Getting Privacy to a new Safe Harbour. Comment on the CJEU Judgment of 6 October 2015, Schrems v Data Protection Commissioner

• Author: Philipp E. Fischer
• Pages: 229-233

Getting Privacy to a new Safe Harbour

2015

229

3

Getting Privacy to a new Safe Harbour

Comment on the CJEU Judgment of 6 October 2015, Schrems v

Data Protection Commissioner

by Philipp E. Fischer*

© 2015 Philipp Fischer

Everybody may disseminate this ar ticle by electronic m eans and make it available for downloa d under the terms and

conditions of the Digital P eer Publishing Licence (DPPL). A copy of the license text may be obtain ed at http://nbn-resolving.

de/urn:nbn:de:0009-dppl-v3-en8.

Recommended citation: Philipp Fis cher, Getting Privacy to a new Safe Harbo ur. Comment on the CJEU judgment of 6 October

2015, Schrems v Data Protec tion Commissioner, 6 (2015) JIPITEC 229 para 1.

Keywords: privacy; Safe Harbor; CJEU; Max Schrems; Data Protection Directive; surveillance; data transfer

A. Background

1

For a number of years, Facebook user and privacy

law expert Maximilian Schrems1 has insisted on

a better data protection on Facebook. Since 2011,

Schrems led 22 complaints2 against Facebook´s

European headquarters in Dublin based on alleged

infringement of the Irish Data Protection Act and

the underlying European Union (EU) Data Protection

Directive of 19953. Following nearly three years,

Schrems´ initiative “Europe vs. Facebook“4 withdraw

these complaints against Facebook; however, the

“PRISM complaints”5 were still pursued. The latter

consisted of complaints against Apple6, Facebook7,

Skype8, Microsoft9 and Yahoo10. In his lodged

complaint with the Irish supervisory authority (the

Data Protection Commissioner) regarding Facebook,

Mr. Schrems upheld the view that, in light of the

1 https://en.wikipedia.org/wiki/Max_Schrems.

2 http://www.europe-v-facebook.org/EN/Complaints/com-

plaints.html.

3 Directive 95/46/EC of the European Parliament and of the

Council of 24 October 1995 on the protection of individuals

with regard to the processing of personal data and on the

free movement of such data, http://eur-lex.europa.eu/

LexUriServ/LexUriServ.do?uri=CELEX:31995L0046:en:HTML.

4 http://www.europe-v-facebook.org/EN/en.html.

5 http://www.europe-v-facebook.org/EN/Complaints/PRISM/

prism.html.

6 http://www.europe-v-facebook.org/prism/apple.pdf.

7 http://www.europe-v-facebook.org/prism/facebook.pdf.

8 http://www.europe-v-facebook.org/prism/skype.pdf.

9 http://www.europe-v-facebook.org/prism/microsoft.pdf.

10 http://www.europe-v-facebook.org/prism/yahoo.pdf.

revelations made in 2013 by Edward Snowden

concerning the activities of United States´ (US)

intelligence services (in particular the National

Security Agency - NSA), the law and practices of

the US do not offer sufcient protection against

surveillance by the public authorities of the data

transferred to that country. On 24 March 2015, the

Court of Justice of the European Union (CJEU) heard11

this procedure against Facebook, which had been

referred12 by the Irish High Court.

2

Facebook is bound to a legal basis called the “Safe

Harbour” decision13. According to the EU Data

Protection Directive of 1995, personal data may

only be transferred to “third countries” (countries

outside the EU and the EEA), if information is

sufciently protected in the country of destination.

It is under the authority of the European Commission

to decide whether other countries can guarantee

this level of protection. In 2000, the EU Commission

dened the level of protection set out by the Safe

Harbour program - adopted by the US Department

of Commerce - as adequate. US companies can

therefore self-certify that they comply with

European data protection rules. In order to do so

they must prove their commitments regarding data

11 Reference for a preliminary ruling from High Court of Ire-

land (Ireland) made on 25 July 2014 – Maximillian Schrems

v Data Protection Commissioner, Case C-362/14, http://

curia.europa.eu/juris/document/document.jsf?text=&do-

cid=157862&pageIndex=0&doclang=EN&mode=lst&-

dir=&occ=rst&part=1&cid=161179.

12 http://www.europe-v-facebook.org/ref_ecj.pdf.

13 C(2000) 2441, http://eur-lex.europa.eu/LexUriServ/LexUri-

Serv.do?uri=OJ:L:2000:215:0007:0047:EN:PDF.