As 2016 draws to a close judgment is awaited from the Court of Justice of the European Union (CJEU) in four cases that relate to data protection: Tele2 and Watson; Canadian PNR ; Manni, and Tele2 (Netherlands). Each of these cases has been heard by the CJEU and an opinion given by the Advocate General; all that remains is for the CJEU to deliver judgment.
The most anticipated of these judgments may be that in the joined cases of Tele2 and Watson, in which the CJEU is being asked whether EU Member States can enact national data retention laws. The opinion of Advocate General Saugmandsgaard Øe is that that such national data retention laws are permissible under EU law, provided the appropriate safeguards are in place. This opinion seems consistent with the recent judgment of the CJEU in Breyer in whichthe CJEU held that the German government might have a legitimate interest in retaining the personal data of all persons accessing its websites in order to ensure “the continued functioning of those websites.”
Judgment in Tele2 and Watson may follow the opinion of Advocate General Saugmandsgaard Øe. But this will not result in the EU Commission suggesting a replacement for the Data Retention Directive, which the CJEU found invalid. The EU Commission has made clear that it “… is not coming forward with any new initiatives on Data Retention”. However, if the CJEU finds that national data retention laws are permissible under EU law (subject to the appropriate controls) then this might suggest that the data retention regimes of third countries, such as the U.S., may not conflict with EU data protection law either (again, subject to the appropriate controls). Judgement in Tele2 and Watson may therefore have implications for the review of the EU Commission Decision that Privacy Shield provides an adequate level of data protection for EU personal data transferred to the U.S. Another factor that may impact on that review may be changes that the new U.S. government of President-elect Donald Trump may make. This review is highly significant and has been described by the Article 29 Committee of EU Data Protection Authorities as a “ … a key moment for the robustness and efficiency of the Privacy Shield mechanism to be further assessed.” It is to be undertaken next year.
Another judgment that may impact on that review is the Canadian PNR case. The EU Parliament has asked the CJEU whether the agreement between Canada and the EU on the transfer and processing of Passenger Name Record data is compatible with EU data protection law. It was the opinion of Advocate General Mengozzi that it did not. In reaching this opinion, Mengozzi analysed previous decisions of the CJEU in Digital Rights Ireland and Schrems to generate a checklist of provisions that should or should not appear in agreements that enable the transfer of personal data outside the EU. The CJEU may adopt a similar approach in its judgment. If so, then we may have a useful guide as to what agreements such as this or Privacy Shield should contain if they are to be acceptable to the CJEU.
In Manni, the CJEU is being asked whether the so-called right to be forgotten should be applied to public registers from which “ … anyone may, at any time, obtain the data relating to individuals.” In particular the CJEU is being asked whether personal data in a register of companies should be “… available for only a limited period and only to certain recipients, on the basis of an assessment case by case by the data manager.” The opinion of Advocate General Bot has issued, but is not yet available in English translation.
Tele2 (Netherlands) concerns the meaning of consent and whether a telecommunication company’s subscribers had to provide a specific consent before their personal data was provided to a telephone directory service in another Member State in accordance with EU telecoms law. Bot is of the opinion that a specific consent was not required to transfer personal data from one Member State to another. However subscribers have to receive “ … clear, precise information on the different aspects of the processing of their data and, in particular, on the supply of such data for the purpose of its publication … in a Member State other than the subscriber’s Member State of residence." The opinion of Bot seems consistent with previous judgments of the CJEU in Deutsche Telekom and Bara. In both of these cases the CJEU held that transfers of personal data were permissible if required by law, provided that subjects are appropriately informed. Judgment in Tele2 (Netherlands) may therefore have implications for any obligation to transfer personal data imposed by EU law or that of a Member State.
None of these cases are yet listed for judgment in the calendar of the CJEU; at present that calendar lists judgments to be delivered from now until the CJEU begins its Christmas vacation on 19 December next. Of course that calendar may change, but for now it would appear that these judgments will not issue until next year.
Photo credit: Image provided by the Court of Justice of the European Union.