3.2 Data protection – Page 13 – European Area of Freedom Security & Justice

Body Scanners: an effective tool to address perceived rather than real increased security?

Several countries around the world have already installed body scanners in airports, including the Schiphol International Airport in Amsterdam.

Several politicians coming from both sides of the Atlantic visited the airport, in order to assess the extent to which such a measure is proportionate and effectively increases security in the airports.

The technology employed in Schiphol has been welcomed by several legislators. For example, the three United States Senators Collins, Kyl and Chambliss praised the advantages of the Schiphol technology in addressing health and privacy concerns (see previous post) in a letter to Secretary Napolitano of the Department of Homeland Security, urging to reconsider such technology also for U.S. airports.

Health concerns

The body scanners technology employed in Amsterdam Airport is based on millimeter waves using extremely high frequency radio waves to produce images with no-ionizing radiation. This frequency range is just below the (related) sub-millimeter “Terahertz radiation” (or “T-ray”) range.

While the digital journal reports that Health Canada says the scanners are safe, the UK Health and Safety Executive states that relatively little appears to be known about the possible health & safety implications of exposure to Terahertz radiation, as a EU project in this area confirms.

Thus, the question related to the effect that body scanners have on human bodies remains opened and needs to be investigated further.

Privacy

Concerning the privacy aspect, the body scanners can “see” through passengers’ clothes, revealing sensitive information (implants, piercings…).

Nonetheless, the letter of the three senators explains that such a loopholes can be reduced by computer-based auto-detection:

“Computer-based auto-detection technology identifies potentially threatening objects on a person and highlights with boxes on a featureless human body outline those areas of the individual that may require further inspection. If the computer scan finds no problems, then the passenger and screener at the imaging machine are notified almost immediately that the passenger may proceed (…). The automated review of images by a computer, rather than by a screener examining the image in a separate room, address privacy concerns.”

Although this option does represent an improvement compared to the systems currently used in several airports, it does not solve the privacy issues.

Especially if added to the fact that no certainty exists over the fact that images are immediately deleted, despite the fact that manufacturers insist that images cannot be stored or transferred. In fact, the machines have the ability to store images on hard disk storage, and that they possess the ability to send the images.

On top of this, the capacity of these machines for detecting devices/weapons concealed inside a body is still very limited, questioning the effectiveness of such a measure to prevent terrorist attacks. One can even argue that if an individual willing to attack an airport reach the airport, it is already too late.

Hence, once again the balance between effectiveness and invasion of fundamental rights, remains to be verified and therefore the use of body scanners in airports seems more a measure to address perceived rather than real greater security.

LIBE Committee resume the works on the future SWIFT long term agreement

The LIBE Committee discussed on 7 April 2010 the re-launch of negotiations on a SWIFT long term agreement.

It has to be recalled that following the European Parliament refusal to provide its consent on the US-EU SWIFT Interim Agreement last February a new draft-negotiating mandate has been indeed submitted by the College of Commissioners on 24 March 2010 to the Council, which in turn is expected to approve it on 22/23 April. According to the Commission the new agreement might be concluded at the beginning of June of this year.

Will the new agreement be founded on Judicial cooperation in penal matters or ….?

According to the Commission statement and the legal basis chosen for the new mandate (art. 82 of the TFUE) the future agreement will comply with the EP request expressed already in September 2009 to build the EU US cooperation in this domain in a framework which could be consistent with the new EU Treaty the art. 8 of the European Charter of Fundamental rights and the request of some Constitutional Courts such as the German Court. To do so the draft mandate has foreseen the creation of an European “Authority of judicial nature” which could check the necessity and proportionality of the US request of SWIFT data .

Therefore during the debate Rapporteur Ms Jeanine Hennis Plasschaert (ALDE) enquired the European Commission on whether it would be possible to explore alternative legal frameworks from judicial cooperation in penal matters .

Mr Faull underlined that the Commission could not see any feasible short term alternative system to the mutual legal assistance framework, however this will not prevent the Commission to explore also other possibilities, following the requests from the Spanish Presidency and by taking in account the question posed by the Rapporteur. On the same logic to find alternative solution to judicial cooperation Ms Carmen Romero López (S&D) suggested to work within the framework of an anti-money laundering directive revised to include banking messaging companies.

Therefore according to Jan Philipp Albrecht (Greens/EFA) these “alternative” approaches would go against the European Charter on Fundamental Rights, the European Convention on Human Rights as well as the German Court (see recent judgment on data retention) with the risk, as pointed out “that Germany will feel impelled to reject this mandate on constitutional grounds”. To avoid possible “clashes” with European or national constitutional courts Mr Albrecht has then suggested then to request for the opinion of the EU Court of Justice on the compatibility of the draft agreement with the EU legislation, as foreseen by Article 218 §11 of the Treaty on the Functioning of the European Union.

The new draft negotiating mandate

The new draft negotiating mandate as agreed upon by the College of Commissioners on 24 March 2010 and upon approval of the Council foresees -among others- the following elements:

Safeguards to ensure the respect of the fundamental right to the protection of personal data;
Transfer to third countries of only information derived from terrorism investigations (“lead information”);
A judicial public authority in the EU with the responsibility to receive requests from the United States Department of the Treasury, verify if the substantiated request meets the requirements of the Agreement and if appropriate require the provider to transfer the data on the basis of a “push” system;
Retention of personal data extracted from the TFTP database for no longer than necessary for the specific investigation or prosecution and non-extracted data retained for five years;
Onward transfer of information obtained through the TFTP under the Agreement shall be limited to law enforcement, public security, or counter terrorism authorities of US government agencies or of EU Member States and third countries or Europol or Eurojust as well as Interpol.
The Agreement shall provide for:

1) the right of individuals to information relating to the processing of personal data;

2) the right to access his/her personal data;

3) to the rectification, and

4) as appropriate erasure thereof.

Hence, it appears that the College of Commissioners has tried to address some of the past concerns addressed by the MEPs.

However, while demonstrating the willingness to explore grounds for a new agreement on the SWIFT data-sharing, some of the Members of the LIBE Committee, expressed a variety of concerns, most of which were already raised in the previous report of the European Parliament and that can be summarised as follows:

Proportionality

Members of Parliament still have concerns that the transfer of bulk data will not be addressed properly. According to Ms Sophie In’t Veld (ALDE) filtering should be done in the EU for financial data, PNR and telecommunications. Also Ms Birgit Sippel (S&D) stressed that SWIFT should be able to individualise data ahead of a transfer.

In this regard it remains to be seen whether SWIFT has the technical ability but not the willingness to bare the costs derived from selecting and transferring individual data instead of ‘data in bulk’.

According to Mr Faull it will not be possible to reduce the quantity of data transferred however he will work to reduce their size by removing the presumably non-useful data.

Data storage period

MEPs expressed concerned over the five years data storage as foreseen by the new text despite the attempts of Mr Faull to reassure the Committee stating that five years was not “unreasonable” given data’s useful lifespan in counter-terrorism.

Access, rectification, compensation and redress outside the EU

Mr Stavros Lambrinidis (S&D) enquired whether there was no other way for the bulk transfer of data and if it was not possible to impose some prior European check when the US wants to transfer the data to third countries.

Furthermore MEPs expressed the need to ensure the right to appeal to European citizens in front of American authorities in case of personal data abuse/misuse.

In this respect Mr Busutill asked to ensure equal rights between US and EU citizens and Mr Faull replied that the Privacy Act is indeed discriminatory and therefore does not guarantee the same rights to EU and US citizens. However the Privacy Act does not apply to the TFTP , hence asking to apply the same right of US citizens to the European ones means not having any rights at all.

No evidence on the effectiveness

There still is no evidence that cases of terrorism have been prevented or prosecuted based exclusively on the financial data.

Procedural concerns

The fact that the EU is planning to conclude an executive agreement on exchanges of data before negotiating the general agreements on rules governing the data protection raise additional concerns. Indeed, the acceleration of the envisaged SWIFT II agreement will limit the margin of maneuver for negotiators on the overarching transatlantic agreement on data sharing and data protection. In other words, it will force the latter to simply accept praxis established before the development of the general principles governing data protection.

Also the Commission -using the words of the Director General of DG JLS Mr Jonathan Faull- is of the opinion that “in an ideal world” general norms should be established before specific ones. However, no sufficient reasons have been provided to explain why the European Union is accelerating the negotiations on the SWIFT agreement instead of giving precedence to the establishment of overarching general framework on EU-US data protection and exchange.

In conclusion, the European Union is engaging in a delicate exercise trying to define at the same time internal, external, specific and general data protection norms. This would have been possible -in theory- if the European Union had clear objectives and points of reference. However, following the LIBE Committee debate on 7 April this seems far from being the case.

L.B.

Freedom on the Internet at risk

The freedom on the Internet is increasingly at risk, as the following three recent examples demonstrate: the on-going secret negotiations on the ACTA agreement, the conviction of three Google executives by an Italian prosecutor and the new approach of Google to China.

Hence, following the digital platform debate hosted by the European Parliament on 24 March 2010 and far from entering into the merit of the specific cases, they will be used as a useful starting point to make some reflections concerning the principle of freedom on the internet as a fundamental aspect to fulfil the more general right to freedom of expression. Firstly, the principle of liability will be investigated, then the ‘commercial purpose’ criterion followed by an overview of some of the sanctions under scrutiny to limit Internet access will be illustrated.

The liability principle

The principle of liability is fundamental to understand what is stake when dealing with measures limiting the freedom on the Internet, hence it is necessary to understand what it means.

Such a principle may have a strict application (strict liability system) or a lighter application (with-fault liability system) and can be applied to individuals and companies having a direct relation with the content of material (being copyrighted, harmful, private or defamatory) as well as to intermediaries, such as Internet Service Providers (ISP). This analysis will mainly focus on the latter, although it will also refer to the former when exploring the ‘commercial purpose’ criterion.

A strict liability system foresees the possibility to held responsible an ISP regardless of its knowledge and control over the material that is disseminated through its facilities. This system may be indirectly established by imposing, an obligation to monitor all the material that is posted on the Internet by private actors.

On the contrary, a with-fault liability system foresees that an ISP is held responsible only if it intentionally violates the rights of others, either by knowing that there is some material on the Internet that violates someone’s rights or if it has certain hints on the existence of certain material infringing someone’s rights.

At the European level, the relevant provision is Directive 2000/31/EC of the European Parliament and of the Council of 8 June 2000 on certain legal aspects of information society services, in particular electronic commerce, in the Internal Market (‘Directive on electronic commerce’), which in articles 12 -15 does not establish a general liability regime applicable to ISPs. Instead, it provides for a system of specific liability exemptions.

This means that in cases where the ISPs provide a specific service (mere conduit, caching, and hosting) and comply with a series of requirements, they will not be held liable for the services performed. The limitations apply only to liability for damages because the last paragraphs of Articles 12, 13, and 14 of the Directive establish that Member States retain the right to require the ISPs to terminate or prevent known infringements.

Following the conviction of three Google executives by an Italian prosecutor, questions were raised on whether IPSs can be considered liable over the content distributed by users even when they are not aware of the existence of such material.

In this regard, Mark Rotenberg rightly pointed out that a distinction should be made between responsibility over the content and ways to make profit out of displayed material.

Hence, although ISPs are not responsible over the content as such they may be considered responsible if they use it to make profit out of it.

The commercial scale criterion

This point was also discussed during the above-mentioned digital platform, namely in relation to whether and under which circumstances a physical person or legal entity (hence not limiting the analysis to ISPs) can be considered liable of infringing owners’ rights.

According to the European Data Protection Supervisor ‘s opinion on the ACTA negotiations “(…) the ‘commercial scale’ embodied in the IPRE Directive is a very appropriate element to set the limits of the monitoring in order to respect the principle of proportionality”. Hence, according to the EDPS, sanctions can be imposed if the alleged infringements have a commercial scale.

However, this criterion may lead to any kind of interpretation and this vagueness is not justifiable, especially when individuals may face not only civil but also criminal prosecutions and convictions.

Therefore, in case of the unfortunate approval of such an agreement, the criterion of “commercial intent”, seems more appropriate to limit the scope of the sanctions, as pointed out by Mr Zimmermann during the Digital Platform meeting on 24 March 2010.

What is more, it has not been demonstrated yet that file sharing damages the commercial interest of rights owners. As the Draft report on enhancing the enforcement of intellectual property rights in the internal market (Gallo report) points out, these assumptions based on “data concerning the scale of IPR infringements are inconsistent, incomplete, insufficient and dispersed”.

Sanctions

Despite these loopholes, Member states have (France) or are very close to (United Kingdom) put into place measures to suspend or block Internet to users infringing owners rights.

Also the ACTA agreement contains such an option despite the fact the European Commissioner Mr De Gucht stated that ” The ‘three-strike rule’ or graduated response systems are not compulsory in Europe. Different EU countries have different approaches, and we want to keep this flexibility, while fully respecting fundamental rights, freedoms and civil liberties. The EU does not support and will not accept that ACTA creates an obligation to disconnect people from the internet because of illegal downloads.”

Denying access to the Internet represents indeed a violation of fundamental rights, freedoms and liberties. As the Gallo report and the European Data Protection Supervisor correctly remind, these measures already exist and are provided for by Directive 2004/48/EC on the enforcement of intellectual property rights on the internal market and since from the point of view of the protection of rights their inefficacy has not been assessed they should be considered as alternative options.

In conclusion, using the words of decision n. 2009/580 (EN) of the French Constitutional Council:

“The free communication of ideas and opinions is one of the most precious rights of man. Every citizen may thus speak, write and publish freely, except when such freedom is misused in cases determined by Law”. In the current state of the means of communication and given the generalized development of public online communication services and the importance of the latter for the participation in democracy and the expression of ideas and opinions, this right implies freedom to access such services.”

The next round of the ACTA negotiations will take place in New Zealand on 12-16 April 2010 and their discussions on Internet, civil, customs and penal measures will be followed as closely as possible, while waiting for a real open debate with stakeholders.

L.B.

Brandeis in Italy: The Privacy Issues in the Google Video Case

Reports of the recent decision by an Italian court to issue suspended sentences against three Google exes for posting a video of a young person with downs syndrome being taunted has sparked a flurry of First Amendment concern. The opinion of reporters, at least in the U.S., has been nearly unanimous — “What were they thinking??” “This will kill the Internet.” “The Italians just don’t get it.”

There is no published opinion yet, so this is very much a first impression based on a quick review of the law in the case, but I was struck by the similarity of the Italian decision with the birth of the right of privacy in the United States.

Continue reading “Brandeis in Italy: The Privacy Issues in the Google Video Case”

On the BVG ruling on Data Retention: “So lange” – here it goes again…

As mentioned a couple of weeks ago in the blog (10 January 2010 – Directive on data retention: now the floor goes to the German Constitutional Court) the German Constitutional Court was preparing to make a decision about the German internal application of the controversial Data Retention Directive (2006/24/EC), demanding telecommunication data retention from 6 months till 2 years. Some historical background is provided in the above mentioned blog. On March 2 the decision has arrived (1 BvR 256/08 , 1 BvR 263/08 , 1 BvR 586/08). And what a decision it is. It is of the same work as the famous decision in Marbury v. Madison presided over by John Marshall. The German Federal Constitutional Court (Bundesverfassungsgericht) avoided a direct conflict with the ECJ but showed once again that it will take its prerogatives very seriously regarding the protection of human rights and annulled the German provisions applying the Directive.

Continue reading “On the BVG ruling on Data Retention: “So lange” – here it goes again…”

Anti-Counterfeiting Trade Agreement (ACTA): towards a legalised regime of privacy invasion?

The European Union, represented by the European Commission, is negotiating – since 2007- a Multilateral Agreement on Anti-Counterfeiting Trade (ACTA) with nine other countries, including the United States of America, Australia, Canada, Japan, Korea, Mexico, Morocco, New Zealand, Singapore, and Switzerland.

The purpose of such an agreement is to strengthen the enforcement of Intellectual Property Rights (IPR) and to combat large-scale counterfeiting and piracy by defining a legal framework for the enforcement of IPR in particular in the digital environment via:

increased international cooperation and
deployment of IPR enforcement practices.

Due to the potential impact that such an agreement may have on individuals’ privacy, the implications related to each of the above-mentioned elements should be carefully evaluated in view of the respect of fundamental rights.

Continue reading “Anti-Counterfeiting Trade Agreement (ACTA): towards a legalised regime of privacy invasion?”

Full body-scanners: risks of violation of Article 8 of the European Convention on Human Rights

The recent attempted bombing to the Detroit flight on 25 December 2009 confirmed the weakness in aviation security to detect non-metallic items. As a consequence a reignited interest towards the introduction of full-body scanners in airports is taking place worldwide.

Full-body scanners create an image of the full body which shows the surface of the skin and reveals objects that are on the body, not in the body. Personal identification is not possible and the image is not retained. The two main technologies used are: backscatter (relying on low intensity x-ray) and millimetre wave (using non-ionizing radio frequency energy). These technologies are capable of detecting body-worn threat items and have the potential to reveal and retain sensitive information about the individual, including health conditions.

Therefore, in order to understand whether such measure should be permitted, the following three cumulative conditions must be met:

• Legitimacy: a legal basis for the restriction should exists. The objective of the full-body scanner must be legitimate and be coherent with the values and principles of the European Union as well as the need to protect the rights and freedoms of individuals;

• Respect the principle of Rule of Law: the conditions under which the restriction to the above-mentioned rights is imposed must be provided for by law and accessible to the individual affected by the restriction and sufficiently precise to enable the person to understand its scope and foresee the consequences of his actions so as not to break the law and protect him from arbitrariness;

• Proportionality: the use of the full-body scanner must be proportionate to the end pursued so that they can be considered necessary.

Legitimacy

At the European level, the legal basis for the implementation of full-body scanner can be found in Regulation (EC) 300/2008 of the European Parliament and of the Council.

This Regulation aims to protect persons and goods within the European Union by preventing acts of unlawful interference with civil aircraft, including screening of persons before they enter security restricted areas at airports and board and aircrafts. Hence, the use of body scanners is included within the scope of the Regulation.

However, not only full-body scanners do not screen body caveats, but experts also say that plastic, chemicals and liquids can go undetected even in a full-body screening, greatly reducing their effectiveness. Hence, despite the existence of a legal basis for permitting such searches, the fact that full-body scanners are not able to detect unlawful material puts under question their legitimacy and proportionality thereof.

Furthermore, the legal basis for screening passengers has been put under question by the European Parliament. In its non-legislative Resolution on the impact of the use of body scanners in the field of aviation security on human rights, privacy, personal dignity, health and data protection it stated:

“This draft measure could exceed the implementing powers provided for in the basic instrument, as the measures in question cannot be considered mere technical measures relating to aviation security, but have a serious impact on the fundamental rights of citizens”.

This is because the Commission proposed a draft regulation supplementing the common basic standards on civil aviation security to include “body scanners” implying that within the existing common basic standards, body scanners were not included.

Proportionality

The European data protection authorities have emphasised the great impact on passengers’ privacy that full-body scanners have and, therefore, they have underlined the necessity to strike the right balance between the body scanners’ necessity and the intrusiveness derived from their introduction.

To reduce the invasively nature of the full-body scanners, the Privacy Impact Assessment of the Homeland Security suggests that passengers may choose alternative screening to the full-body scanner.

However, as the Data Protection Working Group stated, “making them voluntary undermines the(se) reasons for needing them”. As the European Data Protection Supervisor correctly pointed out, this will depend on how, where, when, and with which rigorous procedures they are installed and used and also on which guarantees for the interested persons are put in place.

Although this measure may reduce the invasive nature of the body scanners, the absence of safeguards, such as the monitoring of who is being scanned and how, means that the authorities are unable to check if anyone is being unfairly selected on the basis of their race, religion, gender, age, sexual orientation or disability, as the leading human rights lawyers of Matrix Chambers stated (Matrix Chambers is multi-disciplinary barristers’ chambers which has been called upon by the Non Departmental Public Body Commission on Equality and Human Rights of the United Kingdom to assess the human rights and equalities implications of the United Kingdom’s introduction of full-body scanners at Heathrow and Manchester Airports).

Furthermore, this intrusiveness should be considered together with the health impact that the backscatter X-ray machines have, by exposing individuals to ionizing radiation similar to those used by common medical X-rays. According to Dr. James Thrall of the American College of Radiology and chief of radiology at Massachusetts General Hospital in Boston, the radiation levels are well below the threshold that could be considered a risk to an individual’s health. However, additional studies should be carried on to verify the validity of such position.

Another important issue to be taken into consideration concerns the costs of the full-body scanners vis à vis their efficacy. The fact that the cost of ordering them amounts at approximately €115,000 each, summed up to all the changes that would have to be made to airports, require a precise cost assessment which should be delivered before validating the introduction of such a measure.

Respect the principle of the Rule of Law

Assuming that the first two conditions can be met, despite the aforementioned limitations, there still remains a third non-negotiable aspect that legislators should carefully validate when considering the introduction of full-body scanners: the respect of the rule of law.

According to this principle, decisions should be made by applying known principles or laws, without the intervention of discretion in their application and providing safeguards against arbitrary interventions. Such safeguards are laid down in a variety of legal instruments, including Article 8 of the ECHR, Articles 7 and 8 of the Charter of Fundamental Rights of the European Union as detailed in Directive 95/46/EC.

All these instruments establish data protection as a fundamental principle, which with the entry into force of the Lisbon Treaty, has become a fundamental right on its own.

In addition to these instruments, under the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, the parties are required to apply the principles it lays down in order to ensure respect in their territory for the fundamental human rights of all individuals with regard to processing of personal data.

Therefore, the question that needs to be answered concerns whether the use of full-body scanners complies with these provisions.

According to Matrix Chambers, the introduction of full-body scanners “is on balance likely to infringe Article 8 of the European Convention on Human Rights and Fundamental Freedoms.” It recalls, that in S and Marper v United Kingdom the European Court of Human Rights found that the mere storing of data relating to the private life of an individual amounts to an interference within the meaning of Article 8 and that the concept of “private life” as established in Article 8 ECHR covers the physical and psychological integrity of a person, including the person’s right to their image (Sciacca v. Italy).

Therefore the use of such scanners generates an invasion of privacy which in Matrix Chambers’ view cannot “be “in accordance with the law” as required under article 8(2) and in relation to which no effective waiver is currently routinely secured”.

In order to minimise the level of intrusion, the Privacy Impact Assessment on the whole body imaging conducted by the Homeland Security, foresees that the screener will be used at remote distance of the person being examined.

However, rating the level of intrusion of body scanners depends, on the one hand on cultural and personal context and, on the other hand on the technical features of the scanner.

Scanners providing a detailed picture of the human body are highly intrusive, whereas scanners that present a standardised body image (mimic board) with identification areas to be searched further are less intrusive.

Furthermore, although it is true that passengers forgo their right to privacy to the extent necessary in the interest of security at the moment they purchase their ticket, not all such waivers are automatically effective.

Clear and comprehensive information about full-body scanners should be provided before the ticket is purchased and alternative body search should be foreseen if a passenger refuses to be screened. However, as it has been explained earlier, this undermines the reason for having them in first place.

Despite the risk to breach privacy and anti-discrimination laws, the US strongly support the boosting of airport security with full-body scanners and this request has the backing of the EU’s anti-terror coordinator Gilles de Kerchove. On the contrary, Member States of the European Union still have doubts in this regard. While during the informal meeting of the EU interior ministers with the U.S. Homeland Security chief on Thursday 21 January 2010 in Toledo, Spain and Germany expressed reservations about scanners, their counterparts with responsibility for transports who met in La Coruña on Friday 12 February are less opposed to the introduction of full-body scanners.

The European Commission is expected to publish a report examining all the above mentioned issues by April, on the basis of which the Transport Council will then adopt a common position.

The legitimate reasons behind the introduction of these measures may be considered proportionate if there is a balance between the level of intrusion and the added value in terms of security for passengers. The use of body scanners as such is not against EU privacy laws. However, the feasibility of the introduction of full-body scanners is one thing, another is their desirability.

American authorities access to banks data: challenges…and perspectives

The EU parliamentary Committee on Civil Liberties provoked a certain sensation by deciding on the 4 February to suggest to the European Parliament plenary not to conclude the interim agreement which allows the Treasury Department of The United States of America to access financial data processed by SWIFT (already published in this blog).

What the press has not explained is that this negative vote does not end the transatlantic cooperation in this domain. In fact, the second paragraph of the Recommendation invites the Commission and the Council to submit proposals complying with the new legal framework established by the Treaty of Lisbon.

Indeed, a successful conclusion of the agreement signed by the Council seems to be too shy and too advanced at the same time.

Too shy since the data protection legislation applied will remain that of the Member State where the data are stored (the Netherlands) or that of the State controlling SWIFT (Belgium). Furthermore, the authority verifying the admissibility of the request will also belong to one of these two countries despite the participation of the European Union.

The transatlantic legal framework will be the Agreement on Mutual Legal Assistance between the European Union and the United States of America, or if the conclusions will not be ratified, the bilateral agreements EU-Netherlands and EU-Belgium.

As the European Parliament’s rapporteur points out the type of access to financial data as foreseen by the TFTP is not admissible on the basis of the ordinary procedures applied in case of judicial cooperation in criminal matters. In this respect there is a risk to exceed the scope of the agreement by giving for granted the existence of a clarity in the field of data protection as well as police and judicial cooperation which does not exist not even between the Member States of the European Union.

In this regard, suffice to say that the European Union does not have a comprehensive legal framework to adequately face internal security challenges related to data protection in the field of security and police and judicial cooperation despite the numerous requests made by the European Parliament. This kind of solidarity has started with Schengen although it does not involve all the Member States.

At this stage it is inevitable to recall the old saying “nemo plus juris transferre potest quam ipse habet”, i.e. the European Union cannot transfer more powers of what itself has.

Indeed, the European Union has given to the United States all it could on the basis of the current legislation on the Agreement on mutual legal assistance between the European Union and the United States of America concluded in Washington on 28 October 2009.

The Agreement foresees:

The possibility to access banks’ data of natural or legal persons provided the latter are identified (see article 4 of the Treaty on Mutual Legal Assistance) on the basis of the European legislation in this domain (Third Directive on Money Laundering and Financial Information Regulation)
The possibility to extradite individuals to the United States applying the same conditions of the European Arrest Warrant
the possibility to create common investigation teams (on the basis of European norms concerning Europol and the Convention on Criminal Assistance).

This said, it is still technically feasible to make the transatlantic cooperation even more ambitious and make sure that the jurisprudence produced by international agreements may be translated in internal legislative measures.

To reach this goal it will then be necessary to put forward a series of simultaneous political operations which have been impossible to develop before.

Now, the first question concerns whether the American pressure will convince Member States to finally set up the necessary legal framework.

Secondly and more significantly, it is necessary to understand whether the requests put forward by the United States are compatible with the Treaty of Lisbon and the Charter on Fundamental Rights.

Thirdly, it is necessary to identify which European authority will be responsible for the Member States. For instance, one possibility to assess will be whether it would be possible to extend Eurojust and/or Europol’s powers instead of that of Dutch and Belgian authorities, ensuring at the same time loyal cooperation between the Member States.

Moreover, challenges do not only arise on this part of the Atlantic. The American negotiator is facing other equally demanding questions. For example, in case the authority in charge of the conclusions of the Agreement remains the Administration it will not be possible to seal an “executive agreement” since -by definition- it cannot modify the legal status of the American and European citizens.

What is more, an executive agreement will hardly secure the respect of those guarantees which the Charter requires avoiding hazardous appeals in front of the European and National Courts (see Karlsruhe …).

To do that it would be necessary, as in the case of police and judicial cooperation in criminal matters to pass the Congress and obtain two-thirds of the votes in the Senate. Once again, as it is often the case during the challenging evolution of the European Union, with fantasy and mutual respect it will be maybe possible to build a Transatlantic area of freedom, security and justice to which the Stockholm Programme and the inter-ministerial declaration referred on 28 October.

The EU-USA Provisional Agreement on Interbank Financial data access (SWIFT) under European Parliament scrutiny

In the next few weeks the European Parliament will receive several international agreements in the field of police and judicial cooperation negotiated or signed -albeit not yet ratified by the European Council- before the entry into force of the Lisbon Treaty.

Among these, special attentions deserve the two agreements signed with the United States concerning access to personal data to fight against terrorism.

The first one concerns personal data managed by airline companies when they conclude a transport contract which has as a destination or point of transition the United States (EU-USA Agreement on access to Passenger Name Record- PNR).

The second one, recently published in the Official Journal, concerns the access to personal and financial data exchanged via interbanking messages and processed worldwide, in almost their totality, by a specific society called SWIFT .

Their access is regulated by the Terrorist Finance Tracking Program (TFTP) on the basis of which the USA Treasury Department may request via an administrative mandate (“subpoena”) to access personal and financial data to prevent and fight terrorism.

The advantage of interbanking messages relies on their fast and easy accessibility compared to financial information, whose access is regulated by the prevention programmes for combating Money Laundering and Terrorist Financing. In fact, on the basis of these measures applied worldwide, it is a bank’s responsibility to signal suspicious transactions to the National Financial Intelligence Unit (FIU) which in turn transmits the information to the FIU of the countries involved in terrorist investigations.[1]

On the contrary TFTP access is direct, avoiding delays, risks of incomprehension and non-cooperative banks around the globe.

Even if available data are limited (such as clients generalities and amounts of transferred money) they become essential once they are cross-checked with information coming from other sources related to judicial, police and intelligence investigations.

This is obviously an extraordinary instrument also for the USA. This authorisation is based on exceptional powers granted to the President of the United States on a temporary basis by the Emergency Economic Powers Act (50 USC, sections 1701-1706). The President immediately used them after the 9/11 attacks and since then the Congress has renewed its authorisation every year.[2]

The TFTP programme remained secret up to 2006 when the USA press[3] published a series of articles and the Society SWIFT released a few statements after obtaining more restrictive measures to the access of data by the USA Treasury Department.

This took place despite the fact that the TFTP is exceptionally not covered by the Privacy ACT of the United States and neither by the general norms laid down to protect privacy in financial transitions.

The debate triggered at the European Union level resulted in a series of hearings and resolutions of the European Parliament[4], it set off an investigation of the CE Commission, an opinion of the data protection national authorities Working Group and an investigation carried out by the Belgian authorities ,who are the one responsible for the control of the activities carried onby the company SWIFT.

The conclusions of these discussions pointed out that the management of these data – although illegal in the EU territory- is legal in the USA territory on condition that:

-the company SWIFT adheres to the voluntary programme “SAFE HARBOR” to protect its clients[5] and

– American authorities respect a series of self-imposed limitations to limits data access; Furthermore, the constant presence of SWIFT employees when data are collected should be granted and a periodical review by an independent authority nominated in a concerted way by the USA and the EU takes place.

This complex jurisdictional construction was – and still is- based on the principle that these data are in the USA territory and therefore under jurisdiction of the American authorities.

However, things chaged when the company SWIFT restructured the systems architecture of the financial messaging network in 2007 and its global data centres. Becasue of this, SWIFT decided that the data coming from interbanking transactions outside the USA territory were all relocated exclusively within the European territory no longer allowing a mirror copy of these data in the American servers.

Based on the argument that retained data are crucial to the fight against terrorism, American authorities asked to keep on accessing these data also once they would have been relocated to the EU territory (and under EU legislation), with the guarantee that in case of a terrorist threat these data would have been transmitted back to the EU.

This ofer was mainly made on the basis that the majority of the European states are not equipped to use and process the data gathered in the TFTP. Therefore, in this way not only the United States but also the European Union would have benefit from the programme.

On the basis of this reasoning, negotiations started before summer 2009 and have been carefully followed by the European Parliament which in its resolution in September 2009 listed the minimum conditions to be applied to make sure that the use of data of TFTP is compatible with European standards. These indications refer to data protection as well as judicial protection standards, given that these are information that can be used for counter terrorism activities.

Against this background two agreements have been put forward: a first transitional agreement of the limited duration of 9 months and a second longer one whose negotiations should start in the next few weeks.

The “transitional” text of the first agreement has now been published in the Official Journal and will enter into force on 1st February 2010; it recalls some of the concerns of the European Parliament, not last the one concerning the need to anchor the implementation of this agreement to that on judicial cooperation in criminal matters between the EU and the USA concluded in Washington on 28 October 2009.[6]

It is too early to predict what the European parliament will do. One should not give for granted the outcome of the parliamentary scrutiny and its final vote since the Treaty of Lisbon (Article 16 TFEU) and the now binding Charter of Fundamental Rights[7] have introduced even stricter standard in terms of data protection.

EDC

[1] See GAFI recommendations such as the VII financial provision to gather data concerning transfer above 1.000 $ in Europe (3.000 $ in the USA) and to make them available to the authorities; see also Communitarian Directives on money laundering and Communitarian Regulations in this field (such as Regulation (CE) No 1781/2006 of the European Parliament and the Council of 15 November 2006 on information on the payer accompanying transfers of funds)

[2] CRF Presidential Executive Order 13224 issued by the President George Bush on 23 September 2001.

[3] See Wikipedia reconstruction: http://en.wikipedia.org/wiki/Terrorist_Finance_Tracking_Program

[4] See resolution of 6 July 2006 on the interception of bank transfer data from the SWIFT system by the US secret services (OJ C 303 E, 13.12.2006, p. 843) and Resolution of 14 February 2007 on SWIFT, the PNR agreement and the transatlantic dialogue on these issues (OJ C 287 E, 29.11.2007, p. 349).

[5] The Commission CE assessed that Safe Harbor guaranteed a sufficient level of data protection back in 2001.

[6] Processing of EU originating Personal Data by United States Treasury Department for Counter Terrorism Purposes – “SWIFT” (OJ C 166, 20.7.2007, p. 18).

[7] See also the European Convention on Human Rights, in particular Articles 5, 6, 7 and 8 thereof, the Charter of Fundamental Rights, in particular Articles 7, 8, 47, 48 and 49 thereof, Council of Europe Convention No 108 for the Protection of Individuals with regard to Automatic Processing of Personal Data, Directive 95/46/EC and Regulation (EC) No 45/2001.

Directive on data retention: now the floor goes to the German Constitutional Court

The year 2010 opens focusing on the German Federal Court, yet again. The Court has been called upon to rule on the compatibility of the fundamental right to data protection with the Directive imposing providers of communication services to retain data generated by phone calls and other public networks communication activities for at least six months to a maximum of 2 years .
This Directive adopted in just over three months under British presidency at the end of 2005 as an essential measure to prevent and fight terrorism, had already been strongly criticised during the phase that led to its adoption.
Initially, it was presented as a measure aimed at enhancing the cooperation of police authorities as well as th cooperation between police and telecommunications providers.
This is demonstrated by the fact that in principle this measures should ahve been adopted applying the unanimity rule. However, due to the opposition of some Member States, the British presidency in concert with the European Parliament and the European Commission decided to apply the qualified majority rule.
Thereof, the directive aimed at providing a common framework for telecommunications providers as to avoid unfair treatment between those forced to retain huge amount of data for several years and those exempted from this obligation was adopted despite several objections.
The solution adopted bonded all service providers to retain traffic data from a minimum of six months to a maximum of two years, provided that internal security matters fell under the responsibility of national legislators.
Continue reading “Directive on data retention: now the floor goes to the German Constitutional Court”