Feb 2017
Nowhere
10000010000112 Posts
|
Quote:
Originally Posted by Nick
|
The name didn't ring any bells. I looked it up. I'd heard of the court case. I looked it up. Not easy reading, but I love the ending. Here are a few highlights. The penultimate sentence (at the end, in bold, stating the ruling) is one of the longer sentences I've read recently.
JUDGMENT OF THE COURT (Grand Chamber) 6 October 2015 In Case C‑362/14
Quote:
(Reference for a preliminary ruling — Personal data — Protection of individuals with regard to the processing of such data — Charter of Fundamental Rights of the European Union — Articles 7, 8 and 47 — Directive 95/46/EC — Articles 25 and 28 — Transfer of personal data to third countries — Decision 2000/520/EC — Transfer of personal data to the United States — Inadequate level of protection — Validity — Complaint by an individual whose data has been transferred from the European Union to the United States — Powers of the national supervisory authorities)
In Case C‑362/14,
REQUEST for a preliminary ruling under Article 267 TFEU from the High Court (Ireland), made by decision of 17 July 2014, received at the Court on 25 July 2014, in the proceedings
Maximillian Schrems
v
Data Protection Commissioner,
joined party:
Digital Rights Ireland Ltd,
THE COURT (Grand Chamber),
composed of V. Skouris, President, K. Lenaerts, Vice-President, A. Tizzano, R. Silva de Lapuerta, T. von Danwitz (Rapporteur), S. Rodin and K. Jürimäe, Presidents of Chambers, A. Rosas, E. Juhász, A. Borg Barthet, J. Malenovský, D. Šváby, M. Berger, F. Biltgen and C. Lycourgos, Judges,
Advocate General: Y. Bot,
Registrar: L. Hewlett, Principal Administrator,
having regard to the written procedure and further to the hearing on 24 March 2015,
after considering the observations submitted on behalf of:
– Mr Schrems, by N. Travers, Senior Counsel, P. O’Shea, Barrister-at-Law, G. Rudden, Solicitor, and H. Hofmann, Rechtsanwalt,
– the Data Protection Commissioner, by P. McDermott, Barrister-at-Law, S. More O’Ferrall and D. Young, Solicitors,
– Digital Rights Ireland Ltd, by F. Crehan, Barrister-at-Law, and S. McGarr and E. McGarr, Solicitors,
– Ireland, by A. Joyce, B. Counihan and E. Creedon, acting as Agents, and D. Fennelly, Barrister-at-Law,
– the Belgian Government, by J.-C. Halleux and C. Pochet, acting as Agents,
– the Czech Government, by M. Smolek and J. Vláčil, acting as Agents,
– the Italian Government, by G. Palmieri, acting as Agent, and P. Gentili, avvocato dello Stato,
– the Austrian Government, by G. Hesse and G. Kunnert, acting as Agents,
– the Polish Government, by M. Kamejsza, M. Pawlicka and B. Majczyna, acting as Agents,
– the Slovenian Government, by A. Grum and V. Klemenc, acting as Agents,
– the United Kingdom Government, by L. Christie and J. Beeko, acting as Agents, and J. Holmes, Barrister,
– the European Parliament, by D. Moore, A. Caiola and M. Pencheva, acting as Agents,
– the European Commission, by B. Schima, B. Martenczuk, B. Smulders and J. Vondung, acting as Agents,
– the European Data Protection Supervisor (EDPS), by C. Docksey, A. Buchta and V. Pérez Asinari, acting as Agents,
after hearing the Opinion of the Advocate General at the sitting on 23 September 2015,
gives the following
Judgment
Decision 2000/520
5 Decision 2000/520 was adopted by the Commission on the basis of Article 25(6) of Directive 95/46.
[...]
7 Articles 1 to 4 of Decision 2000/520 provide:
'Article 1
1. For the purposes of Article 25(2) of Directive 95/46/EC, for all the activities falling within the scope of that Directive, the "Safe Harbour Privacy Principles" (hereinafter "the Principles"), as set out in Annex I to this Decision, implemented in accordance with the guidance provided by the frequently asked questions (hereinafter "the FAQs") issued by the US Department of Commerce on 21 July 2000 as set out in Annex II to this Decision are considered to ensure an adequate level of protection for personal data transferred from the Community to organisations established in the United States, having regard to the following documents issued by the US Department of Commerce:
(a) the safe harbour enforcement overview set out in Annex III;
(b) a memorandum on damages for breaches of privacy and explicit authorisations in US law set out in Annex IV;
...'
[...]
The validity of Decision 2000/520
67 As is apparent from the referring court’s explanations relating to the questions submitted, Mr Schrems contends in the main proceedings that United States law and practice do not ensure an adequate level of protection within the meaning of Article 25 of Directive 95/46. As the Advocate General has observed in points 123 and 124 of his Opinion, Mr Schrems expresses doubts, which the referring court indeed seems essentially to share, concerning the validity of Decision 2000/520. In such circumstances, having regard to what has been held in paragraphs 60 to 63 of the present judgment and in order to give the referring court a full answer, it should be examined whether that decision complies with the requirements stemming from Directive 95/46 read in the light of the Charter.
[...]
103 The implementing power granted by the EU legislature to the Commission in Article 25(6) of Directive 95/46 does not confer upon it competence to restrict the national supervisory authorities’ powers referred to in the previous paragraph of the present judgment.
104 That being so, it must be held that, in adopting Article 3 of Decision 2000/520, the Commission exceeded the power which is conferred upon it in Article 25(6) of Directive 95/46, read in the light of the Charter, and that Article 3 of the decision is therefore invalid.
105 As Articles 1 and 3 of Decision 2000/520 are inseparable from Articles 2 and 4 of that decision and the annexes thereto, their invalidity affects the validity of the decision in its entirety.
106 Having regard to all the foregoing considerations, it is to be concluded that Decision 2000/520 is invalid.
[...]
On those grounds, the Court (Grand Chamber) hereby rules:
1. Article 25(6) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data as amended by Regulation (EC) No 1882/2003 of the European Parliament and of the Council of 29 September 2003, read in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights of the European Union, must be interpreted as meaning that a decision adopted pursuant to that provision, such as Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46 on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce, by which the European Commission finds that a third country ensures an adequate level of protection, does not prevent a supervisory authority of a Member State, within the meaning of Article 28 of that directive as amended, from examining the claim of a person concerning the protection of his rights and freedoms in regard to the processing of personal data relating to him which has been transferred from a Member State to that third country when that person contends that the law and practices in force in the third country do not ensure an adequate level of protection.
2. Decision 2000/520 is invalid.
|
|