As a reaction to recent disclosures and revelations about the data collection and surveillance by the US government, the Safe Harbor permitting the transfer of personal information from the EU to the US is under attack, and may be seriously threatened. Threats to the Safe Harbor potentially compromise the ability of companies to move data out of the EU to facilities, vendors, business partners and others in the US. On the 23rd September 2015, Advocate General Yves Bot stated in his non-binding opinion (available at http://curia.europa.eu/jcms/upload/docs/application/pdf/2015-09/cp150106en.pdf) that the decision taken by the Commission Decision 2000/520/EC of 26 July 2000 (‘‘the Decision’’) (available at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32000D0520:EN:HTML) regarding the Safe Harbor scheme may no longer be valid and suggested that the access that US authorities have to personal data ‘constitutes an interference with the right to respect for private life and the right to protection of personal data’.

The EU’s Data Protection Directive 95/46/EC (“the Directive”) confirms that the transfer of data to another country can take place if the country in question ensures an adequate level of data protection. In addition, the EU Commission may also itself determine that a country ensures an adequate level of protection. The Safe Harbor scheme makes it possible for thousands of US companies, including tech-giants such as Facebook, Amazon and Google, to transfer personal data from the EU to their servers in the US.

The Advocate General stated that where there are systematic deficiencies in relation to the level of data protection within the country receiving the transferred data, EU Member States must be able to take measures necessary to safeguard these fundamental rights. In particular, he asserts that the national supervisory authorities play a fundamental role in policing data protection standards such that their independence and powers of intervention under the Directive must remain intact. The Advocate General also showed concern in relation to the inability of EU citizens to be heard on the question of surveillance and interception of their data in the US, which he believes amounts to an interference with the right of EU citizens to an effective remedy under the EU’s Charter of Fundamental Rights. Further, the Advocate General is of the opinion that interference with these rights is contrary to the principle of proportionality since the current Safe Harbor scheme does not contain appropriate guarantees to prevent mass and generalised access to public data.

The Advocate General’s opinion is part of an ongoing case against Facebook brought to the EU Commission by Austrian law student Max Schrems. Mr. Schrems had originally lodged a complaint with the Irish data protection authority taking the view that the law and practices of the US offer no real protection against surveillance by the US of the data transferred to that country. The Irish authority rejected the complaint on the ground that in the Decision the EU Commission considered that, under the Safe Harbor scheme, companies which subscribe to the scheme ensure an adequate level of protection of the personal data transferred to and held by them.

However, the Advocate General takes the view that the existence of an EU Commission decision finding that a third country ensures an adequate level of protection of the personal data transferred cannot eliminate or even reduce the national supervisory authorities’ powers under the Directive on the processing of personal data. Accordingly, the High Court of Ireland sought to determine whether the Decision will prevent a national authority from investigating a complaint alleging that a third country does not ensure an adequate level of protection and, where appropriate, from suspending the contested transfer of data. In this regard, the Advocate General concludes that the national supervisory authorities should have the power to suspend any transfer in circumstances where that authority believes the transfer would undermine the protection of EU citizens in terms of the processing of their data, regardless of the general assessment made by the EU Commission in the Decision. Essentially, the Advocate General provides that powers conferred on the EU Commission and the national supervisory authorities under the Directive are separate, such that the EU Commission is not empowered to restrict the powers of the national supervisory authorities.

In particular, the Advocate General’s Opinion provides that it is apparent from the findings of the High Court of Ireland and of the EU Commission itself that the law and practice of the US allows the large-scale collection of the personal data of citizens of the EU which is transferred, without those citizens benefitting from effective judicial protection.

According to the United States Mission to the European Union’s (the ‘‘USMEU’’) statement dated 28th September 2015, since the Advocate General’s opinion, both sides have been engaged in substantial dialogue to improve the strength of the Safe Harbor scheme but the US Government has reiterated comments made earlier this week that the Advocate General’s opinion rests on ‘numerous inaccurate assertions about intelligence parties in the US’. The US Government insists that it does not and has not engaged in indiscriminate surveillance of anyone, including ordinary European citizens. Moreover, in their view, the Advocate General’s opinion fails to take into account that President Obama has taken unprecedented steps to enhance transparency and public accountability regarding U.S. intelligence practices, and to strengthen policies to ensure that all persons are treated with dignity and respect, regardless of their nationality or place of residence.

The USMEU have made it clear that they have a strong desire to make sure the Safe Harbor scheme is improved and that both sides should continue their strong working relationship given the important privacy and trade benefits that the Safe Harbor scheme provides to EU and US citizens and businesses. The USMEU hopes that the final judgment of the European Court of Justice, which is due to be handed down on 6 October 2015, takes into account the inaccuracies and far-reaching consequences of the Advocate General’s current opinion.

Comment
It is well documented that, while the Advocate General’s opinion is not binding, the European Court of Justice often follows it. Given that the Court’s judgment is expected on 6 October, it seems likely that the Opinion will be followed, at least to a significant extent. However, it will be of great interest to see how far the Court goes in supporting the Advocate General’s fairly strong criticism of the data processing practises in the US and also whether it similarly determines that the Commission’s Decision is invalid.