance must be struck between these competing concerns, interests and values. Not every State will strike the same balance. One will place a greater emphasis on the right to privacy and one will place a greater emphasis on the requirements of national security. It is important to state that it is not the function of this court to assess, still less resolve, the relative merits of these positions.
48. The Directive with which this judgment is primarily concerned uses the word “adequate” and so this judgment will, of necessity, refer to the adequacy or inadequacy of certain laws or provisions of third countries and in particular of the United States. This does not involve a decision on the respective merits of the choices of the European Union (or its Member States) and the United States. The references to the adequacy or inadequacy of the provisions discussed in this judgment are references to the requirements laid down by the Directive. They do not constitute or reflect value judgments on the regime in the United States relating to data protection and surveillance by government agencies. It is not the function of this court to criticise the laws of a sovereign state, in this case, the United States, or to pronounce on the relative merits of the laws of the United States and the European Union. I do not purport to do so in this judgment.
49. Secondly, this case is not a judicial review of the draft decision of the DPC which she prepared prior to instituting these proceedings and which explains the history of the investigation into Mr. Schrems’ complaint and her concerns about the validity of the SCC decisions in light of certain aspects of the law of the United States. The court is concerned with the merits of the arguments advanced by the DPC and the parties to the proceedings. It is not concerned with the process leading to the presentation of the arguments to court. It follows that criticisms levelled at the DPC that she failed to consider certain relevant matters do not invalidate the proceedings. The matters she may not have addressed have been brought before the court by other parties and all of the issues have been extensively argued, including submissions by the United States, with a view to determining whether or not there is merit in the contention that the SCC decisions may be invalid having regard to the provisions of the Directive and the Charter.
Are EU law and the Charter Engaged?
Facebook’s Submissions
50. Facebook argues that this case is concerned with national security. National security issues fall outside the scope of EU law entirely because the treaties reserve competence over national security issues to Member States. It refers to Article 4 (2) of TEU which provides that: -
“The Union shall respect [Member States’]… essential State functions, including ensuring the territorial integrity of the State, maintaining law and order and safeguarding national security. In particular, national security remains the sole responsibility of each Member State.”
51. Facebook submits that EU law does not apply to the processing of personal data for national security purposes regardless of whether the processing takes place in the EU or in third countries such as the United States.
52. It submits that the Directive does not apply to processing for national security purposes. Article 3 (2) of the Directive provides: -
“This Directive shall not apply to the processing of personal data: in the course of an activity which falls outside the scope of Community law, such as those provided for by Titles V and VI of the Treaty on European Union and in any case to processing operations concerning public security, defence, State security (including the economic well-being of the State when the processing operation relates to State security matters) and the activities of the State in areas of criminal law…”
53. It refers to Recital 13 of the Directive which states: -
“… whereas the processing of personal data that is necessary to safeguard the economic well-being of the State does not fall within the scope of this Directive where such processing relates to State security matters.”
In addition, it refers to Recital 16 which notes that data processing for “national security” purposes or “in the course of state activities relating to the area of criminal law”, “does not come within the scope of the Directive.”
54. Facebook points out that a similar exemption in respect of national security applies under national laws. The Directive has been transposed into Irish law by the Data Protection Acts. Section 1 (4) of the Acts provides:
“This Act does not apply to-
(a) personal data that in the opinion of the Minister or the Minister for Defence are, or at any time were, kept for the purpose of safeguarding the security of the State…”
55. Facebook refers to Article 51 (2) of the Charter which provides that the Charter does not extend the field of the application of Union law beyond the powers of the Union. Facebook submits that if it is correct that EU law does not apply to processing for national security purposes, then the Charter is inapplicable by reason of the provisions of Article 51 (2). Facebook submits that as the Directive and the Charter do not apply to Ireland and other EU states when engaged in national security activities, as a corollary, there can be no requirement that the US, when engaging in similar activities, complies with EU data protection law.
56. It relied upon the judgment in jointed cases C-317/04 and C-318/04, European Parliament v. Council and the Commission EU:C:2006:356. In that case the European Parliament sought the annulment of a decision of the Council on the conclusion of an agreement between the European Community and the United States of America on the processing and transfer of passenger name record (“PNR data”) by Air Carriers to the United States Department of Homeland Security, Bureau of Customs and Border Protection (“the CBP”) and the annulment of Commission decision on the adequate protection of personal data contained in PNR of air passengers transferred to the CBP. The Commission’s decision was adopted pursuant to Article 25 (6) of the Directive. Parliament sought the annulment of the decision of the Commission on the basis that the Directive did not apply to the processing of personal data in the course of an activity outside Union law, in this case, processing operations concerning public security and the activities of the United States in areas of criminal law by reason of the provisions of Article 3 (2) first indent of the Directive.
57. The CJEU noted that the initial processing of data by airlines in handing over the PNR was within the scope of Union law but the decision of the Commission related to the processing by third countries, in this case the United States, and constituted processing regarded as necessary for safeguarding public security and for law enforcement purposes. The court held that the decision of the Commission concerned processing of personal data as referred to in the first indent of Article 3 (2) of the Directive. This meant that the Commission’s decision did not fall within the scope of the Directive. Thus, the decision was ultra vires the Commission and the court annulled the decision accordingly. The CJEU held that activities within the scope of Article 3 (2) of the Directive are activities of the State or State authorities and were unrelated to the fields of activity of individuals. The fact that the PNR data was collected by private operators (the airlines) for commercial purposes and it was they who arrange for the transfer of the data to the third country, does not mean that the transfer by the airlines to the United States CBP is thereby outside the scope of Article 3 (2).
58. Facebook’s argument is that Parliament v. The Council and Commission clearly covers the processing of data with which this case is concerned. Private data is collected by Facebook and transferred by Facebook to Facebook Inc. in the United States. It may then be subject to further processing by the United States intelligence agencies for the purposes of national security. Facebook submits that this brings the transfer within the scope of Article 3 (2) of the Directive and therefore outside the scope of the competence of Union law and, in particular, the scope of the Directive.
The DPC’s Submissions
59. The DPC distinguishes Parliament v. The Council and Commission from the facts in this case. In that case the private operators (the airlines) transferred all PNR data to the CBP before processing for reasons of public security and the activities of the State in areas of criminal law. There was no other, independent commercial reason for the transfer of the data. This is a crucial distinction. In this case, the transfers are pursuant to the SCC decisions. They are for commercial purposes by definition. In any country, not just the United States, the data could be subject to processing by the national intelligence agencies of the third countries. It cannot be known in advance of the transfer from the EU to the private operator in the third country which, if any, of the data will be subsequently processed for national security purposes by the third country’s intelligence agencies. If the argument advanced by Facebook is correct and subsequent processing in a third country by its intelligence agencies for national security purposes takes the processing outside of the scope of the Directive by reasons of the provisions of Article 3 (2) then, logically, all data transferred to third countries potentially falls within the scope of Article 3 (2) of the Directive. In view of the fact that the data cannot be identified in advance, it is impossible to say which data exported from the EU is entitled to the protections of Articles 25 and 26 and which data falls outside those protections by virtue of the provisions of Article 3 (2).
Discussion
60. If Facebook is correct in its submission that the entire subject matter of the case falls outside the scope of the law of the Union and the Charter, then this disposes of this case, and no reference for a ruling to CJEU should be made, as it would lack competence to rule on the validity of SCC decisions on the grounds advanced as the basis for such alleged invalidity.
61. I do not believe that the submission is correct for the following reasons:
(1) Article 4 (2) of TEU is concerned with the relationship between the European Union and its member states. It is not concerned with the national security of the United States. Therefore this does not assist Facebook in its submission.
(2) The submission is inconsistent with the ruling of the High Court in Schrems v. The Data Protection Commissioner [2014] 3 I.R. 75 and the CJEU in Schrems where the court proceeded on the basis that it had jurisdiction to rule on the reference. If Facebook’s submission in this case is correct, it did not have jurisdiction so to proceed. Eight Member States, the European Parliament, the European Commission and the European Data Protection Supervisor intervened in those proceedings. If Facebook’s point was well made, it is remarkable that none of these participants raised this fundamental matter of jurisdiction.
This is particularly so as the issue of the role of national security in the case was considered by Advocate General Bot who observed that “… there is nothing to suggest that arrangements for the transfer of personal data to third countries are excluded from the substantive scope of Article 8 (3) of the Charter....” (Section 72). He considered the fact that the US was processing the data of EU citizens for national security purposes was within the scope of the Charter. At s. 170 he stated that: -
“… any form of processing of personal data is covered by Article 8 of the Charter and constitutes an interference with the right to protection of such data. The access enjoyed by the United States intelligence services to the transferred data therefore also constitutes an interference with the fundamental right to protection of personal data guaranteed in Article 8 of the Charter, since such access constitutes a processing of that data.”
(3) The argument is inconsistent with the views of the Article 29 working party. It observed that the fact that national security activities of Member States are excluded from the scope of application of EU law does not mean that EU law ceases to apply. This means that data subject to EU data protection law remains subject to such law when it is accessed by third countries in the name of the national security of such third countries. (Working document on surveillance of electronic communications for intelligence and national security purposes, 5th December, 2014, s. 4.1.2).
(4) This case is concerned with processing consisting of the transfer of data by a private company from a Member State to a private company in a third country. Thereafter, the data may be processed in the third country, the United States, for the purposes of national security, counter-terrorism and the prevention and detection of serious crime. The processing that arises for consideration is not solely the processing of data by the United States in its surveillance activities. Furthermore, the processing concerns commercial activities. This is not processing concerning public security, defence or state security. The parties to the transfers effected under the SCC decisions are private persons and companies, not State actors. The processing of the data by the United States subsequent to the transfer is unknown and uncertain. At the point of transfer it will not be known which data (if any) will be subject to surveillance. It follows that it cannot be said that the transfers concern public security or are for the purposes of national security. The argument is inconsistent with the case Tele 2 Sverige AB v. Post-och telestyrelsen and Secretary of State for the Home Department v. Tom Watson & Ors (joined cases C-203/15 and C-698/15) (hereinafter “Watson”). The case concerned the interpretation of Article 15 (1) of the Directive 2002/58/EC (the e-Directive). The legislation under review included measures adopted in Sweden and the United Kingdom for reasons of national security. The CJEU held that the national legislation fell within the scope of the e-Directive, notwithstanding Article 1 (3) of that Directive which excluded from its scope “activities of the state” in specified fields, including activities of the State in areas of criminal law and in the areas of public security, defence and State security, including the economic well being of the State, when the activities relate to state security matters by analogy with the first indent of Article 3 (2) of Directive 95/46. (see paras. 69 and 81)
(5) The argument is also inconsistent with the views of the Commission (and apparently the United States). On the 12th of July, 2016, the Commission adopted Commission Implementing Decision (EU) 2016/1250 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-US PRIVACY SHIELD (“the Privacy Shield Decision”). The Privacy Shield Decision was adopted pursuant to the Directive and is directly concerned with data transfers to the United States and the potential subsequent processing of the transferred data pursuant to US national security surveillance operations. If the objection of Facebook in relation to national security is correct then it is difficult to understand why both the Commission and the United States engaged in extensive negotiations with the Commission and concluded the Privacy Shield Agreement or why the government of the United States gave the undertakings included in that agreement (as is more fully discussed below). Further, if Facebook is correct, the Privacy Shield Decision must be outside the competence of the Commission and accordingly be invalid. Far from arguing that the Privacy Shield Decision was invalid, Facebook argues, as is more fully set out below, that the decision is valid and binding.
(6) The argument of Facebook would entirely hollow out EU data protection law. If potential unknown, uncertain and ill defined processing of data to achieve the national security objects of a third country can remove a data transfer from the scope of Union law, the entire system of monitoring data transfers falls away and is completely hollowed out. At the point of transfer of data from the member state to the third country, it will not be known which data may be processed by the third country for national security purposes. There can be no way of segregating the data that may ultimately subsequently be processed for national security purposes from the data which will not be scrutinised. On the argument advanced by Facebook, the transfer of the former data is outside the scope of the Directive, where the latter is not. If the argument were valid, the possibility that data may subsequently be processed for national security purposes by a third country would then suffice to remove all transfers of data outside the EEA from the protection of Union law. It would follow that all of the provisions relating to data transfers to third countries in the Directive would be rendered purposeless if such data transfers fell outside the scope of the Directive based upon the national security surveillance activities of third countries.
Does the Privacy Shield Decision Preclude the Making of a Reference to the CJEU?
62. Member States of the Union are required to ensure that decisions of the institutions of the Union, including the Commission, are complied with within each member state. Article 25 (6) of the Directive provides that member states shall take the measures necessary to comply with an adequacy decision of the Commission adopted in accordance with Article 25. In Ireland, this is achieved by s. 11 (2) of the Acts.
63. On the 12th of July, 2016, the Commission adopted the Privacy Shield Decision for the purposes of Article 25 (2) of the Directive.
Facebook’s Submissions
64. Facebook submits that the Privacy Shield Decision is a decision of the Commission adopted under the procedure provided for in Article 31 (2) and that it was a finding made for the purposes of Article 25 (6) of the Directive. It argues therefore that the proceedings before this national court were required to be determined in accordance with that finding on the basis of the provisions of s. 11 (2) of the Acts implementing Article 25 (6) of the Directive. It points out that neither Mr. Schrems nor the DPC challenge the Privacy Shield Decision and that the decision is binding upon the court. A reference to the CJEU in relation to the validity of the SCC decisions on the basis of concerns about the inadequacy of the protections afforded to EU data subjects in respect of interference with their personal data once it has been transferred to the United States, would amount to an impermissible collateral attack on the validity of the Privacy Shield Decision. As the decision is binding upon the national court, it precludes the making of the reference sought by the DPC.
Discussion
65. The submission is predicated upon the argument that the Privacy Shield Decision constitutes an adequacy decision in respect of the United States. The Privacy Shield Decision is a decision that: -
It is therefore confined to data transferred to organisations in the United States under the EU-US Privacy Shield. This involves companies signing up to detailed principles set out in the Privacy Shield Decision and processing data solely in accordance with those principles.
66. Facebook is not relying on the Privacy Shield Decision to transfer data the subject of this case to Facebook Inc. in the United States. This case is concerned with the transfers of data pursuant to the SCC decisions.
67. Facebook argues that the Privacy Shield Decision is a decision as to the adequacy of the laws and protections of the United States generally for the purposes of Article 25 (2) of the Directive. In my opinion, this characterisation of the decision is incorrect. Only data transferred and processed in accordance with the very detailed provision set out in the Privacy Shield Decision and its Annexes is deemed to be adequately protected. A data controller could not transfer data to the United States in a manner that did not comply with the requirements of the Privacy Shield Decision (including for example, self-certification that it adheres to the principles mandated by the Decision) and claim that such transfer was lawful based upon the provisions of Article 25 (2) of the Directive. In my opinion, it is not permissible to parse a decision of the Commission so as to isolate one element of the decision and then apply that element to a separate decision or decisions of the Commission on the basis that the former decision is binding upon inter alia national courts of Member States. It is not a decision that the United States of America affords adequate protection of personal data transferred from the Union to the United States in all circumstances.
68. The difference between the Privacy Shield Decision and a comprehensive Article 25 (2) adequacy decision is illustrated by contrasting it with the adequacy decision in respect of transfers of personal data to the State of Israel of 31st January, 2011, Com. Decision 2011/6//EU (C(2011) 332).
69. Article 1 of that decision provides: -
“1. For the purposes of Article 25(2) of Directive 95/46/EC, the State of Israel is considered as providing an adequate level of protection for personal data transferred from the European Union in relation to automated international transfers of personal data from the European Union or, where they are not automated, they are subject to further automated processing in the State of Israel.”.
70. In 2013 the Commission had expressed concerns in relation to the adequacy of protections afforded to personal data of EU data subjects in the United States in a Communication from the Commission to the European Parliament and Council on the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU COM (2013) 847 Final. In particular it identified concerns it had in relation to individual remedies available in the United States. It identified concerns that EU data subjects did not have avenues of redress in respect of some legal bases for surveillance by US intelligence agencies (for example Executive Order 12333 discussed below). It was also concerned that when causes of action do exist in the US they are limited in a manner inconsistent with the decision of the CJEU in Schrems (para. 89) and other cases and that claims are limited by what it described as restrictive rules in the United States on standing to bring proceedings.
71. The solution devised by the Commission and the government of the United States was to adopt the Privacy Shield Decision, not an unconditional adequacy decision.
72. For these reasons, I am of the opinion that the adoption of the Privacy Shield Decision by the Commission is not binding and determinative of the issue as to whether the transfer of personal data by Facebook to Facebook Inc. pursuant to one of the SCC decisions (that of 2010) is valid.
73. In any event, the court is obliged to consider whether a genuine or well founded issue as to the validity of a decision of the Commission arises. It cannot abdicate its responsibilities in this regard on the basis of the terms of Article 25 (6) of the Directive and s. 11 (2) of the Acts. This is clear from the ruling in Schrems.
74. The Safe Harbour Decision was likewise a community finding within the meaning of the s. 11 (2) of the Acts and Article 25 (6) of the Directive. It had been adopted by the Commission pursuant to the provisions of Article 31 (2) and Article 25 (6) of the Directive. The High Court in Schrems v. The Data Protection Commissioner held that the conclusion that Mr. Schrems’ complaint was unsustainable in law because of the Commission’s Safe Harbour Decision was central to the entire case. The court held that Mr. Schrems’ objection in reality was to the terms of the Safe Harbour regime itself. The court interpreted the central question to be whether the DPC was as a matter of European Union law, absolutely bound to follow the decision of the Commission. It therefore referred the question to the CJEU for a preliminary ruling in the following terms: -
(1) Whether in the course of determining a complaint which has been made to an independent office holder who has been vested by statute with the functions of administering and enforcing data protection legislation that personal data is being transferred to another third country (in this case, the United States of America) the laws and practices of which, it is claimed, do not contain adequate protections for the data subject, that office holder is absolutely bound by the Community finding to the contrary contained in [Decision 2000/520] having regard to Article 7, Article 8 and Article 47 of [the Charter], the provisions of Article 25(6) of Directive [95/46] notwithstanding?
(2) Or, alternatively, may and/or must the office holder conduct his or her own investigation of the matter in the light of factual developments in the meantime since that Commission decision was first published?
75. Neither the High Court nor the CJEU suggested that the High Court was not competent to make a reference to the CJEU on the basis that the Safe Harbour Decision, as a decision of the Commission, was binding on the High Court as well as the DPC, notwithstanding the fact that neither of the parties, in terms, had challenged the validity of the Safe Harbour Decision.
76. In its ruling in Schrems, the CJEU held that a Commission decision adopted pursuant to Article 25 (6) of the Directive cannot prevent persons whose personal data has been or could be transferred to a third country from lodging with the national supervisory authorities a claim within the meaning of Article 28 (4) of the Directive concerning the protection of their rights and freedoms in regard to the processing of that data (para. 53). The decision of the Commission cannot eliminate or reduce powers expressly accorded to national supervisory authorities by Article 8 (3) of the Charter and Article 28 of the Directive. The court held that even if the Commission has adopted a decision pursuant to Article 25 (6) of the Directive, the national supervisory authorities when hearing a claim lodged by a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him, must be able to examine, with complete independence, whether the transfer of that data complies with the requirements laid down by the Directive.
77. The court observed that the European Union is a union based on the rule of law in which all acts of its institutions are subject to review of their compatibility with, in particular, the Treaties, general principles of law and of fundamental rights. Commission decisions adopted pursuant to Article 25 (6) of the Directive cannot therefore escape such a review.
78. The court noted that neither the national supervisory authorities nor a national court had jurisdiction to disapply a decision of the Commission or declare any such act invalid themselves. The CJEU alone enjoyed the jurisdiction to declare that an EU act, such as a Commission decision adopted pursuant to Article 25 (6) of the Directive, is invalid. At paras. 64 and 65 of the ruling, the court held: -
“64. In a situation where the national supervisory authority comes to the conclusion that the arguments put forward in support of [a claim contesting the compatibility of a Commission decision with the protection of the privacy and fundamental rights and freedom of individuals] are unfounded and therefore rejects it, the person who lodged the claim must… have access to judicial remedies enabling him to challenge such a decision adversely affecting him before the national courts…those courts must stay proceedings and make a reference to the Court for a preliminary ruling on validity where they consider that one or more grounds for invalidity put forward by the parties or, as the case may be, raised by them of their own motion are well founded.
65. …where the national supervisory authority considers that the objections advanced by the person who has lodged with it a claim concerning the protection of his rights and freedoms in regard to the processing of his personal data are well founded, that authority must, in accordance with the third indent of the first subparagraph of Article 28 (3) of Directive 95/46, read in the light in particular of Article 8 (3) of the Charter, be able to engage in legal proceedings. It is incumbent upon the national legislature to provide for legal remedies enabling the national supervisory authority concerned to put forward the objections which it considers well founded before the national courts in order for them, if they share its doubts as to the validity of the Commission decision, to make a reference for a preliminary ruling for the purpose of examination of the decision’s validity.” (emphasis added)
79. I am satisfied therefore that this court has jurisdiction to make a reference for a preliminary ruling to the CJEU for the purpose of considering the validity of the SCC decisions. On the basis of Schrems I have a duty so to do if I share the “well- founded” concerns raised by the DPC before the court. I am not precluded from so acting by reason of the adoption by the Commission of the Privacy Shield Decision for the reasons analysed above.
The Scope of the Application For a Reference to the CJEU
80. The DPC instituted these proceedings as she formed the view that the reformulated complaint of Mr. Schrems raised issues concerning the validity of the SCC decisions and she followed the directions set out in the ruling of the CJEU in para. 65 of Schrems.
81. The rules of court did not mandate any particular procedure for her to bring the proceedings before the national court. She therefore decided to present her concerns in relation to the validity of the SCC decisions to the court by way of a draft decision. There was no requirement that she adopt this approach.
82. During the hearing before me it was argued that the court’s jurisdiction was confined to deciding whether or not it shared the well-founded concerns identified by the DPC in her draft decision.
83. Facebook in particular adduced a very considerable amount of evidence which had not been available to the DPC when she drew up her draft decision and this was all opened to the court. In addition, subsequent to the date of the draft decision, there were significant legislative changes at European Union level. The Commission adopted the Privacy Shield Decision (though a draft of the decision had been available to the DPC when she prepared her draft decision) and the SCC decisions were amended in December, 2016 by the replacement of Article 4 with a new Article 4.
84. The fact that the DPC chose to present her concerns to the court by way of a draft decision does not mean that (a) she must be confined to arguing those grounds and may not expand her arguments in the light of the evidence and arguments advanced during the course of the trial and (b) that the court must be confined to what is set out in her draft decision.
85. The court as a matter of principle is not only entitled, but is obliged, to consider all of the facts and law properly presented to the court and to decide on the basis of those facts and arguments whether or not a reference is required. This is no ordinary lis inter partes, as I have explained, where the rights of private parties, or private parties and the State or emanations of the State, require a ruling on Union law in order to resolve the existing dispute between them. Here, the validity of decisions of the Commission are the essence of the proceedings because, in the course of her inquiry into Mr Schrems’ reformulated complaint, the DPC has concluded that she requires a ruling from the CJEU on the validity of the SCC decisions in order to complete her inquiry. In such circumstances, it would be wholly wrong, in my opinion, to limit the scope of the court’s enquiry and consideration on a quasi procedural basis. The court is in any event obliged to take account of amendments to the law that may have occurred in the interval between the institution of the proceedings and the hearing of the action, so to that extent it is not confined to the issues raised in the draft opinion. The parties advanced no reason or authority why the court should so limit its enquiry.
86. In Schrems (para. 64) the CJEU recognised that if a national supervisory authority rejected the complaint of a data subject the complainant must have a right to appeal that rejection to a court. The court may then decide whether or not the arguments raised by the complainant are well founded or it may of its own motion decided that there are well founded concerns as to the validity of a decision.
87. There is no reason in principle why the court should enjoy a jurisdiction to formulate its own concerns in relation to European legislation or acts where the complainant appeals the rejection of his complaint to the national court, but per contra, when a national supervisory authority upholds the complaint and wishes to bring its concerns to the only forum with jurisdiction to rule on the matter, the CJEU, the court does not and the court’s jurisdiction should be confined solely to those concerns raised by the national supervisory authority.
88. In my opinion, the CJEU was not implicitly limiting the right of a national court to make a reference to the CJEU. This reading of para. 64 of the ruling is particularly unlikely as the CJEU was expressly setting out the means by which a decision of the Commission, for example, could be brought before the CJEU as the sole authority with jurisdiction to resolve this point in circumstances where there was a well-founded belief as to the validity of the decision or act in question.
89. If a data subject complains that his data is not protected when it is transferred to a third country and challenges a decision of the Commission which says that the third country provides adequate protection, a national supervisory authority must investigate his complaint. If the national supervisory authority rejects the claim, the data subject has a right of appeal to a court. The court must make its own assessment regarding (1) the decision of the Commission and (2) the rejection by the national supervisory authority of the complaint as to whether one or more of the grounds put forward are well founded. In addition, the court may of its own motion raise a ground of invalidity and make a reference to the CJEU on the basis of one or other of these grounds. This jurisdiction cannot be restricted simply because a national supervisory authority accepts one or more of the complaints as well founded.
90. In my opinion, this court must consider all of the evidence, all of the law and all of the arguments advanced by any of the parties including the amici curiae in deciding whether or not to make a reference to the CJEU. It is not confined to the arguments set out by the DPC in her draft decision dated 24th May, 2016.
Comparator
Facebook’s Submissions
91. Facebook argues the fact that the interference with the personal data of EU data subjects which gives rise to the concerns of the DPC is interference by the United States intelligence agencies means that the court is concerned with data protection in the context of national security. The assessment whether a third country ensures adequate protection to the personal data of EU citizens must involve a comparison with another regime and like must be compared with like. In other words, there must be a comparator to processing of private data by the United States intelligence agencies for purposes of national security against which the assessment whether the protections or safeguards afforded in the United States to data subjects in respect of their personal data are adequate may be made.
92. The comparator for processing in a third country which is not concerned with national security is to be found in the Directive read in the light of the Charter. However, according to Facebook, the Directive and the Charter do not apply to processing by Member States for national security purposes. It follows therefore that there is no European Union comparator for processing by a third country for national security purposes. Facebook argues that the comparator therefore can only be found in the domestic laws of each of the Member States. As the Directive confers no remedy in each of the Member States in respect of EU data subjects where there is inference with personal data on the grounds of national security, it follows that there is no requirement that there be a remedy in the United States.
The DPC’s Submissions
93. The DPC argues that as a matter of principle the adequacy of the laws of the third country must be assessed by reference to Union law and not by reference to the laws of individual Member States or even an amalgam of the laws of the Member States. In Watson, the CJEU applied Union law to national legislation. It would be inconsistent with both principle and case law to apply anything other than Union law as a comparator to the legal regimes of third countries.
94. As a practical matter, the test suggested by Facebook is unworkable and leads to the logical conclusion that there is no possible comparator. It follows that if there is no comparator it can never be assessed and therefore the laws of a third country can never be found to be inadequate, regardless of the level of protection afforded to the data to be transferred or the degree of interference to which it is subject in the name of national security by the third country. This applies to all non-EEA countries no matter what legal regime exists in the third countries.
95. The DPC referred to a report of the European Union Agency for Fundamental Rights dated 2015 entitled Surveillance by Intelligence Services Code on Fundamental Rights Safeguards and Remedies in the EU. The report notes that at the EU level the rights to privacy and data protection are enshrined in Articles 7 and 8 of the Charter and the right to data protection is provided for in Article 16 TFEU and Article 39 TEU. It refers to the Directive and other directives. It refers to the national security exemption in Article 4(2) TEU and Article 3(2) of the Directive. It then states: -
“The limits of the national security exemption are subject to debate, including in relation to the activities of intelligence services. Although international guidelines exist, there is no uniform understanding of ‘national security’ across the EU. The concept is not further defined in EU legislation or in CJEU case law, although the CJEU has stated that exceptions to fundamental rights must be interpreted narrowly and justified. The CJEU has also stated that the mere fact that a decision concerns State security does not render EU law inapplicable. (See ZZ v. Secretary of State Home Department, 4th June 2013, para. 38).” Page 10.
96. The Report continues at p. 11 as follows: -
“This unclear delineation of ‘national security’ also has repercussions for the applicability of EU law, which depends both on the interpretation of the national security exemption’s scope and on the specific characteristics of the various surveillance programmes carried out by intelligence services. Although the existence of such programs remains largely unknown, even in light of the Snowdon revelations, some contain elements that can justify the full applicability of EU law. For instance, when EU companies transfer data to intelligence services, including those of third countries, they are considered under the Data Protection Directive as data controllers who collect and process data for their own commercial purposes. Any subsequent data processing activities, such as the transfer of personal data to intelligence services for the purpose of the protection of national security, will therefore fall within the scope of EU law [Schrems]. Any limitations of the rights to privacy and personal data protection should be examined according to Article 13 of the Data Protection Directive and Article 15 of the e-Privacy Directive, as well as Article 52(1) of the Charter. Such limitations are to be treated as exceptions to the protection of personal data, and thus subject to narrow interpretation and requiring proper justification. The essence of the right to privacy and protection of personal data shall at any rate be respected. The ‘national security’ exception thus cannot be seen as entirely excluding the applicability of EU law. As the UK Independent Reviewer of Terrorism Legislation recently put it,
“National security remains the sole responsibility of each Member State: but subject to that, any UK legislation governing interception of communications data is likely to have to comply with the EU Charter because it would constitute a derogation from the EU directives in the field.” (emphasis added)
Discussion
97. I found the submissions of the DPC more compelling than those of Facebook. They are consistent with the recent decisions of the CJEU in Schrems and Watson and with the views of the European Union Agency for Fundamental Rights. However, that is not the end of the matter. My decision on this point is not binding across the other Member States of the European Union but it is clearly a decision which requires uniformity across the European Union. As it is not competent for a national court to make such a decision, it is a matter on which the CJEU is required to give a ruling in order properly to give effect to Union law. For the purposes of this judgment I am not persuaded that the application of the DPC for a reference to CJEU should be refused on the basis of this argument urged by Facebook. On the contrary, it throws up a point upon which a ruling from CJEU is required in order to determine these proceedings.
Protection of Personal Data Required by the Directive
98. The principle objective of the Directive is as set out in Article 1 quoted above. It is the protection of the fundamental rights and freedoms of natural persons and in particular the right to privacy with respect to the processing of personal data. Recital 10 of the Directive makes clear that the aim is to ensure a high level of protection in the Union. This was confirmed by the CJEU in its ruling in Schrems at para. 39 where it stated: -
“It is apparent from Article 1 of Directive 95/46 and recitals 2 and 10 in its preamble that the directive seeks to ensure not only effective and complete protection of the fundamental rights and freedoms of natural persons, in particular the fundamental right to respect for private life with regard to the processing of personal data, but also a high level of protection of those fundamental rights and freedoms. The importance of both the fundamental right to respect for private life, guaranteed by Article 7 of the Charter, and the fundamental right to protection of personal data, guaranteed by Article 8 of thereof, is, moreover, emphasised in the case law of the court.” (emphasis added)
99. The processing of personal data means any operation or set of operations which is performed upon personal data, whether or not by automatic means, such as collection, recording, organisation, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. (Article 2(b)).
100. Chapter II of the Directive establishes general rules on the lawfulness of the processing of personal data. Member States are required to provide that personal data is processed fairly and lawfully; collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes; is adequate, relevant and not excessive in relation to the purposes for which they are collected and/or further processed and are accurate. Where necessary, personal data must be kept up to date and every reasonable step must be taken to ensure that data which are inaccurate or incomplete, having regard to the purposes for which they were collected or for which they were further processed, are erased or rectified. Personal data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes which the data were collected or for which they are further processed. Member States are required to lay down appropriate safeguards for personal data stored for longer periods or historical, statistical or scientific use. (see Article 6)
101. Article 22 requires member states to provide for the right of every person to a judicial remedy for any breach of the rights guaranteed him by the national law applicable to the processing in question. This is in addition to the data subject’s right to an administrative remedy before the national supervisory authority (as required by Article 28). Article 23 requires Member States to provide that any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with the national provisions adopted pursuant to the Directive is entitled to receive compensation from the controller for the damage suffered. The controller may be exempt from this liability, in whole or in part, if the controller proves that it is not responsible for the event giving rise to the damage. In addition, the member states are required to adopt suitable measures to ensure the full implementation of the provisions of the Directive and to lay down sanctions to be imposed in case of infringement of the provisions adopted pursuant to the Directive (see Article 24).
102. The starting point therefore is that data processed within the European Union is entitled to a high degree of protection and the Member States are required to provide for the right of every person to a judicial remedy for any breach of the rights guaranteed to him. Prima facie any person who has suffered damage as a result of an unlawful processing operation or of any act incompatible with national provisions is entitled to receive compensation for that damage.
103. These rules apply to processing of data within the EU. I turn now to consider the question of the transfer of personal data to third countries pursuant to Articles 25 and 26 of the Directive.
104. Personal data which either are undergoing processing or are intended for processing after transfer may only be transferred to a country outside the EEA (“a third country”) if the third country ensures an adequate level of protection. Transfers of personal data to third countries which do not ensure an adequate level of protection are therefore prohibited. (See Recital 57 and Article 25 (1)).
105. The adequacy of the level of protection afforded by the third country is to be assessed by reference to the criteria set out in Article 25(2). It is in light of all the circumstances surrounding a data transfer operation or set of data transfer operations. Particular consideration is to be given to the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and the country of final destination, the rules of law, both general and sectoral, in force in the third country in question and the professional rules and security measures which are complied with in that country. In Schrems the CJEU held that the adequate level of protection to be afforded to personal data transferred to third countries is to be the same as the high level of protection guaranteed by the Directive to processing of personal data within the EU.
106. Article 25 (6) authorises the Commission to make a decision that a particular third country ensures an adequate level of protection as required by Article 25 (2) of the Directive. In Schrems (paras. 39 and 46) it was held that transfers pursuant to an adequacy decision under Article 25 are entitled to a high level of protection and that an adequacy decision by the Commission under Article 25 (6) must satisfy the test set out in Article 25 (2).
107. The CJEU held that the third country is not required to ensure a level of protection that is identical to that guaranteed by Union law. It is required to ensure by reason of its domestic law or its international commitments a level of protection of fundamental rights and freedoms that is essentially equivalent to that guaranteed within the European Union by virtue of the Directive read in the light of the Charter. (Schrems para. 73). It is thus necessary to ensure that the requirement that the personal data transferred to the third country continues to enjoy a high level of protection is not disregarded.
Transfers of Data Pursuant to Article 26
108. Recitals 58 and 59 of the Directive recognise that provisions need to be made for exemptions from the prohibition on transferring personal data to a third country which does not ensure an adequate level of protection for personal data. Article 26 governs these derogations from the requirements of Article 25.
109. All transfers of personal data to third countries pursuant to Article 26 are predicated upon the fact that the third country does not ensure an adequate level of protection within the meaning of Article 25 (2). Notwithstanding this fact, Article 26 provides that transfers may take place on certain specified conditions.
110. Transfers made pursuant to Article 26 (1) correspond to the transfers referred to in Recital 58. These transfers are based upon the principle of waiver or transfers which are in the interests of the data subjects. They are not based upon the level of protection afforded to the data once it is transferred to the third country. These data transfers are legitimised not on the basis of the protection afforded to the personal data but upon the six individual grounds specified in sub article 1.
111. Article 26 (2) states that without prejudice to para. 1, Member States may authorise a transfer or a set of transfers of personal data to a third country which does not ensure an adequate level of protection within the meaning of Article 25 (2), where the controller adduces adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights. This underscores the fact that transfers of data under Article 26 are not premised on the protections available in a third country. In the case of para. (2) the transfer is permitted if the controller of the data adduces adequate safeguards in respect of that data and as regards the exercise of the corresponding rights. The protection does not derive from the law of the third country but the practices of the controller of the data. Paragraph 2 expressly states that the safeguards may result from appropriate contractual clauses.
112. Article 26 (4) provides as follows: -
“Where the Commission decides, in accordance with the procedure referred to in Article 31(2), that certain standard contractual clauses offer sufficient safeguards as required by paragraph 2, Member States shall take the necessary measures to comply with the Commission's decision.”
113. The SCC decisions were decisions taken by the Commission pursuant to Article 26 (4) in accordance with the procedure established by Article 31 (2).
114. Thus, there are a variety of mechanisms whereby personal data may lawfully be transferred from the EEA to a third country. It may be pursuant to a Commission adequacy decision (Article 25 (6)), pursuant to one of the six derogations identified in Article 26 (1), pursuant to an authorisation by a member state adopted pursuant to Article 26 (2) or pursuant to a Commission decision adopted pursuant to Article 26 (4) that certain standard contractual clauses offer sufficient safeguards as required by para. 2 of Article 26.
SCC Decision 2010/87
115. Recitals 11, 12, 19, 20 and 22 provide: -
(11) Supervisory authorities of the Member States play a key role in this contractual mechanism in ensuring that personal data are adequately protected after the transfer. In exceptional cases where data exporters refuse or are unable to instruct the data importer properly, with an imminent risk of grave harm to the data subjects, the standard contractual clauses should allow the supervisory authorities to audit data importers and sub-processors and, where appropriate, take decisions which are binding on data importers and sub-processors. The supervisory authorities should have the power to prohibit or suspend a data transfer or a set of transfers based on the standard contractual clauses in those exceptional cases where it is established that a transfer on contractual basis is likely to have a substantial adverse effect on the warranties and obligations providing adequate protection for the data subject.
(12) Standard contractual clauses should provide for the technical and organisational security measures to be applied by data processors established in a third country not providing adequate protection, in order to ensure a level of security appropriate to the risks represented by the processing and the nature of the data to be protected. Parties should make provision in the contract for those technical and organisational measures which, having regard to applicable data protection law, the state of the art and the cost of their implementation, are necessary in order to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access or any other unlawful forms of processing.
(19) Standard contractual clauses should be enforceable not only by the organisations which are parties to the contract, but also by the data subjects, in particular where the data subjects suffer damage as a consequence of a breach of the contract.
(20) The data subject should be entitled to take action and, where appropriate, receive compensation from the data exporter who is the data controller of the personal data transferred. Exceptionally, the data subject should also be entitled to take action, and, where appropriate, receive compensation from the data importer in those cases, arising out of a breach by the data importer or any sub-processor under it of any of its obligations referred to in the paragraph 2 of Clause 3, where the data exporter has factually disappeared or has ceased to exist in law or has become insolvent. Exceptionally, the data subject should be also entitled to take action, and, where appropriate, receive compensation from a sub-processor in those situations where both the data exporter and the data importer have factually disappeared or ceased to exist in law or have become insolvent. Such third-party liability of the sub-processor should be limited to its own processing operations under the contractual clauses.
(22) The contract should be governed by the law of the Member State in which the data exporter is established enabling a third-party beneficiary to enforce a contract. Data subjects should be allowed to be represented by associations or other bodies if they so wish and if authorised by national law. The same law should also govern the provisions on data protection of any contract with a sub-processor for the sub-processing of the processing activities of the personal data transferred by the data exporter to the data importer under the contractual clauses.
116. Article 1 of the Decision provides that the standard contractual clauses set out in the Annex to the Decision are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26 (2) of the Directive. Article 3 (f) defines “applicable data protection law” for the purposes of the Decision as “the legislation protecting the fundamental rights and freedoms of individuals and, in particular, the right to privacy with respect to the processing of personal data applicable to a data controller in the Member State in which the data controller is established.”
117. The data exporter is the controller who transfers the personal data. The data importer means the processor established in a third country who agrees to receive from the data exporter personal data intended for processing on the data exporter’s behalf after the transfer in accordance with his instructions and the terms of this SCC decision and who is not subject to a third country’s system ensuring adequate protection within the meaning of Article 25 (1) of the Directive (Article 3 of the Decision).
118. As originally adopted, Article 4 (1) provided: -
Article 4
1. Without prejudice to their powers to take action to ensure compliance with national provisions adopted pursuant to Chapters II, III, V and VI of Directive 95/46/EC, the competent authorities in the Member States may exercise their existing powers to prohibit or suspend data flows to third countries in order to protect individuals with regard to the processing of their personal data in cases where:
(a) it is established that the law to which the data importer or a sub-processor is subject imposes upon him requirements to derogate from the applicable data protection law which go beyond the restrictions necessary in a democratic society as provided for in Article 13 of Directive 95/46/EC where those requirements are likely to have a substantial adverse effect on the guarantees provided by the applicable data protection law and the standard contractual clauses;
(b) a competent authority has established that the data importer or a sub-processor has not respected the standard contractual clauses in the Annex; or (c) there is a substantial likelihood that the standard contractual clauses in the Annex are not being or will not be complied with and the continuing transfer would create an imminent risk of grave harm to the data subjects.
119. Following the decision of the CJEU in Schrems Article 4 was replaced by a new Article 4 by Commission Implementing Decision (EU) 2016/2297. It now reads: -
“Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive 95/46/EC leading to the suspension or definitive ban of data flows to third countries in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall, without delay, inform the Commission, which will forward the information to the other Member States.”
120. Clause 3 of the standard contractual clauses is a third-party beneficiary clause. 3.1 provides: -
“The data subject can enforce against the data exporter this Clause, Clause 4(b) to (i), Clause 5(a) to (e), and (g) to (j), Clause 6 (1) and (2), Clause 7, Clause 8 (2), and Clauses 9 to 12 as third- party beneficiary.”
Omitted from the third-party beneficiary clause are Clause 4 (a) and (j) and Clause 5 (f).
121. Clause 4 sets out that the data exporter agrees and warrants the matters listed at (a) to (j). Sub Clause 4 (a) provides that the data exporter agrees and warrants: -
“that the processing, including the transfer itself, of the personal data has been and will continue to be carried out in accordance with the relevant provisions of the applicable data protection law (and, where applicable, has been notified to the relevant authorities of the Member State where the data exporter is established) and does not violate the relevant provisions of that State;”
This is an agreement between the data exporter and the data importer. The sub-clause is excluded from the third party beneficiary clause so that the data subject cannot enforce this warranty as against the data exporter pursuant to the standard contractual clauses.
122. Sub clauses (b), (c), (d), (e), (i) and (j) provide as follows: -
(b) that it has instructed and throughout the duration of the personal data-processing services will instruct the data importer to process the personal data transferred only on the data exporter’s behalf and in accordance with the applicable data protection law and the Clauses;
(c) that the data importer will provide sufficient guarantees in respect of the technical and organisational security measures specified in Appendix 2 to this contract;
(d) that after assessment of the requirements of the applicable data protection law, the security measures are appropriate to protect personal data against accidental or unlawful destruction or accidental loss, alteration, unauthorised disclosure or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing, and that these measures ensure a level of security appropriate to the risks presented by the processing and the nature of the data to be protected having regard to the state of the art and the cost of their implementation;
(e) that it will ensure compliance with the security measures;
(i) that, in the event of sub-processing, the processing activity is carried out in accordance with Clause 11 by a sub-processor providing at least the same level of protection for the personal data and the rights of data subject as the data importer under the Clauses; and
(j) that it will ensure compliance with Clause 4(a) to (i).
123. On the facts of this case, the applicable data protection law referred to is Irish law. As noted above, a data subject cannot enforce sub clause (j) against the data exporter as it is omitted from the third party beneficiary clause. Thus, the data subject may not ensure compliance with Clause 4 (a) by directly suing the data exporter pursuant to these clauses. It will be noted that a significant number of these warranties relate to the security measures relating to the processing of the data once it has been transferred to the third country and not to the legal protections applicable to the data.
124. By Clause 5 (a) (b) and (c) the data importer agrees and warrants as follows-
(a) to process the personal data only on behalf of the data exporter and in compliance with its instructions and the Clauses; if it cannot provide such compliance for whatever reasons, it agrees to inform promptly the data exporter of its inability to comply, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(b) that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract and that in the event of a change in this legislation which is likely to have a substantial adverse effect on the warranties and obligations provided by the Clauses, it will promptly notify the change to the data exporter as soon as it is aware, in which case the data exporter is entitled to suspend the transfer of data and/or terminate the contract;
(c) that it has implemented the technical and organisational security measures specified in Appendix 2 before processing the personal data transferred;
125. A footnote to Clause 5 provides as follows: -
“Mandatory requirements of the national legislation applicable to the data importer which do not go beyond what is necessary in a democratic society on the basis of one of the interests listed in Article 13(1) of Directive 95/46/EC, that is, if they constitute a necessary measure to safeguard national security, defence, public security, the prevention, investigation, detection and prosecution of criminal offences or of breaches of ethics for the regulated professions, an important economic or financial interest of the State or the protection of the data subject or the rights and freedoms of others, are not in contradiction with the standard contractual clauses. Some examples of such mandatory requirements which do not go beyond what is necessary in a democratic society are, inter alia, internationally recognised sanctions, tax-reporting requirements or anti-money-laundering reporting requirements.”
126. At Clause 6 the parties agreed that any data subject who has suffered damage as a result of any breach of the obligations referred to in Clause 3 or in Clause 11 by any party or sub processor is entitled to receive compensation from the data exporter for the damage suffered. This entitles the data subject to sue the data exporter in the relevant member state where the data exporter is situated. He is not obliged to sue a data importer in a third country outside the European Union. The proceedings will be governed by the national law of the Member State, and not the law of the third country.
127. By Clause 6.2 the data importer agrees that if the data subject is not able to bring a claim for compensation in accordance with Clause 6.1 against the data exporter because the data exporter has factually disappeared or ceased to exist in law or has become insolvent, then the data importer agrees that the data subject may issue a claim against it as if it were the data exporter unless any successor entity has assumed the entire legal obligations of the data exporter by contract or by operation of law. Thus, the data subject may sue the data importer if necessary in the Member State where the data exporter was situate. That case likewise will be subject to the law of the member state.
128. There is a similar provision which allows a data subject to sue a data sub-processor at Clause 6.3. The liability of the sub-processor is limited to its own processing operations under the Clauses.
129. The other two SCC decisions the subject of these proceedings were not analysed in the hearing before me which focused exclusively upon the decision of 2010. This was the decision which Facebook said it employed to transfer Mr. Schrems’ personal data to Facebook Inc.
The SCC Decisions and the laws of Third Countries
130. What is the level of protection required to be afforded to personal data transferred to third countries pursuant to standard contractual clauses adopted in accordance with a decision of the Commission under Article 26 (4) in light of the provisions of the Directive and in particular Articles 25 and 26 read in the light of the Charter?
Submissions of the DPC
131. The DPC says that whether the Directive refers to adequate protection (Article 25), adequate safeguards (Article 26 (2)) or sufficient safeguards (Article 26 (4)), data processing is entitled to the same high level of protection whether or not the processing occurs within the EU or is transferred for processing to a third country and regardless of the method employed to effect a lawful transfer of personal data to a third country. This submission is based upon Recital 10, in particular, of the Directive. She also relies upon the opinion of Advocate General Bot in Schrems. At paras. 139 and 140 he states: -
“Article 25 of Directive 95/46 is based entirely on the principle of the transfer of personal data to a third country cannot take place unless that third country guarantees an adequate level of protection of such data. The objective of that article is thus to ensure the continuity of the protection afforded by that directive where personal data is transferred to a third country. It is appropriate, in that regard, to bear in mind that that Directive affords a high level of protection of citizens of the Union with regard to the processing of their personal data.
In view of the important role played by the protection of personal data with regard to the fundamental right to privacy, this kind of high level of protection must, therefore, be guaranteed, including where personal data is transferred to a third country.”(emphasis added)
132. She also refers to the fact that Advocate General Bot noted that there might be an apparent difference between the English word adequate and the French word “adÉquat”. The only criterion that must guide the interpretation of that word is the objective of attaining a high level of protection of fundamental rights, as required by the Directive.
133. The DPC says that the standard contractual clauses must ensure that personal data transferred pursuant to those clauses to a third country continue to enjoy that high level of protection. She submits that when the particular provisions of the law of the United States are considered, there are well-founded concerns that the laws of the United States do not ensure this continuity of a high level of protection and that the standard contractual clauses do not ensure that data transferred to the United States enjoys a high level of protection to which data subjects in the European Union are entitled by virtue of the provisions of the Directive as read in the light of the Charter.
Submissions of Digital Europe
134. Facebook, Digital Europe and the Business Software Alliance disagreed with the analysis of the DPC. They say Article 26 is a derogation from Article 25. By definition, transfers of data to third countries pursuant to Article 26 are on the basis that the third country does not afford the data an “adequate level of protection”. The six circumstances in Article 26 (1) are not related to the level of protection to be afforded to the data transfers.
135. Digital Europe submitted that it was part of the scheme of the Directive that it is permissible to transfer data to a third country whose laws either have not been assessed or whose laws have been found to be inadequate in their protection of personal data with contractual clauses providing a substitute for the protections that are not available in the third country.
136. It submitted that under Article 26 (2) it is for the controller to adduce adequate safeguards. These are provided by standard contractual clauses which the Commission has found to provide sufficient safeguards pursuant to Article 26 (4). The key innovation of the standard contractual clauses is to impose the responsibility for ensuring that the Charter rights of EU data subjects are respected within a third country upon the data exporting and importing entities. The SCCs protect the data protection rights of EU citizens guaranteed by the Charter including the availability of remedies through a combination of the contractual protections enshrined in the standard contractual clauses and the powers granted to the data protection authorities pursuant to Article 4.1 of the SCC decisions i.e. the power to suspend or ban data flows to a particular third country. EU citizens are enabled to obtain relief before the relevant national data protection authority (DPA) or national court where the data exporter is located and if necessary to have transfers of their data to the third country suspended. The SCCs therefore provide “adequate safeguards” within the meaning of Article 26 (2) of the Directive.
137. Digital Europe submitted that the argument of the DPC in effect required that wherever EU data subjects’ personal data was transferred they were entitled to the protections guaranteed by Article 47 of the Charter. It was submitted that this would utterly defeat the purpose of the Directive to facilitate transfers of data to third countries, many of which would not satisfy the requirements of a remedy essentially equivalent to that guaranteed by Article 47 of the Charter.
138. Digital Europe pointed out that the DPC’s argument was that the SCCs only established rights in contract which by definition could not be binding upon the United States government or any agency of the United States government. Therefore, the SCCs could not provide an effective remedy in the event that the personal data of EU citizens is unlawfully interfered with whether on national security grounds or otherwise. This argument renders Article 26 (2) inoperable. It submitted that if it is the case that contractual clauses can never be adequate to protect personal data when such data has been transferred to a third country which does not provide an adequate level of protection within the meaning of Article 25 (2) then the utility of Article 26 (2) is entirely undermined. It results in applying the criteria of Article 25 (2) to every transfer of data thereby rendering the derogations permitted in Article 26 inoperable and redundant. If the adequacy of the protections in the destination country were a requirement for data exporters to rely on SCCs then the very notion of SCCs would become meaningless because data exporters would simply rely on the adequacy of protection under Article 25.
Submissions of Business Software Alliance
139. The Business Software Alliance (BSA) submitted that there was a clear distinction between transfers under Article 25 on the one hand and transfers under Article 26. By definition transfers of data pursuant to Article 26 were to a country which did not ensure an adequate level of protection within the meaning of the Directive. It was argued that Article 26 (2) implies that appropriate contractual provisions could provide a sufficiently robust level of protection for data subjects specifically in scenarios where their data were being transferred to third countries which do not offer an adequate level of protection. The fundamental premise of Article 26 as far as the SCCs is concerned, is that the contract pursuant to which the data are transferred itself provides sufficient protection to data subjects, both in terms of substantive protection and availability of remedies. Under the SCCs data subjects have a judicial remedy in the EU. Article 26 generally, and the SCCs in particular, are not premised on an effective remedy, whether judicial or otherwise, being available in the third country to which the data are transferred. The SCCs provide the remedies in the transferring EU member state according to its law. This is intended to comply with the requirements of the Charter and in particular Article 47.
140. The BSA submitted that the power of a DPA to prohibit or suspend data flows to a particular third country pursuant to Article 4.1 of the SCCs decision was crucial to assessing the validity of the SCC decisions. While a data subject may have no direct remedy against agencies in the third countries, the data subject could call upon a DPA to suspend or prohibit flows of data to that third country and it was open to the DPA to protect data subjects by making such an order.
141. Under Article 4 (1) (a) of the SCC Decision (as originally drafted) any analysis of the mandatory requirements imposed by a third country in relation to accessing the data for the purposes of national security must be assessed in relation to the “restrictions necessary in a democratic society”. EU law itself allows significant limitations and exclusions in respect of EU data protection law in the realm of national security, defence, public security and criminal investigations. This must be taken into account when considering whether “adequate remedies” are available in third countries and whether the restrictions are necessary in a democratic society. Furthermore, in assessing whether the protection in a third country is “essentially equivalent” to the level of protection available within the EU, it is necessary to have regard to the degree to which EU data protection laws do not apply to Member States in the realm of national security, defence, public security or criminal investigations.
142. It was argued that if it was necessary to apply the Article 25 standard of adequacy of protection to transfers effected under Article 26, this effectively revokes Article 26 and makes it impossible to comply with. If it was necessary to have the same protection as that provided by Article 25, this can never be achieved by means of standard contractual clauses under Article 26. Standard contractual clauses by definition operate in the private sphere and do not bind the national authorities in third countries. It was submitted that this means that there must be a different structure of protection and that the rights of data subjects are protected differently under Article 26 compared to Article 25.
143. It was argued that it was important to differentiate between the level of protection that was required (a high level) and how that protection was achieved. It was submitted that data subjects whose data are transferred pursuant to SCCs have a legal remedy in the Member State of the exporter but not in the third country importer State. The SCCs were not and are not intended and could not have been intended to remedy the inadequacy in relation to the third country legal protections. If effective judicial remedies in third countries are a prerequisite for lawful transfer under Article 26 (2), it can never be satisfied.
Response of the DPC
144. In response, the DPC asks what remedy does an EU citizen have where his data are transferred to a third country pursuant to the SCC decisions and in that third country his data are interfered with unlawfully for the purposes of national security? The ability to sue either the data exporter or the data importer or the sub-processer pursuant to the SCCs is of no benefit. In this case, no wrong has been alleged against either Facebook or Facebook Inc. or any of the sub-processers in relation to the processing of his data (assuming it is being processed pursuant to the SCCs). Mr. Schrems could not look to the SCCs for a remedy in respect of his complaints.
Discussion
145. The submissions of Digital Europe and BSA are based on the argument that the adequate safeguards of an EU data subject in relation to his data privacy rights is to be found in the SCCs rather than in the laws of the importer country. The clauses compensate for the inadequacy of those laws. But, the SCC decisions themselves refer to the content of the laws of the third country. Under Article 4.1 (a) of SCC Decision 2010/87/EU (as originally drafted), a DPA had power to prohibit or suspend data flows to third countries in order to protect individuals with regard to the processing of their personal data where is it is established that: -
“… the law to which the data importer or a sub-processor is subject imposes upon him requirements to derogate from the applicable data protection law which goes beyond the restrictions necessary in a democratic society as provided for in Article 13 of [the Directive] where those requirements are likely to have a substantial adverse effect on the guarantees provided by the applicable data protection law and the standard contractual clauses.”
146. This Article shows that as originally drafted, DPAs had a role in assessing the law of the country of the data importer or sub-processer. The DPAs were to assess the extent to which the data importer or sub-processer was required to derogate from the data protection law of the Member State where the data exporter was established. The DPAs were required to determine whether the requirements of the third country laws go beyond the restrictions necessary in a democratic society and whether those requirements were likely to have a substantial adverse effect on the guarantees provided by the applicable data protection law and the SCCs.
147. While this Article has been repealed and a new Article 4 substituted, the implications of this Article are relevant to the construction of the SCC decisions and show that the SCCs alone cannot ensure an adequate level of protection in the third country for data protection rights and freedoms. Despite the provisions of the SCCs, nonetheless data transferred pursuant to the SCCs to third countries may not enjoy the adequate level of protection mandated by reason of the laws of the individual third country.
148. It seems to me that the provisions of the law in a particular third country may be the basis for suspending or prohibiting a data transfer or transfers pursuant to an SCC decision. It follows therefore that the provisions of the law of that third country may provide the basis for concluding that data transfers effected pursuant to SCCs under Article 26 (2) do not provide adequate safeguards for the personal data of data subjects.
149. As referred to above, following the decision of CJEU in Schrems, this Article was replaced by a new Article 4 so that the power of the DPAs under the SCC decisions is the general power conferred on the DPAs by Article 28 of the Directive. This applies to all forms of processing whether within the EU or to transfers of data to third countries. It is not specific to the transfer of data outside the EU to third countries. It is not constrained as was formerly the case under Article 4.1 (a) as originally drafted. The laws of the third country may be such as to require the suspension or prohibition of data transfers to the third country under the provisions of SCCs notwithstanding protections afforded by the SCCs themselves, though whether this is always the appropriate response is a matter to which I shall return.
150. It seems to me that this leads to the following conclusion. Article 26 is a derogation from Article 25. Data transfers pursuant to Article 26 are not premised upon the existence of an adequate level of protection in the third country. Nonetheless the data is still entitled to a high level of protection, as was stated by Advocate General Bot in Schrems. It follows therefore that transfers of personal data to a third country cannot simply step outside the protections guaranteed by the Directive entirely. It is clear that data exporters cannot rely solely upon the SCCs as complying with the requirements of the Directive regardless of the legal regime in the third country to which the data is exported. DPAs have an obligation to ensure that the data still receives a high level of protection and they are expressly granted powers to suspend or prohibit data transfers if the laws of the third country undermine that mandatory high level of protection.
151. If there are inadequacies in the laws of the United States within the meaning of Union law, the SCCs cannot and do not remedy or compensate for these inadequacies. The private contractual clauses cannot bind the sovereign authority of the United States and its agencies. This was not contended. This conclusion means that the terms of the SCCs themselves does not provide an answer to the concerns raised by the DPC in relation to the existence of effective remedies for individual EU citizens in respect of possible infringement of their data privacy protection rights if their data are subject to unlawful interference. Whether Article 4 of the SCC decisions provides the answer, I consider later in this judgment.
The Relevant Laws of the United States of America.
152. Five experts gave evidence in relation to the provisions of US law relevant to the issues in these proceedings. The primary source of law is the Constitution of the United States. There are then federal statutes, state statutes (which are not relevant to the issues in these proceedings) and case law. The judgments of the United States Supreme Court are binding throughout the United States. The US Courts of Appeal decisions are binding in their particular circuits and persuasive in other circuits. The decisions of District Courts are of less precedential value.
153. The United States is a common law jurisdiction. The state of the law at any particular moment on a given point may be in flux and there may be divergent, even inconsistent, authorities from the circuits. It is not always possible to give a clear unqualified statement of the current state of the law. Therefore, of necessity, the opinions of the experts reflect their best endeavours to explain the laws of the United States as of date of the hearing before me in February, 2017. There could not be a clear-cut consensus on all points. That said, there was in fact a significant degree of agreement and often the areas of disagreement were at the margins.
154. The experts gave very detailed evidence in relation to many aspects of US law. Of necessity, this judgment cannot record or assess the entirety of this evidence. I have summarised the evidence I believed was necessary for the purposes of reaching my decision on the issues in this case. It is focused on the transfer of personal data from Facebook to Facebook Inc. for private purposes and on the possibility that the data may as a result be made available to or actually accessed, processed and retained by authorities in the United States for reasons of national security.
155. After the conclusion of the trial and before judgment was delivered there were significant developments relevant to the evidence adduced on the laws and practices of the United States. As an exceptional measure, I permitted the parties to adduce this additional evidence and for the expert witnesses to give further testimony in relation to it. I heard brief submissions from all parties in light of the developments.
What is the correct basis upon which the court should assess the adequacy of the protections afforded by the laws of the United States to the data privacy rights of EU citizens?
156. There was fundamental disagreement between the DPC on the one hand and Facebook and the United States on the other hand in the approach to be taken in assessing the adequacy of US law for the purposes of investigating Mr. Schrems’ reformulated complaint and these proceedings.
Submissions of the DPC
157. The DPC started from the adequacy criteria set out in Article 25 (2) of the Directive. This states that particular consideration is to be given to, inter alia, the rules of law, both general and sectoral, in force in the third country to which the data is to be transferred. Article 47 of the Charter guarantees everyone the right to an effective remedy before a tribunal in compliance with the conditions laid down in the Article. Article 52 of the Charter requires that the essence of the right must be respected. She analysed the remedial regime in the United States and conducted what might be described as an inadequacy assessment rather than an adequacy assessment.
158. She did not engage in an investigation to see whether US laws provided adequate protection such as would be conducted by the Commission for the purposes of making a decision pursuant to Article 25 (6). She reasoned that an essential requirement of Union law is that there be a remedy compatible with Article 47 so that EU data subjects’ fundamental rights and freedoms in relation to data protection may be vindicated. If US law does not guarantee the availability of a remedy compatible with Article 47, then, regardless of any other provisions of US law, it cannot provide adequate protection for the personal data of EU data subjects as guaranteed by the Directive read in the light of Article 47 of the Charter.
159. She therefore investigated the remedies available to EU citizens in the United States for interference in their personal data by US intelligence agencies. The evidence adduced by her experts focused on the availability of and limitations on remedies available to EU citizens and the obstacles to obtaining relief in the United States for breach of their data protection rights and freedoms.
160. The DPC and Mr. Schrems strongly argued that the court should be concerned with the laws of the United States and not the practice. They argued that the adequacy of the level of protection of the third country is to be assessed by reference to the content of the applicable rules and the practice designed to ensure compliance with those rules. This is based upon the analysis of CJEU in Schrems at para. 75 and the Advocat General at para. 143. Thus, evidence as to practices in the United States were not relevant to the consideration of the court.
Submissions of Facebook and the government of the United States
161. Facebook and the United States government said that this approach was wrong in principle. An adequacy assessment of the entire relevant regime in the United States was required. The DPC – and the court – should make an holistic assessment of the laws and protections afforded to data subjects. Neither the DPC nor the court should confine its consideration to the legal remedies available to EU citizens in the United States. It must look at the practices, oversight mechanisms and other forms of indirect protection employed to ensure compliance with the requirements of legal authorisations, administrative protections, congressional oversights and wider protections against unlawful surveillance by United States intelligence agencies before making any decision.
162. They submit that a person only enjoys a right to a remedy under Article 47 where there is at least an arguable violation of that person’s rights and freedoms. The DPC did not conduct such an analysis so the issue does not even arise. Even if it did, the court must consider the overall context of the right or entitlement and then assess what remedy is required in the circumstances. They say that the ruling of CJEU in Schrems (para.95) establishes that the correct test is whether or not the laws of the third country fail to provide “any possibility for an individual to pursue legal remedies” in relation to breaches of his data protection rights.
163. They submit that the regime in the United States respects the essence of the rights of EU citizens guaranteed by Articles 7, 8 and 47 of the Charter. The limitations on the fundamental rights and freedoms respect the essence of those rights. The limitations are proportionate, necessary and comply with the requirements of Article 52 as they genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others. They say that a proportionality test must be conducted and the DPC never purported to carry out such a test. Therefore, her analysis is fundamentally incorrect.
The legal basis for electronic surveillance by the United States
164. Before considering these arguments and whether it is always necessary to conduct a proportionality analysis, it is necessary to put them in context and to consider the legal basis upon which surveillance is conducted by the agencies of the United States, the practice of the intelligence agencies, the oversight mechanisms (on the assumption that this is relevant to the assessment to be conducted) and the remedies available to parties claiming to have suffered legal wrong as a result of surveillance by the intelligence agencies of the United States.
165. The principal statute to which all parties referred is the Foreign Intelligence Surveillance Act (“FISA”) (as amended). FISA authorises two types of surveillance. There are “traditional” FISA orders and surveillance pursuant to s. 702 of FISA.
166. Pursuant to the provisions of traditional FISA orders, government authorities must obtain individual orders from the FISA court (FISC) on an individualised basis to conduct electronic surveillance or physical searches as defined in the law. In order to obtain an order authorising electronic surveillance or physical search the government must demonstrate to the FISC “probable cause” that, among other things, the target is a “foreign power or an agent of a foreign power”. These are principally foreign governments, international terrorist groups or proliferation networks and their agents. A “significant purpose” of the collection must be to gather “foreign intelligence information” which FISA defines as five specific categories of information that relate to the government’s ability to protect against foreign attack, terrorism, proliferation of weapons of mass destruction and other threats or to the conduct of the foreign affairs of the United States (50 U.S.C. 1801 (e)). The breadth of the definition of foreign intelligence information was emphasised by both the DPC and Mr. Schrems.
167. Surveillance pursuant to s. 702 is fundamentally different. Section 702 permits the Attorney General and the Director of National Intelligence to jointly authorise surveillance conducted within the United States by targeting non-US persons reasonably believed to be located outside the United States with the compelled assistance of electronic communication service providers in order to acquire foreign intelligence information. Persons who may be targeted under s. 702 cannot intentionally include US persons or anyone located in the United States. The targeting must be conducted to acquire foreign intelligence information as defined in the Act.
168. The joint authorisations of the Attorney General and the Director of National Intelligence must be approved by the FISC along with procedures governing targeting and the handling of information acquired (minimisation). Under s. 702 the Attorney General and the Director of National Intelligence make annual certifications authorising this targeting to acquire foreign intelligence information without specifying to the FISC the particular non-US persons who will be targeted. There is no requirement that the government demonstrate probable cause to believe that an individual targeted is an agent of a foreign power as generally required in the “traditional” FISA process. The certifications identify categories of information to be collected which must meet the statutory definition of foreign intelligence information. The FISC determines that the procedures are consistent with the statute and the Fourth Amendment of the Constitution. The privacy rights of non-US persons located outside of the United States are not protected by the Fourth Amendment.
169. The targeting procedures govern how the executive branch determines that a particular person is reasonably believed to be a non-US person located outside the United States and that targeting this person will lead to the acquisition of foreign intelligence information. Minimisation procedures cover the acquisition, retention, use and dissemination of any non publicly available US personal information acquired through the s. 702 programme. They do not apply to non-US persons located outside the United States. Data may only be legally collected in compliance with the orders of the FISC authorising particular targeting and minimisation procedures for each individual agency engaged in collecting or receiving and sharing signals intelligence.
170. Once foreign intelligence acquisition has been authorised under s. 702 the practice is that the government sends written directives to electronic communication service providers compelling their assistance in the acquisition of communications. The government identifies or “tasks” certain “selectors”, such as telephone numbers or email addresses. A named individual may not be tasked. The selectors are associated with the targeted persons. The government sends these selectors to the electronic communications service providers who then provide the data to the relevant government agency.
171. An electronic communication service provider receiving a directive may file a petition to modify or set aside the directive with the FISC. The government or an electronic communication service provider may appeal a decision of the FISC to the Foreign Intelligent Surveillance Court of Review (FISCR).
172. Section 215 of the USA-PATRIOT Act, 2001 (50 USC s. 1861) is the second legal authority for surveillance programmes. It permits the Federal Bureau of Investigation (FBI) to make an application to the FISC for an order requiring a business or other entity to produce “tangible things”, such as books, records or documents, where the information sought is relevant for an investigation to obtain foreign intelligence information not concerning a United States person or to protect against international terrorism or clandestine intelligence activities provided that such investigation of a United States person is not conducted solely upon the basis of activities protected by the First Amendment to the Constitution (i.e. freedom of religion, freedom of speech, freedom of assembly). The application must include a statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant to an authorised investigation to obtain foreign intelligence information. As with applications under s. 702, the application and court order will specify minimisation procedures to be followed upon receipt of the tangible things required to be produced pursuant to the court order.
173. Section 215 allowed for bulk collection of telephony metadata maintained by telephone companies to whom orders under s. 215 were addressed. The USA FREEDOM Act which was enacted on the 2nd June, 2015, prohibits the collection in bulk of records pursuant to inter alia s. 215 of the US-PATRIOT Act.
174. The FISC is staffed by federal judges with lifetime tenure appointed by the Chief Justice. Applications for authorisations are ex parte and are secret. The parties served with the directives issued under the authorisations are likewise bound to secrecy. Unless expressly declassified, all procedures under FISA are secret.
175. FISA governs the acquisition of signals intelligence within the United States in relation to non-US persons reasonably believed to be located outside of the United States. However, the primary authority under which the NSA acquires foreign intelligence is EO 12333. This applies to intelligence collections made outside of the United States. It is an executive order of the President of the United States. It is not law and may be revoked or amended at any time by the President. The activities of the NSA authorised by EO 12333 are not governed by statute, are not subject to judicial oversight, are not justiciable and there was no evidence in relation to any programmes conducted pursuant to EO 12333. The collection of intelligence must be for the purposes of foreign intelligence as defined in EO 12333. This is an extremely broad definition, wider than the definition in FISA: -
“Information relating to the capabilities, intentions and activities of foreign powers, organisations or persons, but not including counterintelligence except for information on international terrorist activity.” (emphasis added)
he order establishes limits in relation to the collection, retention or dissemination of information concerning US persons (as defined) acquired pursuant to the order. It has no such limits in respect of information concerning non-US persons, though this may be qualified by PPD-28, as discussed below.
176. While EO 12333 is not relied upon for intelligence collection within the United States, it does authorise the collection of data in transit to the United States and data transiting through the United States but never intended to arrive for processing within the United States. This is referred to as transit authority. This means that the NSA may be authorised under EO 12333 to collect data from the deep underwater cables on the floor of the Atlantic by means of which data are transferred from the EU to the US for processing within the US before the data arrives within the US (and thus would be subject to the provisions of FISA). This means that the data of EU citizens in transit to the US may be accessed, acquired or retained pursuant to EO 12333. There was no evidence adduced in relation to any programme actually operated pursuant to EO 12333. There is no legal remedy for any actions of NSA pursuant to EO 12333.
177. The manner in which surveillance is actually conducted and data processed following acquisition is governed by Presidential Policy Directive – 28 (“PPD-28”). PPD - 28 applies certain principles to signal intelligence activities for the benefit of all persons whether United States persons or otherwise. Privacy and civil liberties are stated to be integral considerations in the planning of US signals intelligence activities. Signals intelligence is to be collected exclusively where there is a foreign intelligence or counterintelligence purpose to support national and departmental missions and not for any other purposes. Signals intelligence activities are required to be “as tailored as feasible”. PPD – 28 does not authorise any surveillance activities but establishes principles how authorised activities are to be conducted.
PRISM and Upstream
178. In order to appreciate how these laws may operate and may affect EU citizens it is useful to consider the evidence adduced based on declassified information in relation to two programmes operated by United States intelligence agencies pursuant to s. 702 of FISA.
179. In PRISM collection, the government sends a selector, such as an email address, to a United States based electronic communications service provider and the provider is compelled to give the communications sent to or from that selector to the government. The NSA receives all data collected through PRISM. In addition, the CIA and the FBI each receive a select portion of the data collected through PRISM. A selector must be a specific communications facility that is assessed to be used by the target, such as the target’s email address or telephone number. People are targeted and selectors are tasked. Only selectors used by non-US persons reasonably believed to be located abroad may be tasked. The government estimates that 89,138 persons were targeted under s. 702 during 2013. In 2015 there were 94,368 persons targeted under s. 702. A decision of the FISC from 2011 reveals that the government acquired more than 250,000,000 communications under this programme.
180. Upstream differs from PRISM in several respects. The acquisition occurs with the compelled assistance of service providers that control the telecommunications backbone – the network of cables, switches and routers - over which telephone and internet communications transit, rather than with the compelled assistance of internet service providers or similar companies. Upstream collection includes telephone calls as well as internet communications. Through Upstream collection the experts said that the NSA copies and searches streams of internet traffic as data flows across the internet backbone.
181. Prior to April, 2017 the situation with regard to Upstream was as follows. NSA Upstream collection acquired internet transactions that were “to”, “from”, or “about” a tasked selector. With respect to “to” and “from” communications, the sender or a recipient is a user of a s. 702 tasked selector. This is not necessarily true for an “about” communications. An about communication is one in which the tasked selector is referenced within the acquired internet transaction, but the target is not necessarily a participant in the communication. Collection of “about” communications involves searching the content of internet communications traversing the internet backbone which are subjected to Upstream surveillance. The internet transactions are first filtered to eliminate potential domestic transactions and then screened to capture only transactions containing a tasked selector. Transactions which pass both screening operations are acquired by the NSA. As of 2011, the NSA acquired approximately 26.5m internet transactions a year as a result of Upstream collection. Necessarily, this is a small portion of the amount of internet transactions subjected to the filtering process and of the number of worldwide internet communications.
182. Upstream also captures Multiple Communications Transactions (MCTs). MCTs are internet transactions that contain more than one discrete communication within it. If a single discrete communication within an MCT is to, from or about a s. 702 tasked selector and, at least one end of the transaction is foreign, the NSA will acquire the entire MCT. This may include communications between persons who have no connection whatsoever with the s. 702 target and are not themselves targets for surveillance for national security purposes or otherwise.
183. On 26th April, 2017, the FISC released an opinion addressing the United States government’s submissions seeking reauthorization to conduct surveillance under s .702 of FISA. The experts said that the opinion states that the government will not “acquire” or “collect” communications that are merely about a target but it does not indicate that the NSA has stopped copying and searching communications as they pass through its surveillance equipment prior to “acquisition” or “collection”. The opinion left unchanged the government’s long standing ability to query s. 702 data using non-US person identifiers. The opinion authorises the conduct of surveillance for a year and is a binding decision of the FISC. The government will have to reapply for authorization next year.
Mass surveillance?
184. There was a dispute between Mr. Schrems on the one hand and Facebook and the United States on the other hand as to how surveillance by the United States intelligence agencies should be characterised. Facebook and the United States said that in practice the surveillance was very targeted; it was not indiscriminate and it was not mass surveillance. Mr. Schrems on the other hand pointed to the vast number of communications acquired pursuant to the PRISM programme and to the method by which Upstream operated. Ms. Gorski, who gave evidence on his behalf, was of the opinion that Upstream involved searching billions of internet transactions crossing the internet backbone and this must be regarded as mass surveillance. She referred to the generalised access by the government of the United States to the content of communications under s. 702 Upstream surveillance.
185. The United States government acknowledges that in certain circumstances it collects signals intelligence in bulk and that it may result in the collection of information about persons whose activities are not of foreign intelligence or counter intelligence value (PPD-28, s. 2). It maintains that it is not engaged in mass or indiscriminate surveillance.
186. Service providers are required by law to comply with directions served upon them by the relevant agencies and thus potentially the intelligence agencies have access to all of the data held by the service providers as a matter of law and practice. Collection of data from the service providers pursuant to PRISM is targeted. An individual is the target. An email address or mobile phone number that is associated with the target is the selector and it is tasked and the service provider is directed to provide the communications responsive to the selector. As stated above, in 2015 there were 94,386 targets. However, this can multiply up to a very large number of communications. Targets communicate with non targets. Targets can have multiple selectors. In 2011, the government acquired more than 250,000,000 communications under s. 702 surveillance. PRISM accounts for approximately 90% of s. 702 surveillance so it can be seen that starting with less than 100,000 targets can result in the acquisition of an extremely large number of communications indeed. Of course, it is fair to say, as was pointed out on behalf of Facebook, that this in itself, though large, constitutes a very tiny proportion of the total number of internet communications.
187. Upstream operates differently. It necessarily involves making huge numbers of non relevant communications available for surveillance by the NSA. The NSA then searches this vast number of communications. It retains the communications which it “acquires” or “collects” from the vast number of communications to which it has access. It has access to the content as well as the metadata of these communications.
188. It is of course inherent in targeted searching that a large body of data is searched. The true difference between Mr. Schrems on the one hand and Facebook on the other hand, was the focus by Mr. Schrems on the making available and initial searching of billions of communications passing through the internet backbone, while Facebook focused upon the fraction of these communications which was actually acquired or collected and therefore subsequently retained and made available for analysis.
189. There is a distinction between bulk searching and bulk acquisition, collection or retention. In my opinion, the evidence clearly establishes that under Upstream there is mass surveillance in the sense that there is mass searching of communications. The search is for targeted communications and is in that sense not indiscriminate. Even when targeted it involves the collection of non relevant data as explained above.
190. The Directive defines processing of personal data as including any operation or set of operations which is performed upon personal data such as collection… or otherwise making available the data. On the basis of this definition and the evidence in relation to the operation of the PRISM and Upstream programmes authorised under s. 702 of FISA, it is clear that there is mass indiscriminate processing of data by the United States government agencies, whether this is described as mass or targeted surveillance.
Evidence on Relevant Data Protection Law in the United States
191. One of the experts described data protection law in the United States as an overlapping and labyrinthine array of statutory and non-statutory authorities. It is a complex web of constitutional law, sector specific federal statutes, state statutes and common law rules. This section of my judgment necessarily is a summary of the evidence adduced at trial and does not purport to be an exhaustive or comprehensive statement of the laws of the United States in this area.
192. The basic principle is that surveillance is legal unless forbidden and there is no requirement ever to give notice in relation to surveillance.
193. Data protection and data privacy rights, whether express or implied, are to be found in the First and Fourth Amendments to the Constitution. The First Amendment, which relates to freedom of speech, did not feature in the evidence at trial.
The Fourth Amendment
194. The experts identified the Fourth Amendment to the Constitution as being the most important protection against unlawful government surveillance. The Fourth Amendment applies to searches and seizures that take place within the US (such as on data transferred to the US). The prevailing assumption is that, as the law currently stands, non-EU citizens lacking substantial voluntary connection with the United States (such as the majority of EU citizens) may not bring a Fourth Amendment case. Thus, the foremost protection under US law against unlawful government surveillance is not available to most EU citizens. They may benefit indirectly from the protections guaranteed by the Fourth Amendment to those entitled to its protections.
Individual remedies available to EU citizens under US law
A. 18 U.S.C. Section 2712 (Stored Communications Act)
195. Section 2712 (a) permits a person who is aggrieved by a “willful” violation of certain specific statutory provisions to sue for damages. It applies to the Wiretap Act and the Stored Communications Act (together the Electronic Communications Privacy Act) and to three sections of FISA.
196. These are 50 USC sections 1806 (a), section 1825 and section 1845. Section 1845 is of no relevance to Mr. Schrems’ reformulated complaint. Section 1806 (a) prohibits the use or disclosure by Federal officers or employees except for lawful purposes of information acquired from an electronic surveillance within the United States for foreign intelligent purposes.
197. Section 1825 prohibits the use or disclosure by Federal officers or employees except for lawful purposes of information acquired from physical searches within the United States for foreign intelligent purposes.
198. The court may award as damages (1) actual damages, but not less than $10,000, whichever amount is greater and (2) litigation costs reasonably incurred. “Willful” in the context of a claim for damages under s. 2712 (a) has been held to mean both knowing and reckless violations of the statute.
199. Section 2712 amounts to an express waiver of sovereign immunity for the government. Damages may be recovered from the government. It is an exclusive remedy against the United States. Therefore, no relief other than damages may be obtained for breaches of these provisions.
200. Because s. 2712 provides an exclusive remedy for damages against the United States, it precludes action under the Administrative Procedures Act (as discussed below) for any of the causes of action listed in s. 2712. It does not apply to ss. 1810 or 1861 of FISA (s. 215 of PATRIOT Act).
201. There are minimisation procedures and other provisions in relation to ss. 1806, 1825 and 1845 which concern only United States persons – defined as US citizens and lawful residents or US corporations. Therefore, EU citizens who are not US citizens or residents would not be able to bring a claim under s. 2712 for non-compliance with the minimisation procedures or these other provisions.
B. 50 USC Section 1810
202. Under s. 1810 an affected person (other than a foreign power or an agent of a foreign power) who has been subjected to electronic surveillance, or about whom information obtained by electronic surveillance of such person has been disclosed or used, in violation of the provisions of s. 1809 can recover;
203. Section 1810 is not included within s. 2712. It does not operate as a waiver of sovereign immunity which means that the United States cannot be held liable under the section. Any case must be brought against the individual actors. Under s. 1810 the disclosure must be in breach of s. 1809 which means the plaintiff must prove willful/intentional violation of the section. There have been no prosecution of officers or employees under s. 1809 and the section was described by Professor Vladeck on behalf of Facebook as very narrow and difficult to prove.
204. Even if a plaintiff under s. 1810 could prove willful violation, the plaintiff must still overcome possible issues of sovereign immunity and official immunity. Because there is no waiver of sovereign immunity with regard to the United States, it is arguable that sovereign immunity may extend to officers acting in their official capacity. If it does not, officers may still rely upon official immunity. The test is: the officer must have violated clearly established law of which a reasonable officer would have known. It is clear that the liability is personal and therefore the head of an agency may be entitled to claim official immunity in respect of proceedings brought under s. 1810 (even if he or she cannot assert sovereign immunity).
205. Professor Vladeck accepted that both of these possible immunities may prove substantial obstacles to relief. On the other hand, he was of the opinion that if the plaintiff could prove his or her case, it was likely that the government would indemnify the individual officer.
C. 50 USC Section 1806
206. Claims brought for willful violation of s. 1806 (a) are brought under s. 2712. Section 1806 (e) provides an exclusionary remedy for a person against whom evidence gained by electronic surveillance is being introduced in criminal or administrative proceedings. The person against whom the evidence is being introduced has the right to bring a motion to suppress the evidence gained by electronic surveillance if it is shown that the information was unlawfully obtained or that the surveillance was not made in conformity with an order of authorisation or approval. It does not of itself provide a remedy for unlawful processing of personal data.
207. To date, only eight criminal defendants have received notices of s. 702 surveillance. The only adversarial rulings by US courts on the legality of surveillance under FISA s. 702 to date have come through s. 1806 motions to suppress.
D. Electronic Communications Privacy Act (ECPA)
208. The Electronic Communications Privacy Act governs when electronic communications and wire communications can be intercepted or monitored. It is an exceptionally complex piece of legislation. It consists of the Wiretap Act and the Stored Communications Act (SCA). The Wiretap Act applies to the interception or accessing of information while in transmission. The SCA applies to the unauthorised access of stored communications. Remedies under the ECPA are generally available to both US citizens and foreign nationals and non citizens are entitled to protections of the ECPA. It is unclear whether suits can proceed against the agencies themselves in addition to the individual officers.
209. Section 2712 confers a cause of action for willful violation of the Wiretap Act or the SCA. Under the Wiretap Act it is a crime for persons to intentionally intercept or procure electronic communications, including email, unless certain exceptions apply. It is a violation of the Wiretap Act to disclose communications if the person making the disclosure knew or had reason to know that the communication was intercepted in violation of the ECPA.
210. Under the SCA it is illegal to obtain, alter or prevent authorised access to a wire or electronic communication while it is in electronic storage in such system if a person “intentionally accesses without authorisation a facility through which an electronic communication service is provided” or “intentionally exceeds an authorisation to access that facility”.
211. Claims for damages under the Wiretap Act or the SCA apply to wrongful collection and not just use and disclosure.
E. Privacy Act and Judicial Redress Act
212. The Privacy Act allows US citizens to access their records or information pertaining to those individuals held by governmental agencies and to review those records and have copies made. The head of any agency may promulgate rules to exempt certain systems of records from the Act. There is no blanket exemption for records collected by a particular agency. However, there are regulations prohibiting the disclosure of records pertaining to the functions and activities of the NSA. All systems of records maintained by the NSA are exempt from disclosure to the extent that the system contains information properly classified under an executive order and that is required by executive order to be kept secret in the interest of national defence or foreign policy. Thus, the NSA has exempted itself from the most significant protections afforded to individuals. As the NSA is the primary agency responsible for foreign intelligence signals gathering, this means that the Privacy Act for all practical purposes is likely to provide no remedy to an EU citizen.
213. In any event, it is necessary to establish that the disclosure was intentional or willful and that the disclosure had an adverse effect on the plaintiff. It is necessary to establish pecuniary loss and damage. Non economic harm is insufficient. Federal Aviation Authority. v. Cooper 137 S.Ct. 1441 (2012)
214. The experts stated that Privacy Act suits face numerous hurdles including subject matter exemptions, classified documents, the “routine use” exception, F.A.A. v. Cooper limiting damages and most importantly the exemption of national security records from the coverage of the Privacy Act.
215. The Judicial Redress Act extended the protections of the Privacy Act to the covered records held by designated agencies in respect of covered countries. As of the 1st of February, 2017, all EU countries, with the exception of the United Kingdom and Denmark, are covered countries for the purposes of the Judicial Redress Act. However, the NSA is not a designated agency for the purposes of the Act. Therefore, citizens of the EU may not bring a Privacy Act/JRA suit against the NSA.
216. There are also issues concerning the definition of covered records and covered countries which means that data initially transferred to a private company in the US and then acquired by a US government agency may not be a covered record. As the United States is not defined as a covered country, this may mean that sovereign immunity has not been waived with the result that any suit against any agency would be barred by a plea of sovereign immunity.
217. On the 25th of January, 2017, a new executive order on the topic of immigration was issued by President Trump. Section 14 states: -
“Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residence from the protection of the Privacy Act regarding personally identfiable information.”
The legal effect of the executive order is uncertain. The experts agree that the provision is a change in policy from the previous administration which had expanded the number of agencies that applied administrative Privacy Act protections to mixed systems of records (databases containing both US and non-US person information). This order has been superseded as of the date of judgment but no evidence was given of the terms of the latest version of this executive order.
218. In practice, it is extremely unlikely that the Privacy Act will afford a remedy for breaches of data protection to an EU citizen.
Administrative Procedure Act
5 U.S.C. Section 702
219. Only Professor Vladeck placed emphasis on the Administrative Procedure Act as a possible source of remedy. It was not referred to by Professor Swire who gave evidence on behalf of Facebook or Mr. Robert Litt in his letter to the Commission included as an annex to the Privacy Shield Decision. Professor Richards and Mr. Serwin who gave evidence on behalf of the DPC both discounted it as a meaningful avenue of redress for EU citizens.
220. The Administrative Procedure Act is precluded if a plaintiff has a remedy under an alternative statutory provision. By reason of the provisions of s. 2712 this means that the Act is precluded in relation to suits brought pursuant to the Wiretap Act, the SCA and ss. 1806, 1825 and 1845 of FISA. Claims under FISA 1810 and 1861 (s. 215 PATRIOT Act) are not precluded from the Administrative Procedures Act as discussed above.
221. The Act provides that “any person suffering legal wrong because of agency action or adversely affected or aggrieved by agency action is entitled to seek judicial review.” Even where the Act applies the remedies available are subject to limitations. A plaintiff must establish that he or she falls within “the zone of interest” of the Act and that the action complained of is “a final agency action”. It is not clear whether monitoring a particular individual’s communications for the purposes of national security is “a final agency action” under the APA, but Professor Vladeck believes that a directive to a service provider would qualify as a final agency action. He adduced no authority to support this opinion. A plaintiff may obtain injunctive or declaratory relief (provided the complained of action has not ceased) but not damages under the APA.
Standing
222. While there are a variety of possible judicial remedies open to EU citizens in respect of possible unlawful processing of their private data by United States agencies as I have set out, in all cases it is necessary for a plaintiff to establish that he or she has standing to bring the suit. This is a very complex matter in the context of secret government surveillance. All of the evidence show that it is an extraordinarily difficult hurdle for a plaintiff to overcome. It constitutes a substantial obstacle to maintaining any of the causes of action discussed.
223. Under Article III of the US Constitution, a plaintiff must have standing to bring suit before a federal court as a precondition to bring a claim. The party invoking federal jurisdiction bears the burden of establishing the following three elements:
(1) that it has suffered an injury in fact – an invasion of a legally protected interest which is (a) concrete and particularised and (b) actual or imminent, not conjectural or hypothetical;
(2) That there is a causal connection between the injury and the conduct complained of – the injury has to be fairly traceable to the challenged action of the defendant, and not the result of the independent action of some third party not before the court;
(3) That it is likely, as opposed to merely speculative, that the injury will be redressed by a favourable decision.
224. In Clapper v. Amnesty International US, 133 S.Ct. 1138 [2013] the Supreme Court considered the imminence test of “injury in fact” in the context of alleged unlawful surveillance by the Director of National Intelligence of the communications of the plaintiffs. The court held that it meant “certainly impending”. It rejected the formulation of the Second Circuit that “objectively reasonable likelihood” that communications will be interfered with was sufficient to meet the test of “injury-in-fact”.
225. This decision makes it more difficult for plaintiffs to establish standing in the absence of express notice that they personally have been surveilled. This is particularly significant as there is no notification obligation. The experts agreed that in the absence of notice that a plaintiff has been the subject of surveillance (and thus his data processed), it would be very difficult to challenge that surveillance. In the vast majority of cases persons surveilled will never receive notice of the fact –and therefore they will not be in a position to challenge the surveillance both because of their ignorance of a possible claim and their inability to establish standing as required by Clapper.
226. The application of the test depends upon what is called the posture of the case. A plaintiff’s standing to sue can be challenged on the basis of the pleaded case by a motion to dismiss, in which case the plaintiff is required to show that he has plausibly pleaded his case in order to survive the motion to dismiss. The facts are assumed in his favour but they must amount to a legal wrong, if proven. His standing may also be challenged by a motion for summary judgment. If that occurs, it is not sufficient for the plaintiff to plead plausible allegations; he must adduce evidence to support his claim and if he fails to do so his action will be dismissed.
227. Clapper was an application for summary judgment and the plaintiffs failed because they failed to prove facts that the injury alleged was imminent.
228. Wikimedia Foundation v NSA (4th Cir. 15-2560) was a decision of the Fourth Circuit of Appeals on a motion to dismiss the claims of the plaintiffs delivered on 23rd May, 2017. Wikimedia engages in more than 1 trillion international communications a year in almost every country on the globe. It challenged the Upstream programme pursuant to s. 702 based on the manner in which Upstream operates as acknowledged by the PCLOB report, the vast number of its communications and the geographical diversity of the people with whom it communicates. It said its communications almost certainly travers every international backbone link connecting the United States with the rest of the world. If, as is clear from the PCLOB report, the NSA is monitoring at least a single internet backbone link then the NSA is intercepting, copying and reviewing at least some of its communications. The court held that Wikimedia had plausibly alleged that its communications travelled all of the roads that a communication can take and that the NSA seizes all of the communications along at least one of those roads. It therefore had standing at a motion to dismiss stage to sue for a violation of the Fourth Amendment.
229. The court emphasised the importance of the distinction between motions to dismiss and summary judgments in determining whether the plaintiff had standing to sue. The court held that Wikimedia had standing as it had pleaded an actual and ongoing injury. Because it pleaded an actual injury, the analysis of an impending injury set out in Clapper did not apply. On the other hand, the court held that none of the other plaintiffs had plausibly pleaded a case – their case was different to that of Wikimedia-and therefore dismissed their claims at the motion to dismiss stage of the proceedings.
230. In addition to proving that the complained of wrong had occurred (actual) or was imminent, a plaintiff must also satisfy the “concrete and particularised” limb of the test. “Particularised” means that it affects the plaintiff in a personal and individual way. “Concrete” means that the harm may not be hypothetical. It must be real not abstract. It may be intangible and still concrete, but a bare procedural violation of a statutory right is not sufficient. (See Spokeo v. Robbins 135 S. Ct. 1892 (2016)) Therefore a simple violation of an individual’s statutory right may not be sufficient of itself to establish standing.
231. Interference with data was accepted by the court as sufficient to establish standing for the purposes of a claim for a violation of the Fourth Amendment in Wikimedia. The experts disagreed whether Spokeo meant that a plaintiff suing for violation of a statutory right would be required to show more than interference with his data in order to satisfy the concrete limb of the test for standing i.e. whether he was required to show damage. In FAA v Cooper 1320S. Ct 1441 (2012) the Supreme Court held that for a claim under the Privacy Act the plaintiff was required to prove pecuniary loss.
232. The experts all agreed that standing is notoriously indeterminative and that it is possible to find cases across a range of possibilities. Many cases have been dismissed for want of standing and others have not. There is significant uncertainty in the federal district courts over exactly when Clapper does and does not foreclose standing. There was a dispute among the experts as to the degree of the uncertainty and thus the difficulty in establishing standing. The experts agree that the government’s failure to notify individuals subject to its secret surveillance programmes makes it more difficult for plaintiffs to establish standing.
233. The difficulties with regard to standing can be illustrated by two recent decisions. In ACLU v. Clapper, 785F3d 787 (2nd Cir. 2015) the second circuit was concerned with a s. 215 programme which authorised the collection of all of the metadata of all of the customers of Verizon in the United States. The FISC had authorised this metadata programme on 41 occasions pursuant to s. 215 of the PATRIOT Act. Edward Snowden leaked the actual FISC order and it was thus clear that it applied to all customers of Verizon. ACLU was a customer of Verizon. Thus, it was able to satisfy the test for injury in fact as set down in Clapper v. Amnesty International as it could show an actual injury and was not attempting to establish an imminent injury.
234. But for the fact the particular programme collected the data of all of the customers of Verizon, ACLU might not have been able to satisfy the test for standing in light of the decision in Clapper v. Amnesty International.
235. The case highlights the significance of the absence of notice. ACLU had no notice of the metadata programme and therefore was unaware of the fact that it was subject to surveillance and could not sue in respect of the surveillance. It was only as a result of the illegal leaks of Mr. Snowden that it became aware of the surveillance and that it had a possible cause of action.
236. The case also illustrates the importance of judicial review. The second circuit struck down the metadata programme in its entirety on the basis that it exceeded the statutory authorisation for such surveillance (to obtain foreign intelligence). This was so even though the programme had received prior authorisation from the FISC on 41 occasions.
237. It underscores the importance of remedies to protect the rights of individuals, not just the particular plaintiff. If the case had not been brought, the programme would not have been declared unlawful and the surveillance of millions of persons could have continued unchallenged. Incidentally, it should be noted that the case was brought on the basis of the Administrative Procedure Act and the Fourth Amendment, and an EU citizen would have been confined to the action under the APA, with all the technical difficulties involved in bringing forward such a claim.
238. The second case is Wikimedia. Wikimedia was held to have standing at the motion to dismiss stage of the proceedings because it could plausibly allege that its communications were so vast that they must travel all the roads that a communication can take and that the NSA seizes all of the communications along at least one of those roads. There will be very few other plaintiffs able to advance such a claim. On the other hand, the other plaintiffs, who included Amnesty International, Human Rights Watch and the National Association of Criminal Defense Lawyers, were held not to have standing even at this stage of the proceedings. Their case was that the NSA is intercepting “substantially all” text-based communications entering and leaving the United States. However, they could not assert enough facts about Upstream’s operational scope to plausibly allege a dragnet that must capture their communications and, following Clapper, an “objectively reasonable likelihood” that their communications would be intercepted was not sufficient to establish their locus standi.
Systemic Safeguards and Oversights
Oversight by FISC
239. The FISC oversees the activities of the agencies who obtain orders for the collection of data under s. 215 or the annual certifications that provide the basis for collection of data under s. 702. As stated above, there is no judicial approval of individual selectors to query the data collected under s. 215 or tasked for collection under s. 702. The FISC operates ex parte and in secret. Its orders and opinions are classified, unless they are declassified. Increasingly, more material has been declassified. There is no judicial oversight of the collection of foreign intelligence outside the US, including pursuant to transit authority, under EO 12333.
240. The FISC (and the FISCR) is supported by a standing panel of five individuals who have expertise in national security matters as well as civil liberties. From this group, the court may appoint an individual to serve as an amicus curiae to assist in the consideration of any application for an order or review that, in the opinion of the court, presents a novel or significant interpretation of the law. This ensures that there can be a suitably qualified interlocutor to engage with the government on what would otherwise be ex parte applications.
241. Professor Swire on behalf of Facebook gave evidence of the fact that the FISC has in the past refused to authorise certain programmes, has rigorously scrutinised the targeting and minimisation procedures and issues of non-compliance with these procedures which have been reported to the court. Where data has been obtained without due authorisation, the FISC has directed the destruction of the data.
242. The opinion of the FISC of 26th April, 2017, illustrates very close scrutiny by the FISC of the applications for certificates pursuant to s. 702 of FISA. The court is required to ensure that the requirements of the statute are satisfied and that procedures are reasonable in light of the Fourth Amendment. The opinion also illustrates the court monitoring and supervising compliance with its orders. The opinion referred to “significant non-compliance with NSA minimization procedures” which it said were widespread. It detailed a number of violations of earlier orders by the FBI and the CIA. It said that the NSA had failed to give the court timely notice of the issue and revealed “an institutional lack of candour” and emphasised that this was a very serious Fourth Amendment issue. The government was forced to end “about” collection under Upstream in light of the non-compliance with the previous procedures which protected the privacy of US persons.
Other forms of oversight
243. The US intelligence agencies are subject to various additional review and oversight mechanisms. According to PPD-28, s. 4 (a) (iv), the policies and procedures of the intelligence community elements “… shall include appropriate measures to facilitate oversight over the implementation of safeguards protecting personal information…”. These measures include periodic auditing. Multiple oversight layers have been put in place including civil liberties or privacy officers, Inspectors General, the office of the Director of National Intelligence Civil Liberties and Privacy Office and the President’s Intelligence Oversights Board.
244. The civil liberties or privacy officers supervise procedures to ensure that the relevant agency is adequately considering privacy and civil liberties concerns and has put in place adequate procedures to address complaints. Each agency has its own Inspector General with responsibility to oversee foreign intelligence activities. They are authorised to investigate complaints or information concerning allegations of unlawful conduct, or abuse of authority in connection with Office of the Director of National Intelligence (ODNI) or the programmes or activities of agencies. Inspectors General may issue non-binding recommendations for corrective action. Their reports are made public and sent to Congress. Civil liberties and privacy officers periodically report to Congress and the PCLOB.
245. The Privacy and Civil Liberties Oversight Board (PCLOB) is an independent agency within the executive branch composed of five presidential appointees. It receives reports from the civil liberties and privacy officers of several departments and agencies and regularly reports to congressional committees and the President. Currently and for some months it has only one member and is inquorate.
246. In addition, the Department of Justice and the Department of Defence each provide extensive oversight of intelligence activities. In the NSA alone there are over 300 employees dedicated to compliance issues.
247. Agencies are required to report incidents of non compliance with the rules and procedures authorising the collection of signals intelligence. The reports are to the head of the particular intelligence community element, the Director of National Intelligence and the Intelligence Oversight Board. This is to ensure that an issue will be addressed at the highest level. They are also reported to the FISC.
248. In considering the weight to be attached to these extensive provisions it is worth bearing in mind the limitations which have been shown to exist notwithstanding the best efforts of those concerned in carrying out this very extensive oversight of the intelligence agencies. It is apparent from the opinion of the FISC of 26th April, 2017, that it is dependent upon the agencies acting promptly and with candour, something that may, at times, be lacking. In this regard, I should note that the FISC authorised the revised targeting and minimization procedures despite the reported instances of non-compliance with prior orders of the court based largely on “the extensive oversight conducted within the implementing agencies” and by the Department of Justice and ODNI. It held that “due to those efforts, it appears that compliance issues are generally identified and remedied in a timely and appropriate fashion”. Further, it should be remembered that the programme that was struck down in ACLU v Clapper on the basis that it far exceeded what was authorised by the statute, had been authorised by the FISC on 41 occasions.
249. In addition to executive oversight mechanisms, the US Congress, specifically the House and Senate Intelligence and Judiciary committees, have oversight responsibilities regarding all US foreign intelligence activities, including US signals intelligence. The President is obliged to keep the congressional intelligence committees fully and currently informed of the intelligence activities of the United States including any significant anticipated intelligence activity. The President is to ensure that any illegal intelligence activity is reported promptly to the congressional intelligence committees as well as any corrective action that may have been taken or is planned in connection with such illegal activity. The oversight committees have subpoena power and access to classified information.
250. The USA FREEDOM Act 2015 requires the government to disclose to Congress and the public each year the number of FISA orders and directives sought and received as well as estimates of the number of US and non-US persons targeted by surveillance. There has been an increased emphasis on declassifying the opinions of the FISC and the targeting and minimisation procedures adopted by the respective agencies pursuant to the orders of the FISC.
Conclusions in Relation to the Evidence Regarding Remedies
251. There are a variety of very significant barriers to individual EU citizens obtaining any remedy for unlawful processing of their personal data by US intelligence agencies.
252. Since the orders of the FISC are classified and companies are required to maintain secrecy with regard to the assistance they are required to provide, there are no judicial or administrative avenues for data subjects to be informed of whether their personal data is being collected or further processed. There are no opportunities for individuals to obtain access, rectification or erasure of data, or administrative or judicial redress.
253. The necessity for a plaintiff to establish that he has standing to sue constitutes a very substantial obstacle to any legal remedy. Clapper v. Amnesty International has made it exceedingly difficult to challenge secret government surveillance programmes, according to Professor Swire, who gave evidence on behalf of Facebook. Establishing an objectively reasonable likelihood that one has been the subject of surveillance is insufficient to satisfy the standing requirement. (Clapper v. Amnesty International, Wikimedia v. NSA).
254. The absence of express notice makes it even more difficult to meet the threshold for standing set by the Supreme Court in Clapper v. Amnesty International (see Wikimedia in contrast to ACLU v. Clapper) even if the plaintiff believes that it is highly likely that their data have been or will be accessed and/or acquired by one or more of the US intelligence agencies.
255. Under FISA, the personal data of an EU citizen can be seized, accessed and retained by a US government agency without the agency proving probable cause prior to obtaining a warrant in respect of the individual EU citizen from the FISC. There is no need to obtain any authorisation for surveillance conducted under EO 12333.
256. By far the most significant avenue of redress for unlawful interference with personal data is a claim for violation of the provisions of the Fourth Amendment. Such a claim is not open to EU citizens lacking a substantial voluntary connection with the US.
257. There are a number of possible causes of action potentially open to EU citizens in respect of processing of their data by government intelligence agencies in the United States, but on closer analysis it becomes clear that there are substantial obstacles to recovery in respect of some causes of action such that in reality an EU citizen is most unlikely to obtain a remedy for unlawful acquisition or processing of his personal data (actions under the Privacy Act or s. 1810 of FISA). A motion to suppress evidenced to be adduced in a criminal trial pursuant to s. 1806 of FISA is not a general remedy for wrongful interference with personal data. This in effect leaves claims for damages under s. 2712 of ECPA or claims under the APA. Some causes of action require the plaintiff to establish that he or she has suffered damage, which has been held to mean pecuniary damage. This is a significant limitation on the right to seek a remedy that does not apply under EU law. In Schrems para. 89 the CJEU noted that it has repeatedly stressed that to establish the existence of an interference with the fundamental right to privacy, it does not matter whether the person concerned has suffered any adverse consequences on account of the interference. For claims under s. 2712 a plaintiff is required to prove a willful violation of the statute by an individual actor. How difficult this may be will obviously depend upon the facts of the case.
258. A claim under the APA only lies if there is no other statutory claim available. This rules out many potential cases. Even where the claim is not precluded, there is uncertainty whether it extends to collecting, processing or retaining the data of a particular individual.
259. In my opinion, despite the number of possible causes of action, it cannot be said that US law provides the right of every person to a judicial remedy for any breach of his data privacy by its intelligence agencies. On the contrary, the individual remedies are few and far between and certainly not complete or comprehensive.
260. I accept the conclusion of Professor Vladeck that retrospective judicial remedies will likely be unavailing to victims of governmental overreaching in the conduct of surveillance for the purpose of national security.
261. Quite clearly there are extensive rules to ensure that data is obtained in accordance with law and data, once obtained, is not misused. This is not the same as providing a remedy where the rules are broken and data is unlawfully collected or otherwise misused. Protections against excessive or inappropriate surveillance are essential to an acceptable system of state surveillance. It is vitally important to ensure that secret surveillance does not exceed what society deems to be the appropriate limitations for such surveillance. But no system can ever be perfect. This is clearly illustrated by the FISC opinion of 26th April, 2017. There is a fundamental difference between protections and safeguards on the one hand and remedies on the other. A protection cannot be a remedy, though obviously the better the protection the less likely it is that a recourse to a remedy will be required. A remedy is to be available when the protections have in a sense failed.
262. Professor Swire gave as his opinion that it is sometimes difficult to provide individual remedies in the intelligence setting because of the risk of revealing classified information to hostile actors. He stated, “the desirability of individual remedies, in intelligence systems must be weighed against the risks that come from disclosing classified information”
263. Article 52 of the Charter requires that the essence of the right be respected. In this case, the essence of the right under Article 47 of the Charter is the right of an individual to an effective remedy before a tribunal. The question of the desirability of individual remedies as referred to by Professor Swire does not arise if the essence of this right is not protected.
Article 47 of the Charter
(I) Is it Engaged?
264. The DPC in considering Mr. Schrems’ reformulated complaint did not conduct an adequacy assessment in respect of the laws of the United States in relation to data protection and privacy. She conducted an inquiry into the essence of Mr. Schrems’ rights under Article 47 of the Charter and then considered whether the essence of the rights guaranteed by Article 47 of the Charter were protected when his personal data were transferred by Facebook to Facebook Inc. and thereby made available to be processed by the United States intelligence agencies.
265. This approach was heavily criticised by Facebook, the government of the United States and two of the other amici curiae.
Submissions of Facebook
266. Facebook argued that the DPC had not analysed whether there was any infringement of Mr. Schrems’ fundamental rights and freedoms guaranteed under Articles 7 and 8. It submitted that this was a precondition to any question of a right under Article 47 arising and that therefore her entire analysis was flawed and must be rejected.
267. It seems to me that this argument is inconsistent with the requirement that each right under consideration (in this case the right to an effective remedy in the event that there is a breach of the protection of the data privacy rights of EU citizens whose data are transferred to the United States) must be individually assessed and the requirements of each Article engaged must be satisfied. This was emphasised by both the Advocate General and the court in Schrems (opinion para. 170 and 173; ruling paras. 94-95) and the Advocate General in Joined Cases C-293/12 and C-594/12 Digital Rights Ireland Ltd v Minister for Communications, Marine and Natural Resources and Others and Kärntner Landesregierung and Others (paras 60 – 61). The case was predicated upon the question that, insofar as there are breaches of EU citizens’ data protection rights in the US, do the EU citizens have the same type of effective remedy before an independent and impartial tribunal of the type envisaged by Article 47 in the United States? Therefore, it is this question which must be addressed.
268. Facebook argues that Article 47 applies to rights and freedoms guaranteed by the law of the Union. It submits that the national security of the individual member states remains the sole responsibility of each member state (Article 4 of TEU). It follows, according to Facebook, that Article 47 is not engaged at all.
269. In addition, Facebook argues that if the actions complained of in these proceedings occurred in a Member State there would be no question of an Article 47 right to an effective remedy as the Charter would not apply to the actions of a Member State in the area of national security. On that basis, it says, the laws and practices of the United States cannot fail the essential equivalence test enunciated by CJEU in Schrems.
Discussion
270. It seems to me that these submissions are incorrect. In Schrems it was accepted by the Advocate General and CJEU that Article 47 applied notwithstanding the fact that the interference with personal data of EU citizens in question resulted from surveillance by the United States intelligence services. At para. 173 of his opinion, Advocate General Bot noted that the referring court found that in the United States citizens of the Union have no effective right to be heard on the question of the surveillance and interception of their data. He considered that this amounted to an interference with the rights of citizens of the Union to an effective remedy, protected by Article 47 of the Charter. The CJEU likewise considered that Article 47 applied in the circumstances of that case (see para. 95). The Court, in those circumstances, had no difficulty in applying the essential equivalence test.
271. In ZZ v. Secretary of State for the Home Department [2004] EWCA Civ 1578 the CJEU considered a decision of the United Kingdom refusing a citizen of the European Union admission to the United Kingdom on public security grounds. The Directive engaged in that case was Directive 2004/38/EC which concerned the freedom of movement of persons and the question referred related to the interpretation of Article 30 (2) of the Directive read in the light in particular of Article 47 of the Charter. At para. 38 the court stated: -
“… although it is for Member States to take the appropriate measures to ensure their internal and external security, the mere fact that a decision concerns State security cannot result in European Union law being inapplicable”
ZZ was concerned principally with the application of Article 47 of the Charter in the context of a decision by the relevant authorities not to disclose information to ZZ on the grounds of national security. Thus, it is clear that as a matter of principle Facebook’s argument in this regard is incorrect.
272. Finally, it should be remembered that the transfers of data to which Mr. Schrems objects are the transfers by Facebook to Facebook Inc. in the United States and clearly EU law is engaged in respect of these transfers. He thus has the benefit of the fundamental rights and freedoms guaranteed to him by the Charter including the rights guaranteed under Article 47. This applies even though the processing which may give rise to a claim is that which may arise from subsequent interference with his personal data by intelligence agencies of the United States.
273. For these reasons, I believe that Article 47 of the Charter is engaged in these proceedings.
(II) Do the laws of the United States respect the essence of Article 47?
Submissions of the DPC
274. The DPC submits that, pursuant to Article 47, everyone whose rights and freedoms guaranteed inter alia by Articles 7 and 8 of the Charter and of the Directive are violated, has the right to an effective remedy before an independent and impartial tribunal. It was accepted by all parties that, pursuant to Article 52 (1) of the Charter, this right could be limited. Any limitation on the exercise of the right must be provided for by law and respect the essence of the right and freedom.
275. The DPC says that US law does not respect the essence of the right guaranteed by Article 47 to an effective remedy before an independent tribunal and that therefore it is not necessary to conduct a proportionality assessment of US law.
276. The DPC submits that there is an absolute requirement on intelligence agencies who have, in one way or another, surveilled the data of EU citizens to notify the persons affected as soon as that notification is no longer liable to jeopardise the investigations being undertaken by those authorities: -
“Likewise, the competent national authorities to whom access to the retained data has been granted must notify the persons affected, under the applicable national procedures, as soon as that notification is no longer liable to jeopardise the investigations being undertaken by those authorities. That notification is, in fact, necessary to enable the persons affected to exercise, inter alia, their right to a legal remedy, expressly provided for in Article 15(2) of Directive 2002/58, read together with Article 22 of Directive 95/46, where their rights have been infringed . This is so as notification is in fact necessary to enable the persons affected to exercise their right to a legal remedy.” (Watson para.121).
277. While Watson is a decision of CJEU on Article 47 of the Charter, the reasoning reflects the jurisprudence of the ECHR. In Zakharov v. Russia (case 47143/06) [2015] ECHR 1065 the ECHR considered secret surveillance laws in Russia in a case brought by a journalist who believed, but could not prove, that he had been the target of surveillance by state authorities. At para. 287 the ECHR held as follows:-
“It may not be feasible in practice to require subsequent notification in all cases. The activity or danger against which a particular series of surveillance measures is directed may continue for years, even decades, after the suspension of those measures. Subsequent notification to each individual affected by a suspended measure might well jeopardise the long-term purpose that originally prompted the surveillance. Furthermore, such notification might serve to reveal the working methods and fields of operation of the intelligence services and even possibly to identify their agents. Therefore, the fact that persons concerned by secret surveillance measures are not subsequently notified once surveillance has ceased cannot by itself warrant the conclusion that the interference was not “necessary in a democratic society”, as it is the very absence of knowledge of surveillance which ensures the efficacy of the interference. As soon as notification can be carried out without jeopardising the purpose of the restriction after the termination of the surveillance measure, information should, however, be provided to the persons concerned… In the cases of Association for European Integration and Human Rights and Ekimdzhiev and Dumitru Popescu (no. 2), the Court found that the absence of a requirement to notify the subject of interception at any point was incompatible with the Convention, in that it deprived the interception subject of an opportunity to seek redress for unlawful interferences with his or her Article 8 rights and rendered the remedies available under the national law theoretical and illusory rather than practical and effective… in the case of Kennedy the absence of a requirement to notify the subject of interception at any point in time was compatible with the Convention, because in the United Kingdom any person who suspected that his communications were being or had been intercepted could apply to the Investigatory Powers Tribunal, whose jurisdiction did not depend on notification to the interception subject that there had been an interception of his or her communications.” (emphasis added)
278. Article 52 (3) of the Charter provides that insofar as the Charter contains rights which correspond to rights guaranteed by the Convention, the meaning and scope of those rights shall be the same as those laid down by the Convention. The provision does not prevent Union law from providing more extensive protection. In this case Article 13 of the Convention provides the right to an effective remedy which corresponds to Article 47 in the Charter. It follows therefore that Article 47 cannot be interpreted as providing for a lesser remedy than Article 13 of the Convention as expounded in the jurisprudence of the ECHR.
279. The DPC submits that US law never requires that the subject of surveillance receive notification at any time of the surveillance. She argues that this is critical to the right to an effective remedy as guaranteed by Article 47 of the Charter. It was accepted by the experts on the law of the United States that most people never know that they have been the subject of surveillance and if they do not know that effectively they can never sue. Thus, the DPC agrees with the conclusion of Professor Brown in Brown et al. “Towards Multilateral Standards for Surveillance Reform”, (2015) that US law does not satisfy the requirements of the ECHR in relation to Article 13 and thus does not satisfy the requirements of Article 47.
280. Secondly, the DPC submits that the essence of an Article 47 right is a right to the possibility of a judicial remedy or at the very least a remedy from an independent tribunal. She argues that the law in relation to standing in the United States makes it extremely difficult to establish standing for an EU citizen who alleges interference with his personal data. Professor Swire accepted that it would be exceedingly difficult to challenge secret surveillance by government agencies for EU citizens and Professor Vladeck stated that it was likely that retrospective judicial remedies will be unavailing.
281. This is to be contrasted with the situation under European Union law. In Verholen v. Sociale Verzekeringsbank Amsterdam (Cases C-87/90, C-88/90 and C-89/90) [1991] ECR I-3757 para. 24 the ECJ held: -
“While it is, in principle, for national law to determine an individual's standing and legal interest in bringing proceedings, Community law nevertheless requires that the national legislation does not undermine the right to effective judicial protection and the application of national legislation cannot render virtually impossible the exercise of the rights conferred by Community law.” (emphasis added)
282. In Unibet (London) Ltd and Unibet (International) Ltd v. Justitiekanslern (Case C-432/05) [2007] ECR I-2271 the ECJ noted at para. 43 that: -
“… the detailed procedural rules governing actions for safeguarding an individuals’ rights under Community law…must not render practically impossible or excessively difficult the exercise of rights conferred by Community law…”(emphasis added)
283. The DPC says the effect of the rules of standing in the United States is to make the bringing of cases practically impossible or excessively difficult and that this effectively undermines the right to effective judicial protection. She submits that this fails to respect the essence of the fundamental right to an effective remedy guaranteed by Article 47.
284. She also argued that the US rules with regard to standing were more stringent than those accepted by the ECHR and this had the effect of rendering the remedies available under US law theoretical and illusory rather than practical and effective. In Zakharov the court summarised the case law of the ECHR and at para. 171 concluded: -
“The Court accepts that an applicant can claim to be the victim of a violation occasioned by the mere existence of secret surveillance measures, or legislation permitting secret surveillance measures, if the following conditions are satisfied. Firstly, the Court will take into account the scope of the legislation permitting secret surveillance measures by examining whether the applicant can possibly be affected by it, either because he or she belongs to a group of persons targeted by the contested legislation or because the legislation directly affects all users of communication services by instituting a system where any person can have his or her communications intercepted. Secondly, the Court will take into account the availability of remedies at the national level and will adjust the degree of scrutiny depending on the effectiveness of such remedies…. where the domestic system does not afford an effective remedy to the person who suspects that he or she was subjected to secret surveillance, widespread suspicion and concern among the general public that secret surveillance powers are being abused cannot be said to be unjustified. In such circumstances the menace of surveillance can be claimed in itself to restrict free communication through the postal and telecommunication services, thereby constituting for all users or potential users a direct interference with the right guaranteed by Article 8. There is therefore a greater need for scrutiny by the Court and an exception to the rule, which denies individuals the right to challenge a law in abstracto, is justified. In such cases the individual does not need to demonstrate the existence of any risk that secret surveillance measures were applied to him. By contrast, if the national system provides for effective remedies, a widespread suspicion of abuse is more difficult to justify. In such cases, the individual may claim to be a victim of a violation occasioned by the mere existence of secret measures or of legislation permitting secret measures only if he is able to show that, due to his personal situation, he is potentially at risk of being subjected to such measures.” (emphasis added)
285. It is submitted by the DPC that this test is far more liberal than the test to be found in the United States in cases such as Clapper v. Amnesty International and Wikimedia. Thus, the United States rules on standing in the area of national security are far more stringent than those established by ECHR.
286. The DPC highlighted the fact that the most important cause of action available in the United States to challenge unlawful interference with personal data, claims for a breach of the Fourth Amendment, are not available to EU citizens who do not have substantial voluntary connections with the United States and therefore are not available to the vast majority of EU citizens.
287. She also points to the extremely limited nature of the statutory remedies available to EU citizens and concludes that for all of the above reasons, the essence of the right to an effective remedy before an independent and impartial tribunal is not respected by the laws of the United States in the context of interference with the personal data of EU citizens by intelligence agencies on the grounds of national security.
Submissions of Facebook and the United States
288. Facebook and the government of the United States argued that it was not appropriate to focus solely on the question of individual redress in the United States. They each urged that it was essential to consider the totality of the regime in relation to the authorisation of surveillance, the practice of targeting selectors, the minimisation procedures, the multiple levels of oversight to ensure compliance with procedures, the procedures governing the acquisition of data, the storage of data, access by individuals and agencies to the raw data, retention and dissemination of the data.
289. They submitted that the essence of the Article 47 right was respected as EU citizens had available individual causes of action for substantive remedies before the courts in the United States. They emphasised that the CJEU in Schrems at para. 95 had established that it was only if there was no possibility of a remedy before a national court that the essence of the Article 47 right to an effective remedy was not respected. This is not the case in the United States and therefore the essence of the Article 47 right was respected.
290. In addition, they submitted that the DPC had overstated the difficulties of establishing standing in the United States and that, in essence, if an EU citizen had notice that he or she had been surveilled that he or she would likely have standing to sue for relief under one or more of the statutory remedies on the basis of ACLU and Clapper v. Amnesty International.
291. That being so, Facebook and the United States urged that a proportionality assessment is required before it can be said that any limitation on the exercise of a right or freedom recognised by the Charter is impermissible.
292. Facebook argued that when looking at the processing of data for the purposes of national security one does not look at the rights enshrined in the Directive. The test is not whether there is a high level of protection or an adequate level of protection or sufficient safeguards. The question is whether the interference with the rights of the data subject for national security purposes exceeds that which is strictly necessary and proportionate. Are the measures strictly necessary to achieve the objective of preserving national security?
293. Facebook referred to ECHR jurisprudence which has jurisdiction in the field of national security. It submitted that the case law establishes that when considering remedies in the context of national security, the court will consider the entire regime in the particular jurisdiction. It recognises that the concept of an effective remedy cannot carry the same meaning in the context of secret intrusive measures because the efficacy of such measures depends upon their remaining secret. Therefore, an effective remedy within the meaning of Article 13 of the ECHR must mean a remedy that is as effective as can be having regard to the restricted scope for recourse inherent in any system of secret surveillance (see Klass v. Germany (App. No. 5029/71) [1978] 2 EHRR 214 para. 69.)
294. Facebook noted that in Silver v. The United Kingdom (1983) 5 EHRR 347 at para. 113 the court synthesised the principles on the interpretation of Article 13 of the ECHR to include the following: -
“… (a) where an individual has an arguable claim to be the victim of a violation of the rights set forth in the Convention, he should have a remedy before a national authority in order both to have his claim decided and, if appropriate, to obtain redress,
(b) the authority referred to in Article 13 may not necessarily be a judicial authority but, if it is not, its powers and the guarantees which it affords are relevant in determining whether the remedy before it is effective,
(c ) although no single remedy may itself entirely satisfy the requirements of Article 13, the aggregate of remedies provided for under domestic law may do so.”
295. Facebook submitted that the aggregate of the protections and remedies available in the United States provides an effective remedy as required by Article 47 of the Charter. It referred to the authorisation by the FISC of the annual certifications in respect of each of the intelligence agencies, the ongoing oversight exercised by the FISC in respect of the individual agencies, the multiple levels of oversight both within the agencies, the Department of Justice, the ODNI, the Directors General as well as Congressional oversight. It said that the scope of the individual remedies available in the US to EU citizens must be seen in this context of oversight before, during and after acquisition of personal data. When viewed in this way, it is clear that US law and practice provides greater protections to EU citizens in respect of their personal data than is in fact available to them in practice in individual Member States within the EU. The limitations on the data protection rights of EU citizens in the circumstances satisfy the strictly necessary threshold and genuinely meet objectives of general interest recognised by the Union and are needed to protect the rights and freedoms of others as required by Article 52 (1) of the Charter.
Response of the DPC
296. In response, the DPC argued that US law fails to satisfy the tests established by the ECHR. In Zakharov, the ECHR conducted precisely the type of proportionality test in respect of the law and practices of Russia which Facebook said ought to have been conducted by the DPC in relation to the regime in the United States. In two significant respects, (1) in relation to the obligation to give notice when notice would no longer jeopardise the surveillance actually conducted and (2) the rules in relation to standing, the laws of the United States failed to pass these tests. This is confirmed by Professor Brown where he states at p. 3 of his work that the Convention “… sets a higher general standard than the US government’s interpretation of its international human rights law obligations as applying only within its own territory.” He notes at para. 3.4 that despite the relatively weak standards on foreign intelligence collection by EU member states, the Convention sets relatively high standards in terms of compliance of all surveillance regimes with the rule of law. He identifies a number of minimum standards. The last two of these points are: -
297. The DPC submitted that the legal regime in the United States fails the strictly necessary test laid down in Article 52 (1) of the Charter in relation to interference with personal data on the grounds of national security. She submitted that there was no explanation why it is necessary to have strict rules in relation to standing with no latitude afforded to potential litigants to reflect the inherent difficulties in litigation in this area. She submitted that there was no explanation why notification along the lines similar to those described in Watson and Zakharov applied in the United States or why it was necessary to maintain in all cases for all time a policy of “neither confirm nor deny” that surveillance has taken place. Inherent in the Watson formula is accommodation for the danger posed by the so called “hostile vector attack”.
Conclusion
298. To my mind the arguments of the DPC that the laws -and indeed the practices- of the United States do not respect the essence of the right to an effective remedy before an independent tribunal as guaranteed by Article 47 of the Charter, which applies to the data of all EU data subjects transferred to the United States, are well founded. Furthermore, even if the essence of that right is respected, there are, for the reasons advanced by the DPC, well founded concerns that the limitations on the exercise of that right faced by EU data subjects in the United States are not proportionate and are not strictly necessary within the meaning of Article 52 (1) of the Charter.
299. It is necessary to consider therefore whether the introduction of the Ombudsperson mechanism changes this assessment.
The Ombudsperson Mechanism
300. The Privacy Shield Decision was adopted after the CJEU in Schrems declared that the Safe Harbour Decision was invalid. Analysis by the working group, and the Commission highlighted concerns about the limits on individual redress for EU citizens in relation to data subjected to processing by the United States for purposes of national security. Recital 115 of the Privacy Shield Decision provides: -
“While individuals, including EU data subjects, therefore have a number of avenues of redress when they have been the subject of unlawful (electronic) surveillance for national security purposes, it is equally clear that at least some legal bases that U.S. intelligence authorities may use (e.g. E.O. 12333) are not covered. Moreover, even where judicial redress possibilities in principle do exist for non-U.S. persons, such as for surveillance under FISA, the available causes of action are limited and claims brought by individuals (including U.S. persons) will be declared inadmissible where they cannot show ‘standing’, which restricts access to ordinary courts.”
301. It is thus clear that as of the 12th of July, 2016, when the decision was adopted, the Commission had concerns about the adequacy of the avenues for individual redress in the United States. Recital 116 records that: -
“In order to provide for an additional redress avenue accessible for all EU data subjects, the U.S. government has decided to create a new Ombudsperson Mechanism…”
302. The Ombudsperson will be appointed by the Secretary of State and will be independent from the intelligence community but operate within the Department of State. He or she will be part of the executive branch of government. The Ombudsperson will deal with requests received from EU citizens. Each EU citizen will send their individual requests to the supervisory authorities in his or her Member State. There is no requirement to demonstrate that the requester’s data has in fact been accessed by the US government through its signals intelligence activities and the requester can deal with the matter through his own language. The supervisory authorities ensure that the request is in order and it is not frivolous, vexatious or not bona fide. They then forward the request to the EU individual complaint handling body. The EU body then submits the complaint to the Ombudsperson in the State Department.
303. The Ombudsperson will work closely with the United States government officials including independent oversight bodies to ensure that the requests are processed on the basis of necessary information and resolved in accordance with the applicable laws and policies. The Privacy Shield Ombudsperson will provide in a timely manner an appropriate response to the submitting EU individual complaint handling body, subject to the continuing obligation to protect information under applicable laws and policy. The response will confirm (1) that the complaint has been properly investigated, and (2) that the US laws, statutes, executive orders, presidential directives and agency policies providing the limitations and safeguards described in the annex to the Privacy Shield Decision have been complied with or, in the event of non-compliance, that such non-compliance has been remedied. Critically, the Privacy Shield Ombudsperson will neither confirm nor deny whether the individual has been the target of surveillance nor will the Ombudsperson confirm the specific remedy that was applied.
304. There was some uncertainty as to whether the Ombudsperson mechanism applied in respect of EU citizens whose data is transferred pursuant to the SCCs. The mechanism is described in Annex A to the Privacy Shield Decision. On page 72 of the decision it records the fact that the new mechanism is: -
“to facilitate the processing of requests relating to national security access to data transmitted from the EU to the United States pursuant to the Privacy Shield, standard contractual clauses (SCCs), binding corporate rules (BCRs), Derogations, or Possible Future Derogations”.
Clause 3 (B) requires the EU individual complaint handling body to verify that the request pertains to data reasonably believed to have been transferred from the EU to the United States pursuant to “the Privacy Shield, SCCs, BCRs, derogations, or possible future derogations.” In the circumstances, I am satisfied that it is open to an EU citizen who reasonably believes that his or her data have been transferred from the EU to the United States pursuant to the SCCs to make a request to the Ombudsperson through the mechanism established as part of the Privacy Shield Decision. It is therefore relevant to the assessment of the issues before the court.
Submissions of Facebook
305. Facebook relied upon the Ombudsperson mechanism. It said the Commission was of the view that the mechanism addressed any concerns regarding the adequacy of the individual avenues for redress in the United States. Recitals 122, 123 and 124 the Decision state: -
“(122) Overall, this mechanism ensures that individual complaints will be thoroughly investigated and resolved, and that at least in the field of surveillance this will involve independent oversight bodies with the necessary expertise and investigatory powers and an Ombudsperson that will be able to carry out its functions free from improper, in particular political, influence. Moreover, individuals will be able to bring complaints without having to demonstrate, or just to provide indications, that they have been the object of surveillance. In the light of these features, the Commission is satisfied that there are adequate and effective guarantees against abuse.
(123) On the basis of all the above, the Commission concludes that the United States ensures effective legal protection against interferences by its intelligence authorities with the fundamental rights of the persons whose data are transferred from the Union to the United States under the EU-U.S. Privacy Shield.
(124) In this respect, the Commission takes note of the Court of Justice's judgment in the Schrems case according to which "legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification of erasure of such data, does not respect the essence of the fundamental right to effective judicial protection, as enshrined in Article 47 of the Charter." The Commission's assessment has confirmed that such legal remedies are provided for in the United States, including through the introduction of the Ombudsperson mechanism. The Ombudsperson mechanism provides for independent oversight with investigatory powers. In the framework of the Commission's continuous monitoring of the Privacy Shield, including through the annual joint review which shall also involve the Ombudsperson, the effectiveness of this mechanism will be reassessed.”
306. Facebook argues that the legal regime analysed by the Commission is (essentially) the same as the legal regime which falls to be considered by this court and that the Ombudsperson mechanism applies to the SCCs as well as to data transferred pursuant to the Privacy Shield Decision. Therefore, there is no distinction between the adequacy assessment to be made pursuant to the Privacy Shield Decision and the adequacy assessment which this court is asked to consider. In those circumstances, it argues that the court is bound by the adequacy decision of the Commission. In the alternative, if the court is not bound by it, then it should defer to the greater expertise and research conducted by the Commission in comparison to the analysis and research conducted by the DPC and should prefer the conclusions of the Commission to those of the DPC.
307. As discussed above, the DPC argues that the Privacy Shield Decision is a decision that there is adequate protection afforded to data transferred to the United States pursuant to all of the safeguards set out in the Privacy Shield Decision. In essence, these are threefold: the protections based upon the privacy shield principles (which are essentially private law remedies), the provisions of US law and the Privacy Shield Ombudsperson mechanism. As I have already held, the Privacy Shield Decision is not an adequacy decision binding upon the DPC and the court in the context of this case. However, it is difficult to see how the privacy shield principles (as opposed to the provisions of the laws of the United States and the Ombudsperson mechanism) could be relevant to the issues raised in Mr. Schrems complaint (leaving aside the fact that the data is not transferred pursuant to the privacy shield principles). It is fair to conclude therefore that the decision of the Commission in regard to the adequacy of the protections afforded to EU citizens against interference by the intelligence authorities in the United States with the fundamental rights of EU citizens whose data are transferred from the Union to the United States, conflicts with the case made by the DPC to this court.
Submissions of the DPC
308. The DPC submits that the Ombudsperson mechanism does not remedy the inadequacies in US law which she has identified. She says that the Ombudsperson is not independent of the executive and therefore does not constitute an independent tribunal within the meaning of Article 47. It is not established by law, it is not permanent, it does not give decisions or reasons and it does not grant compensation. It is not subject to judicial review. Each of these elements are requirements of an independent tribunal within the meaning of Article 47. Therefore, it does not alter her conclusion that the laws of the United States do not respect the essence of the right guaranteed by Article 47 of the Charter or, in the alternative, are not proportionate and strictly necessary within the meaning of Article 52 (1) of the Charter.
Discussion
309. Just as the DPC was required by the CJEU in Schrems to make her own independent inquiry into Mr. Schrems’ complaint notwithstanding the provisions of the Safe Harbour Decision, so too this court, in fulfilling its role in the legal order of the Union and, in particular, the role referred to by the CJEU in its ruling in Schrems at paras. 64 and 65, must make its own assessment of the issues notwithstanding the assessment of the Commission enshrined in the Privacy Shield Decision. It is of course clear that there is no requirement that the third country provide identical protections to those provided for by EU law so long as there is an essential equivalence between the protections provided under Union law and under those in the third country. Under Union law the requirement is to “… respect the essence of the fundamental right to effective judicial protection as enshrined in Article 47 of the Charter…” (Schrems para. 95).
310. It seems to me that there is a well-founded argument that the Ombudsperson mechanism does not respect the essence of that fundamental right. It does not afford EU citizens judicial protection. The Ombudsperson is not a judge and she is not on the face of it independent of the executive. The office arguably does not meet the indicia of a tribunal established by the CJEU in Denuit [2005] ECR I-923 at para 12 that the body is established by law, is permanent, whether its jurisdiction is compulsory, whether its procedure is inter partes, whether it applies rules of law and whether it is independent. Critically, her decisions are not subject to judicial review. It is also arguable that the remedy is not an effective remedy as required by Article 47. If the data of an EU citizen have been illegally seized, processed or shared, while the “non compliance” may have been remedied, there is obviously no question of the person so wronged recovering damages or an injunction to prevent future wrongdoing or even a declaration to that effect, as the Ombudsperson will neither confirm nor deny that the requester has been subjected to electronic surveillance.
311. This is not to say that the response of the Ombudsperson is an unreasonable one in the context of the exigencies of national security, nor is that a matter upon which a national court should pronounce. On the contrary, there are good reasons why authorities should neither confirm nor deny whether or not an individual has been subject to surveillance. But these good reasons do not necessarily alter the assessment I have made with respect to the requirements of Article 47 of the Charter or the fact that I share what I consider to be the well founded concerns of the DPC that the Ombudsperson mechanism does not remedy the issues identified with regard to individual redress for wrongful interference with data privacy in the United States.
Article 4 of the SCC Decisions
312. The remaining issue to be considered is whether the existence and provisions of Article 4 of the SCC decisions preserves the validity of the SCC decisions, notwithstanding the laws and practices of the third country to which the data is transferred. As discussed above, Article 4 of the SCC decisions as originally drafted was replaced on the 16th December, 2016. It is the effect and implications of this text which is relevant to this judgment.
313. It was argued by a number of parties that the solution to the concerns raised by the DPC regarding the regime in the United States and in particular as concerns the issues of redress lay in her own hands: she could suspend or prohibit transfers of data by Facebook to Facebook Inc. pursuant to Article 4 of the SCC decisions if she believed that this was necessary in order to protect individuals with regard to the processing of their personal data. Even if, on the facts of this case, it was not appropriate to suspend data transfers to the United States, nonetheless the existence of Article 4 saved the SCC decisions from invalidity.
314. In order to examine this argument, it is necessary to consider the scope of the SCC decisions. Article 1 provides that the standard contractual clauses set out in the annex are considered as offering adequate safeguards with respect to the protection of the privacy and fundamental rights and freedoms of individuals and as regards the exercise of the corresponding rights as required by Article 26 (2) of the Directive. Article 2 sets out the scope of the decision and Article 3 sets out relevant definitions. Article 4 now provides: -
“Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive 95/46/EC leading to the suspension or definitive ban of data flows to third countries in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall, without delay, inform the Commission, which will forward the information to the other Member States.’
Articles 5 to 8 of the decision provide that there is to be a review of the decision after three years, the commencement date, the repeal of earlier decisions, transitional arrangements and the fact that the decision is addressed to the Member States.
315. Article 4 is directed towards ensuring that the Member States notify the Commission and the Commission in turn notifies other Member States of the exercise by a competent authority of their existing powers pursuant to Article 28 (3) to suspend or ban transfers of data to third countries in order to protect individuals with regard to the processing of their data. It does not confer a power on a supervisory authority. In effect, the previous version of Article 4 has been removed from the SCC decisions. If Article 4 had simply been repealed, the supervisory authorities would nonetheless still retain their powers pursuant to Article 28 (3) of the Directive. Article 4 no longer operates as a saver provision in the SCC decisions analogous to the comparable provision in the Safe Harbour Decision (Article 3) which was declared invalid by the CJEU in Schrems. The provisions of Article 4.1 (a) as originally drafted were specifically directed towards the legal regime in force in third countries. This is no longer the case. The supervisory authorities, in this case the DPC, enjoy the powers set out in Article 28 (3) of the Directive, no more and no less, when considering the protection of individuals with regard to the processing of their data.
316. Article 28 (3) sets out the powers to be conferred on supervisory authorities by the Member States in order that they may carry out their functions and obligations under the Directive in the light of the Treaties and the Charter. They are investigative powers, effective powers of intervention and powers to engage in legal proceedings. Examples of effective powers of intervention include imposing a temporary or definitive ban on processing. This is a general power of supervisory authorities applicable to any and all processing operations within the EU. It also applies to processing comprising of transfers to third countries but it is by no means specific or limited to the latter situation. The power is not primarily conferred with a view to suspending data transfers to a third country pursuant to the SCCs where the supervisory authority contends that this is necessary in order to protect individuals with regard to the processing of their data, though undoubtedly the power extends to that situation. Neither is the power expressly related to complaints by individuals or associations, which are governed by Article 28 (4) of the Directive.
317. Given that it is a general power applicable to all processing governed by the Directive, it is useful to see if there are any indicators as to how the power should be exercised in the context of the SCC decisions. Recital 11 of Commission Decision 2010/87/EU provides: -
“Supervisory authorities of the Member States play a key role in this contractual mechanism in ensuring that personal data are adequately protected after the transfer. In exceptional cases where data exporters refuse or are unable to instruct the data importer properly, with an imminent risk of grave harm to the data subjects, the standard contractual clauses should allow the supervisory authorities to audit data importers and sub-processors and, where appropriate, take decisions which are binding on data importers and sub-processors. The supervisory authorities should have the power to prohibit or suspend a data transfer or a set of transfers based on the standard contractual clauses in those exceptional cases where it is established that a transfer on contractual basis is likely to have a substantial adverse effect on the warranties and obligations providing adequate protection for the data subject.” (emphasis added).
318. Recital 11 shows that the power to prohibit or suspend a data transfer or a set of transfers based on standard contractual clauses should apply in exceptional cases. It applies where it is established that a transfer on contractual basis is likely to have a substantial adverse effect on the warranties and obligations of the data exporter, the data importer and any sub-processor which are intended to provide adequate protection for the data subject. There can be any number of bases upon which this could be so and the legal regime of the third country is only one possible example of this exceptional case. The fact that it is described as an exceptional case would indicate that particular rather than systemic circumstances prevailing are envisaged.
319. Secondly, in Com [2013] 846 Final, the Communication from the Commission to the European Parliament and Council concerning the Safe Harbour Decision, the Commission noted at p. 7: -
“The shortcomings of the Safe Harbour scheme have been underlined by the response of European Data Protection Authorities to the recent surveillance revelations. Article 3 of the Safe Harbour Decision authorises these authorities to suspend, under certain conditions, data flows to certified companies. German data protection commissioners have decided not to issue new permissions for data transfers to non-EU countries (for example for the use of certain cloud services). They will also examine whether data transfers on the basis of the Safe Harbour should be suspended. The risk is that such measures, taken at national level, would create differences in coverage, which means that Safe Harbour would cease to be a core mechanism for the transfer of personal data between the EU and the US.” (emphasis added).
320. The Commission’s concern that different data protection authorities were intending to take different decisions in relation to data transfers pursuant to the Safe Harbour Decision applies equally to any decision taken by either a data protection authority or a member state individually to suspend or prohibit transfers of data pursuant to the SCCs to the United States. The reason is clear. The perceived difficulty in permitting continued transfers of data to the United States pursuant to the SCCs decision is general and systemic rather than particular to the individual contractual arrangements concerning Facebook and Facebook Inc. and/or its sub-processers. The scope for what the Commission described as differences in coverage applies equally in this case. It is undesirable that identical data transfers could be permitted under the SCCs in one Member State but suspended or banned in another depending on whether the particular national authorities had investigated the issues surrounding the transfer of data to the United States or not, or had reached different conclusions regarding the likelihood of the data being subjected to a substantial adverse effect on the warranties and obligations provided by the SCCs or whether such a ban or suspension of data flows is required in order to protect individuals with regard to the processing of their personal data.
321. Thirdly, the power of the data protection authorities to suspend or ban the transfer of data to third countries is a discretionary power. Both the Directive and the CJEU in Schrems emphasised that the authorities shall act with complete independence in exercising the functions entrusted to them. If the SCC decisions are valid because the DPC has the power to suspend the transfers of data to the United States where this is necessary to protect the personal data of EU citizens, this can only be on the basis that the DPC is obliged to suspend the transfer of data in circumstances where it is established that a transfer on contractual basis is likely to have a substantial adverse effect on the warranties and obligations providing adequate protection for the data subject. In other words, if the argument is correct, she is obliged to make the order, and this in turn means that she does not have a discretion to refrain from acting.
322. Further, once the precondition to the exercise of the power is established (the likely substantial adverse effect on the warranties and obligation) she must then make an order suspending or banning the transfer of data. She cannot consider, for example, whether it is desirable that a common position across the EU should be established or weigh competing interests in the balance or take account of the wider implications of such an act before taking such an extremely significant step as to prohibit all transfers of data by Facebook to Facebook Inc. Such a construction is inconsistent with her independence in relation to her functions. It also seems to be inconsistent with the judgment of the CJEU in Schrems para. 42 where the court said that the national supervisory authorities must ensure a fair balance between the observance of the fundamental right to privacy on the one hand and the interests requiring the free movement of personal data on the other hand. But if the power is in fact discretionary, with the implication that she may refrain in certain circumstances from exercising it, notwithstanding the perceived inadequacies in the legal regime in the third country to which the data are transferred, then she may validly decide not to make an order suspending or banning the transfer of data to a third country. It therefore follows that the mere fact that the power to suspend data transfers exists does not save the SCC decisions from invalidity based upon the perceived inadequacies of the law of the third country.
323. It seems to me that as the power is and remains discretionary, the validity of the SCC decisions cannot depend on the automatic exercise of a discretionary power. She is entitled to take the view that the suspension of data transfers is not appropriate in any given circumstances, even if the threat to the data privacy of EU data subjects is established. In this case, she has decided that this is so as the problem which she has identified is systemic and general rather than particular and related to the specific contracts in question. She has adopted an alternative means of dealing with the issue by bringing these proceedings and seeking to have her concerns considered by a national court and if necessary referred to the CJEU for a decision on the validity of the SCC decisions insofar as they apply to transfers of data to the United States.
324. It seems to me that not only is this a legitimate conclusion for her to reach but it is one that is clearly hers to make as an independent supervisory authority. It is reasonable to ask whether it is legitimate to use the power granted to a data protection authority pursuant to Article 28(3) of the Directive to resolve major international structural issues of the kind identified in these proceedings.
325. It is also to be borne in mind that she can only make orders pursuant to the provisions of national legislation. Section 11, subs. 7 and 8 of the Data Protection Acts states that the DPC may prohibit the transfer of personal data from the State to a place outside the State but that in determining whether to prohibit a transfer of personal data under s. 11 she must also consider whether the transfer “would be likely to cause damage or distress to any person and [to] have regard to the desirability of facilitating international transfers of data.”
326. It seems to me that there is certainly an issue to be resolved as to whether the fact that the DPC has power pursuant to Article 28(3) of the Directive to suspend or ban the transfer of data by Facebook to Facebook Inc. necessarily saves the SCC decisions from invalidity. There is also an argument to be made as to whether, in the circumstances of this case, the DPC was obliged to exercise that power or whether, in the alternative, she was entitled to proceed as she did and to seek a ruling from the CJEU on the validity of the SCC decisions. For these reasons, I do not accept the submissions that Article 4 is the answer to all of the issues raised by the DPC and that accordingly a reference to the CJEU is neither appropriate nor necessary.
Mr. Schrems’ Objections to a Reference
327. Mr. Schrems’ objections to the reference sought by the DPC in these proceedings are different to those raised by Facebook and some of the amici curiae. Firstly, he says that he did not raise any objection to the validity of the SCC decisions whether in his reformulated complaint or otherwise. He says his primary complaint was that the relevant clauses in the agreement relied upon by Facebook to transfer data to Facebook Inc. did not conform to or comply with the provisions of the SCC decisions and that therefore Facebook could not rely on the decisions and was not entitled to the derogation from Article 25 of the Directive provided for by Article 26.
328. He said the DPC wholly failed to examine, investigate or determine his primary complaint and instead she accepted Facebook’s contention that the agreement was in compliance with the SCC decisions. He submits that in the absence of such a determination by the DPC the proceedings are premature, misconceived, unnecessary and are based entirely on a hypothesis developed and maintained by the DPC that there is a challenge to the validity of the SCC decisions.
329. He also argued that even if it were the case that the SCC decisions applied, Mr. Schrems did not question the validity of the SCC decisions as Article 4 (1) permits the prohibition or suspension of data transfer where the law to which the data importer (Facebook Inc.) is subject does not provide adequate safeguards. On this basis, the SCC decisions provide for circumstances where the third country’s laws are inadequate and thus they do not interfere or conflict with the rights of individuals to privacy and data protection as ensured by and enshrined in Articles 7 and 8 of the Charter.
330. He submitted that on the facts established by the DPC the US does not provide adequate safeguards as required by EU law and therefore data transfers to the US between Facebook and Facebook Inc. ought to be suspended or prohibited, as he sought in his reformulated complaint.
331. He submitted that Article 267 of TFEU requires that a reference only be made when a question is properly raised and the answer to that question is necessary to enable the court to give judgment. He says that para. 65 of the judgment of CJEU in Schrems does not confer a free standing right on the DPC to make a reference to the CJEU. It clarifies that a reference must be necessary by reference to the underlying claim.
332. He also stated that the making of a reference is premature as the DPC has expressly stated that her investigations have not concluded and that her decision is in draft form only and explicitly subject to further submissions. It is only once the investigation is completed that it will be possible to determine whether Facebook in fact transfers data to Facebook Inc. pursuant to SCCs as it asserts and to determine whether there are other bases upon which Facebook transfers data to Facebook Inc. which may or may not be justified whether under the provisions of Articles 25 or 26 of the Directive.
Response of the DPC
333. The DPC submitted that, as an independent authority, it was a matter for her how she conducts her investigations into Mr. Schrems’ reformulated complaint. Facebook has acknowledged that it transfers data in large part pursuant to the SCC decisions and particularly that of 2010. It has exhibited the agreement of November, 2016 between Facebook and Facebook Inc. which governs the transfers. She is the statutory decision maker and the independent authority under the Directive and once a complaint is made to her it is a matter for her to determine the order and the manner in which she proceeds to decide upon the issues raised. She has reached the conclusion that she cannot now progress her investigation further in the absence of the ruling which she seeks in these proceedings. This is a matter within her jurisdiction and one in which the court ought not to interfere by, for example, as submitted by Mr. Schrems, directing that she complete her investigations into whether or not the terms of the agreement of November, 2016, accord with the provisions of the SCC decisions or whether there are other legal bases upon which Facebook relies when transferring data for processing to Facebook Inc.
334. The DPC submitted that she believes Mr. Schrems is incorrect in his belief that Article 4 of the SCC decisions secures the validity of the decisions for the reasons discussed above. As Mr. Schrems’ alternative position is that if he is wrong about Article 4, then he does challenge the validity of the SCC decisions, it follows that it is not correct to say that the issue does not arise from his reformulated complaint. She submits that she did not raise this issue based upon her own hypothesis, as was submitted by Mr. Schrems, but that it arises from point 2 of his reformulated complaint page 11 which states: -
“Even if the current and all previous agreements between “Facebook Ireland Ltd” and “Facebook Inc.” would not suffer from the countless formal insufficiencies above and would be binding for the DPC (which it is not), “Facebook Ireland Ltd” could still not rely on them in the given situation of factual “mass surveillance” and applicable US laws that violate Art. 7, 8 and 47 of the [Charter] (as the CJEU has held) and the Irish Constitution (as the Irish High Court has held).”
335. Finally, even if it were the case that Mr. Schrems did not, in terms, in his reformulated complaint challenge the validity of the SCC decisions, the DPC is entitled to determine what is the key question raised by the reformulated complaint. It is to be noted that in the proceedings as they originally unfolded, neither party challenged the validity of the Safe Harbour Decision, but the High Court (with whom the CJEU agreed) took the view that the proceedings involved a challenge to the validity of the Safe Harbour Decision. Therefore, even if Mr. Schrems did not in fact challenge the validity of the SCC decisions, this does not mean that reference to the CJEU is not necessary for the resolution of the proceedings and Mr. Schrems’ reformulated complaint.
Discussion
336. It is clear from the decisions of the High Court and CJEU in Schrems that it is both legitimate and appropriate for both the DPC and the court to identify the true controversy raised by the complaint and the point which requires to be determined in order properly to conclude the investigation into Mr. Schrems’ complaint. I accept that the central issue for resolution is the validity of the SCC decisions and this can only be resolved by a decision of the CJEU. I believe that there is a strong argument that Article 4 of the SCC decisions does not provide the answer to the concerns raised by the DPC in relation to the remedial regime in the United States. That being so, Mr. Schrems’ reformulated complaint does raise the validity of the SCC decisions and therefore it is legitimate for the DPC to seek a reference to the CJEU to resolve this issue in order that she may complete her investigation in accordance with law.
337. This court lacks jurisdiction to pronounce upon the validity of the SCC decisions. The DPC says that she needs to know whether or not they are valid, given her concerns that they are not valid for the reasons set out in this judgment. There are two options open to the court: it can make the reference sought by the DPC to the CJEU or it can refuse to make the reference and dismiss the proceedings as no other relief is sought. In that event the court in effect will be endorsing the validity of the decisions and require the DPC to conclude her investigation into Mr Schrems’ complaint on the basis that the SCC decisions are valid.
338. I have formed the view that I concur with the DPC that there are well founded grounds for believing that the SCC decisions are invalid and furthermore that it is extremely important that there be uniformity in the application of the Directive throughout the Union on this vitally important issue. This requires that there be consistency and clarity. On that basis, I believe that a reference is necessary and appropriate. It follows that the balance of the arguments raised by Mr Schrems against making a reference must be rejected. For these reasons and the reasons advanced by the DPC I do not accept that I should refuse to make a reference to the CJEU as requested by the DPC.
Conclusion
339. The court has jurisdiction to make a reference to the CJEU for a preliminary ruling on the validity of the SCC decisions under Article 267 of TFEU. The court may do so if it finds that the DPC has raised well founded concerns as to the validity of the decisions of the Commission and the court shares those concerns. Union law and the Charter are engaged. The court is not obliged to reject the application based upon the Privacy Shield Decision. It is certainly arguable that neither the DPC nor the court is required to conduct a comprehensive adequacy analysis of the laws and practices of the United states in relation to electronic surveillance on the grounds of national security, oversight systemic protections and individual remedies in order that they may reach a conclusion that the protection of the data privacy of EU citizens whose data are transferred to the United States for processing does not enjoy the high level of protection which it is guaranteed under Union law. It is arguably legitimate to analyse the remedial regime of a third country to whom the data are transferred for processing in isolation and on the basis of the evidence in relation to individual rights of redress for EU citizens whose data are wrongfully interfered with to conclude that there is a failure to satisfy the essence of the right guaranteed under Article 47 of the Charter as required by Article 52 (1) of the Charter. In the alternative, it is arguable that the limitations on the exercise of the right to an effective remedy before an independent tribunal, as required by Article 47, for EU citizens whose data privacy rights are infringed by the intelligence agencies are not proportionate or necessary or needed to protect the rights and freedoms of others. Neither the introduction of the Privacy Shield Ombudsperson mechanism nor the provisions of Article 4 of the SCC decisions eliminate the well founded concerns raised by the DPC in relation to the adequacy of the protection afforded to EU data subjects whose personal data are wrongfully interfered with by the intelligence services of the United States once their personal data have been transferred for processing to the United States.
340. I therefore propose to refer the issue of the validity of the SCC decisions to the CJEU for a preliminary ruling. As every party to the proceedings indicated that, if I decided to refer issues to the CJEU, they would like the opportunity to be heard as to the questions to be sent to the court, I will list the matter for submissions and then determine the exact questions I shall refer to the court for a preliminary ruling.
