The Court of Justice of the European Union will next week give its opinion on “the agreement envisaged between Canada and the European Union on the transfer and processing of Passenger Name Record data” in Avis 1–15. This will be the first occasion since Schremsthat the CJEU has been formally asked to consider transfers of personal data outside the EU. A lot has happened since Schrems, so the court’s opinion in Avis 1–15 is big.
In Schrems, the CJEU found invalid the EU Commission decision that the Safe Harbor agreement between the EU and the U.S. government ensured an adequate standard of data protection for EU personal data transferred to the U.S. This Safe Harbor agreement was then replaced by the Privacy Shield, which is currently undergoing its first annual review. An EU delegation will be visiting Washington in September, and representatives of EU data protection authorities will participate in their meetings.
EU Commission decisions approving adequacy such as Privacy Shield are not the only legal basis upon which personal data can be transferred outside the EU. Appropriate contractual clauses may provide another legal basis upon which data can be transferred outside the EU; the use of these clauses is currently under challenge before the Irish High Court, which may refer questions about their use to the CJEU. And challenges to the process upon which Privacy Shield was deemed adequate are already underway before the CJEU. Hence, transfers of data outside the EU seem certain to face challenges before the CJEU at some point; whether those challenges will be heard before May 2018 remains to be seen. This is when the GDPR will apply. The GDPR grants EU data protection laws a global jurisdiction; it remains to be seen how this new jurisdiction will affect the CJEU’s assessment of agreements like Privacy Shield.
The CJEU opinion in Avis 1–15 may give some indication as to how the CJEU considers future transfers of data outside the EU should work. The CJEU’s thinking on such transfers is continuing to evolve. In Tele2 Sverige,the CJEU held that transfers of what it termed "data of sensitivity," such as traffic and location data of electronic communications users, could not be stored outside the EU.
As the Advocate General of the CJEU pointed out in his opinion, next Wednesday will be “ … the first time that the court will be required to rule on the compatibility of a draft international agreement with the fundamental rights enshrined in the Charter of Fundamental Rights of the European Union ….” In September 2016, the Advocate General’s opinion was that, while the agreement was compatible with the right to data protection in many instances, it was incompatible in some. These were that the agreement may allow Canada to:
- process personal data for purposes other than preventing and detecting terrorist offenses and serious transnational crime;
- process sensitive personal data, beyond what is strictly necessary;
- make disclosures, beyond what is strictly necessary;
- retain data for up to five years without a requirement for any connection with the purpose of preventing and detecting terrorist offenses and serious transnational crime; and
- transfer the personal data onward to a third country, without any restrictions on further transfers.
To what extent will the CJEU agree or disagree with the opinion of its advocate general? That's what remains to be seen. The EU-Canadian agreement is not yet made, so any issues identified by the CJEU may be addressed by further negotiations.
This opinion will come at a time when the EU Commission has communicated its interest in entering into new agreements recognizing adequate data protection standards outside the EU. Earlier this month, the Prime Minister of Japan and the President of the EU Commission issued a joint statement affirming their commitment to work toward an EU Commission adequacy finding by spring 2018.
Finally, there is Brexit, currently set for March 2019, which may lead to the U.K. leaving the EU. Should the CJEU follow its Advocate General and its previous judgment in Tele2 Sverige, indicating that EU sensitive personal data should not be processed outside the EU, such an opinion would have the potential to significantly impact upon the relationship between the U.K. and EU after Brexit.
photo credit: Gwenaël Piaser European Court of Justice via photopin(license)