The representative of the EP Legal Service explained they prepared a legal opinion on three questions. The umbrella agreement seeks to provide a high level of protection of personal data in the law enforcement sector. The first question is on the legal nature of the agreement and the relationship between this agreement and secondary EU legislation. The agreement is an international agreement in the meaning of the TFEU. The agreement will be binding on the Union and the Member States. As for the relationship, the ECJ explained that international agreements can have primacy over EU secondary legalisation. An obvious example is when then data protection package will be adopted. This agreement will cover the same subject matter. There is one important comment to make: international agreements cannot have primacy over primary EU law. In addition, an international agreement would not have primacy over secondary EU law if it is in any way incompatible with the Charter of Fundamental Rights.
The second question is on whether the agreement is a form of an adequacy decision. He said that it is not a classic form of an adequacy decision. It falls outside the scope of EU secondary legislation. He explained that the powers of the ECJ are different regarding international agreements and Commission decisions on secondary legislation. The ECJ has full powers to review and annul and declare invalid Commission positions. For international agreements, the ECJ has more limited powers. There is a procedure set out in the treaties to review the compatibility before it is adopted but that limits the powers of the ECJ.
The third question concerns the legal status of persons who are not EU citizens and whether they are entitled to protection. Under EU law, everyone’s personal data is protected. The situation under this agreement is different; there is specific rule on judicial redress which states that the rights would be granted to EU citizens in the USA. Is that satisfactory under EU law? There is a gap between EU law and the situation under the international agreement. Given the recent case-law, it is clear that it is an essential requirement that everybody must have rights of judicial address. The proposed agreement would not be compatible with the Charter.
Francisco J. Fonseca Morillo, Deputy Director-General in DG JUST, explained that the Congress adopted the judicial act; which means a major success for the EU. The agreement is generally a data protection agreement. The agreement establishes a framework that will apply to every transfer in the law enforcement sector made on the basis of future or existing agreements or national law. In addition, the agreement will improve the situation of all EU data subjects except for judicial address avenues, regardless of the nationality or place of residence of the data subject. He explained that article 3 of the agreement makes clear that protections and rights will apply to all personal information transfers between the EU and USA criminal law enforcement authorities as well as the transfer between private authorities such as PNR or TFTP, regardless of nationality and place of residence. He said that this is reflected in reference to the individual throughout the agreement, including key articles regarding the rights of access.
Furthermore, article 6 makes it clear in purpose that this will continue to apply if there is sharing with other USA public authorities. He explained that the Umbrella agreement is an improvement compared to the present situation. As for future agreements, the agreement will be a safety net. The negotiations will not have to start from scratch. Concerning the specific question of judicial redress, he stressed that the adoption of the act by Congress is an important success. The act removes a major issue of unequal treatment with the EU’s most important international partner. USA citizens already enjoy these rights in the EU, but EU citizens are denied the same treatment in the USA. It was essential for the agreement to put rights for EU citizens on an equal footing with rights for USA citizens and provide effective and enforceable rights without any discrimination. The judicial redress act will allow EU citizens to benefit from redress: refusal to grant access to personal data, change data and disclosure to data. The effectiveness will be the core issue. The judicial redress act extends avenues to EU citizens. Nevertheless, this is not the only route of judicial redress.
He referred to the third paragraph of article 19; it is without prejudice to any other judicial review. He referred to computer fraud abuse acts, the electronic communication act and the freedom of information act. The redress avenues will be addressed specifically in a note attached to the agreement. No EU citizens will be deprived judicial redress; they will enjoy some avenues in line with what the ECJ prescribes in the Schrems judgment. One has to keep in mind that EU citizens are not the only ones who can benefit from the redress act. Other countries can also benefit from the act. The act is an improvement compared to the current status quo. All existing information sharing agreements concluded by Member States will be unfortunately illegal because they do not provide for redress avenues even not for EU citizens. The agreement does not grant adequacy to the USA, he said. He said it was never the intention of the Commission to make an adequacy finding. It does not contain an adequate clause such as in the PNR and TFTP agreements. Article 5.3 does not provide a blanket authorisation but a presumption of compliance. Paragraph 2 of article 5 clarifies that. The presumption operates on a case by case basis. It is an instrument to complement our legal basis for transfer. It is very different from an adequacy decision, he concluded.
Giovanni Buttarelli, European Data Protection Supervisor, referred to his preliminary opinion. He also explained that neither the EDPS nor any other national DPA were part of the negotiations of the agreement. His intervention is to exercise his role as independent advisor. He stated that he is sure no one underestimates the delicate and complicated task for the Commission regarding these negotiations. Please click here to read his entire speech.
Jan Philipp Albrecht (Greens/EFA, DE) said that a consistent framework is needed for safeguards on both sides of the Atlantic and to allow EU fundamental rights to be applied. The agreement negotiated and the result on the table serves this fundament. There are some unclarified which need to be clarified or fixed before we can adopt the agreement, he said. The scope of the redress being limited to EU citizens, the effect this agreement might give as to granting adequacy to the USA when transfers to law authorities are happening, for instance. There are additional safeguards that are not part of many agreements between the USA and EU. This throws a shadow on the existing agreements when talking about essential safeguards. One of the agreements is still in front of the Court and that is the PNR-Canada agreement, he said. If this agreement gives only additional rights and does not create any effect of legitimising or legalising transfers or creating a legal basis for transfers, then the situation might be a bit different than if the agreement does create this. He argued that the question of personal scope is different. If this agreement is only a winning situation, then there cannot be a loss on the side of those not covered. The problem is enshrined in article 3. We need to further elaborate on that. We need the clarification, if not, then we have no other chance then to ask the Court again if it is legally sound, he concluded.
Axel Voss (EPP, DE) stated that the Parliament’s opinion leaves him at a loss. We have been negotiating this for three years, now the USA is altering its legal system and we come up with an agreement that if this does not correspond one per one to what we want, we cannot go ahead with it, this is catastrophic, he said. It would mean that it is no longer possible to have any kind of data exchange agreement with any country if it is not 100 percent in line with our ideas. He finds this worrisome. The Charter is being used as a defence mechanism: the only way to get an agreement is when you apply the Charter one for one. He explained that as a German citizen, he cannot invoke German law vis-à-vis Americans. We are giving EU law a worldwide status, a global force, he said. When it comes to judicial redress, it is clear that everyone should have access to that. He cannot see how to arrive at a solution. Maybe the only plausible outcome is that it is not possible to have an agreement. He said that if one does not want make any progress, then one should hand this over to the ECJ straight away. He said he supports what the Commission has presented. There is an international structure, there needs to be the possibility to do something with third countries, otherwise one will end up in a situation where one cannot privilege one’s own citizens.
(...)
If you are interested in reading the full briefing, please sign up for a free trial of Dods EU Monitoring