Another episode of the EU PNR saga: remarks of the national data protection authorities

LETTER SENT BY THE PRESIDENT OF THE ART 29 WORKING PARTY (*) TO THE CHAIRMAN OF THE PARLIAMENTARY COMMITTEE IN CHARGE OF THE EU PNR DRAFT DIRECTIVE (emphasized by me)

Dear Mr Moraes,
Since the terrorist attacks in Paris and Copenhagen, the discussion on the possible introduction of an EU Passenger Name Records system (hereafter: EU PNR) has moved significantly forward, both in the Council and in the European Parliament. In particular, Mr Kirkhope, rapporteur on this issue, has presented an updated report on the Commission’s 2011 draft directive establishing an EU PNR to your Committee.
As stated early last month, the Article 29 Working Party (hereafter: the WP 29) is not in principle either in favour of or opposed to PNR data collection schemes (See press release issued by the Article 29 Working Party on EU PNR on 5 February 2015), as long as they are compliant with the fundamental rights to respect for private life and to the protection of personal data.
However, considering the extent and indiscriminate nature of EU PNR data processing for the fight against terrorism and serious crime, the WP 29 believes that it is likely to seriously undermine the rights as set out in Articles 7 and 8 of the Charter of Fundamental Rights in the European Union.
In this regard, the Working Party acknowledges that there have been some improvements to the initial draft from a data protection perspective. Still, the Working Party wishes to urgently draw your attention to the following outstanding issues to ensure that the aforementioned fundamental rights are respected.
First, the necessity of an EU PNR scheme still has to be justified. Precise argumentation and evidence are still lacking in that respect. Further restrictions should also be made to ensure that the data processing is proportionate to the purpose pursued, in particular considering that the report now includes intra-EU flights in the data processing. Therefore, it is recommended that the data collection is limited with reference to specific criteria in order for the scheme to guarantee respect for individuals’ fundamental rights and to take the CJUE data retention judgment into account. Besides this, the scope of the offences concerned should be further reduced and the retention period shortened and clearly justified.
In addition, a major error in the new Articles 10a and 12(1b) stemming from an apparent misunderstanding of the data protection authority’s role must be rectified in order to set the responsibilities of governments and data controllers.
Finally, the WP29 insists on the necessity to present as soon as possible a detailed evaluation of the efficiency of the PNR scheme. A sunset clause should also be inserted into the directive to assist in ensuring periodic review of the necessity of the system.

All these points will be developed in an appendix of this letter, as well as concrete modifications and improvements proposed to the text by the Working Party. I would be grateful if you would be so kind as to forward this letter to the members of your committee in order for them to take account of these views before the deadline for further amendments to the proposal. Naturally, the Working Party remains at your disposal for any clarification you would require and further input during the discussion on EU PNR.

Yours sincerely,
On behalf of the Article 29 Working Party,
Isabelle FALQUE-PIERROTIN Chairwoman

Appendix :
Demonstrating the necessity and ensuring the proportionality of the EU PNR scheme
Continue reading “Another episode of the EU PNR saga: remarks of the national data protection authorities”

The Proposed Data Protection Regulation: What has the Council agreed so far?

ORIGINAL PUBLISHED ON STATEWATCH

Analysis (Second version) by Steve Peers, Professor of Law, University of Essex, Twitter: @StevePeers

13 March 2015

Introduction

Back in January 2012, the Commission proposed a new data protection Regulation that would replace the EU’s existing Directive on the subject. It also proposed a new Directive on data protection in the sphere of law enforcement, which would replace the current ‘Framework Decision’ on that subject.

Over three years later, there has been considerable progress on discussing these proposals. The European Parliament (which has joint decision-making power on both proposals) adopted its positions back in the spring of 2014. For its part, the EU Council (which consists of Member States’ justice ministers) has been adopting its position on the proposed Regulation in several pieces. It has not yet adopted even part of its position on the proposed Directive.

For the benefit of those interested in the details of these developments, the following analysis presents a consolidated text of the five pieces of the proposed Regulation which the Council has agreed to date, including the two parts just agreed in March 2015. This also includes the parts of the preamble which have already been agreed. I have left intact the footnotes appearing in the agreed texts, which set out Member States’ comments.

The underline, italics and bold text indicate changes from the Commission proposal. I have added a short summary of the subject-matter of the Chapters and Articles in the main text which have not yet been agreed by the Council.

For detailed analyses of some parts of the texts agreed so far, see the links to the blog posts. The Council might always change its current position at a later point, and of course the final text of the new legislation will also depend on negotiations between the Council and the European Parliament.

SEE THE CONSOLIDATED TEXT (156 PAGES)

Background documents

‘Public sector’ provisions, agreed by Dec. 2014 JHA Council:

Chapter IV, agreed by Oct. 2014 JHA Council:

Rules on territorial scope, agreed by June 2014 JHA Council:

Rules on ‘one-stop-shop’, agreed by March 2015 JHA Council:

Rules on basic principles, agreed by March 2015 JHA Council:

Proposal from Commission:

Position of European Parliament:

Analysis of agreed territorial scope rules:

Analysis of agreed ‘privacy seals’ rules

Analysis of data protection supervision (one-stop-shop) rules:

Analysis of rules on basic principles

House of Lords recommends to change the Governement’s strategy on the UK’s opt-in.

“The UK’s opt-in Protocol: implications of the Government’s approach”

NOTA BENE : the full report is accessible on the House of Lords website.

SUMMARY

This report focuses on the Government’s approach to the opt-in Protocol, introduced by the Lisbon Treaty, by virtue of which the UK has a right not to participate in EU justice and home affairs (JHA) measures. At issue is whether the opt-in Protocol can be interpreted to mean that it is the content of an EU measure which determines the application of the Protocol, rather than a legal base under the JHA title of the Treaty on the Functioning of the EU (Title V).

We express no view on the desirability or otherwise of the opt-in mechanisms introduced by the Lisbon Treaty. The function of this report is to examine the way in which the Government has sought to interpret those mechanisms.

We examine the Government’s interpretation of the expression “pursuant to [Title V]” in the opt-in Protocol, and conclude that it has an accepted legal meaning, namely that a Title V legal base is required before the opt-in can be triggered. As a consequence, we recommend that the Government reconsider its broader interpretation.

We consider the Government’s approach to determining the legal base of an EU measure with JHA content. We conclude that the distinction it draws between whole, partial, and incidental JHA measures is misconceived. We again recommend it reconsider its approach.

We consider whether the Government’s overall approach to the opt-in Protocol gives rise to legal uncertainty. We draw a distinction between potential and actual legal uncertainty, concluding that the potential of the Government’s policy to create legal uncertainty is considerable. We further conclude that the Government’s approach risks breaching the EU legal duty of “sincere cooperation”.

We then look at how the opt-in Protocol has been interpreted by the EU institutions. The Government believes that the Commission has actively pursued a policy of “legal base shopping”, in order to undermine the UK’s opt-in rights. In one specific case it provides evidence that lends some support to this allegation, in respect of the former Commission. With this partial exception, however, we conclude that there is no persuasive evidence to suggest that the Commission has circumvented the UK’s opt-in rights.

We review the approach of the Court of Justice of the EU (CJEU) to determining the legal base of international agreements and, while recognising the Government’s concerns, conclude that there is no evidence to suggest that the CJEU has sought deliberately to undermine the safeguards in the opt-in Protocol. We conclude that it is highly unlikely that the CJEU will change its established approach to determining legal base, including for measures with JHA content. We recommend that the Government review its litigation strategy in the light of this conclusion.

Finally, we recommend that the Government consider the feasibility of an inter-institutional agreement on the scope of Title V. Continue reading “House of Lords recommends to change the Governement’s strategy on the UK’s opt-in.”

THE UK IMPLEMENTS EU FREE MOVEMENT LAW – IN THE STYLE OF FRANZ KAFKA

ORIGINAL PUBLISHED ON EU LAW ANALYSIS

Thursday, 19 March 2015

By Steve PEERS

Most laws are complicated enough to start with, but with EU Directives there is an extra complication – the obligation to transpose them into national law. A case study in poor transposition is the UK’s implementation of the EU’s citizens’ Directive, which regulates many aspects of the movement of EU citizens and their family members between EU Member States. Unfortunately, that defective implementation is exacerbated by a further gap between the wording of this national law and its apparent application in practice, and by the unwillingness of the EU Commission to sue the UK (or other Member States) even for the most obvious breaches of the law.

It’s left to private individuals, who usually have limited means, to spend considerable time and money challenging the UK government in the national courts. One such case was the recent victory in McCarthy (discussed here), concerning short-term visits to the UK by EU citizens (including UK citizens living elsewhere in the EU) with third-country (ie, non-EU) family members. The UK government has just amended the national rules implementing the EU citizens’ Directive (the ‘EEA Regulations’) to give effect to that judgment – but it has neglected to amend the rules relating to another important free movement issue.

Implementing the McCarthy judgment

The citizens’ Directive provides that if EU citizens want to visit another Member State for a period of up to three months, they can do so with very few formalities. However, if those EU citizens are joined by a third-country family member, it’s possible that this family member will have to obtain a short-term visa for the purposes of the visit. The issue of who needs a short-term visa and who doesn’t is mostly left to national law in the case of people visiting the UK and Ireland, but it’s mostly fully harmonised as regards people visiting all the other Member States.

Although the EU’s citizens’ Directive does simplify the process of those family members obtaining a visa, it’s still a complication, and so the Directive goes further to facilitate free movement, by abolishing the visa requirement entirely in some cases. It provides that no visa can be demanded where the third-country family members have a ‘residence card’ issued by another EU Member State. According to the Directive, those residence cards have to be issued whenever an EU citizen with a third-country family member goes to live in another Member State – for instance, where a British man moves to Germany with his Indian wife. Conversely, though, they are not issued where an EU citizen has not left her own Member State – for instance, a British woman still living in the UK with her American wife.

How did the UK implement these rules? The main source of implementation is the EEA Regulations, which were first adopted in 2006, in order to give effect to the citizens’ Directive by the deadline of 30 April that year. Regulation 11 of these Regulation states that non-EU family members of EU citizens must be admitted to the UK if they have a passport, as well as an ‘EEA family permit, a residence card or a permanent residence card’. A residence card and permanent residence card are creations of the EU Directive, but an ‘EEA family permit’ is a creature of UK law.

While the wording of the Regulation appears to say that non-EU family members of EU citizens have a right of admission if they hold any of these three documents, the UK practice is more restrictive than the wording suggests. In practice, having a residence card was usually not enough to exempt those family members from a visa requirement to visit the UK, unless they also held an EEA family permit. Regulation 12 (in its current form) says that the family member is entitled to an EEA family permit if they are either travelling to the UK or will be joining or accompanying an EU citizen there. In practice, the family permit is issued by UK consulates upon application, for renewable periods of six months. In many ways, it works in the same way as a visa requirement.

An amendment to the Regulations in 2013 provided that a person with a ‘qualifying EEA State residence card’ did not need a visa to visit the UK. But only residence cards issued by Germany and Estonia met this definition. This distinction was made because the UK was worried that some residence cards were issued without sufficient checks or safeguards for forgery, but Germany and Estonia had developed biometric cards that were less likely to be forged.

In the McCarthy judgment, the CJEU ruled that the UK rules breached the EU Directive, which provides for no such thing as an EEA family permit as a condition for admission of non-EU family members of EU citizens with residence cards to the territory of a Member State. The UK waited nearly three months after the judgment to amend the EEA Regulations to give effect to it.

The new amendments cover many issues, but to implement McCarthy they simply redefine a ‘qualifying EEA State residence card’ to include a residence card issued by any EU Member State, as well as any residence card issued by the broader group of countries applying the EEA treaty; this extends the rule to cards issued by Norway, Iceland and Liechtenstein. Presumably this brings the rules into compliance with EU law on this point (the new rules apply from April 6th). That means that non-EU family members of EU citizens will not need a visa to visit the UK from this point, provided that they hold a residence card issued in accordance with EU law, because they are the non-EU family member of an EU citizen who has moved to another Member State. However, this depends also on the practice of interpretation of the rules, including the guidance given to airline staff.

‘Surinder Singh’ cases Continue reading “THE UK IMPLEMENTS EU FREE MOVEMENT LAW – IN THE STYLE OF FRANZ KAFKA”

DENMARK AND EU JUSTICE AND HOME AFFAIRS LAW: DETAILS OF THE PLANNED REFERENDUM

ORIGINAL PUBLISHED ON EU LAW ANALYSIS

Tuesday, 17 March 2015

by STEVE PEERS

Danish participation in cross-border criminal law measures is symbolised by ‘The Bridge’, the ‘Nordic Noir’ series about cross-border cooperation in criminal matters between Denmark and Sweden. But due to the changes in EU law in this field, that cooperation might soon be jeopardised. As a result, in the near future, Denmark will in principle be voting on whether to replace the current nearly complete opt-out on EU Justice and Home Affairs (JHA) law with a partial, selective opt-out. I have previously blogged on the implications of this plan in general terms, but it’s now clear exactly what this vote will be about.

First of all, a short recap of the overall framework (for more detail, see that previous blog post). Back in 1992, Denmark obtained an opt-out from the single currency, defence and aspects of JHA law (it’s widely believed that it also obtained an opt-out from EU citizenship, but this is a ‘Euromyth’). These opt-outs were formalised in the form of a Protocol attached to the EU Treaties as part of the Treaty of Amsterdam. The JHA opt-out was then amended by the Treaty of Lisbon.

At present, Denmark participates in: the EU policing and criminal law measures adopted before the entry into force of the Treaty of Lisbon; measures relating to the Schengen border control system (as matter of international law, not EU law); the EU rules on visa lists (as a matter of EU law); and the EU’s Dublin rules on allocation of asylum applications, ‘Brussels’ rules on civil jurisdiction and legislation on service of documents (in the form of treaties with the EU). In contrast, Denmark does not – and cannot – participate in other EU rules on immigration and asylum law or cross-border civil law, or policing and criminal law rules adopted since the entry into force of the Treaty of Lisbon.

The Protocol on Denmark’s legal position either allows it to repeal its JHA opt-out entirely, or selectively. If it chooses to repeal the opt-out selectively, it would then be able to opt in to JHA measures on a case-by-case basis, like the UK and Ireland, although (unlike those states) it would remain fully bound by the Schengen rules. Indeed, those rules will then apply as a matter of EU law in Denmark, not as a matter of international law. Continue reading “DENMARK AND EU JUSTICE AND HOME AFFAIRS LAW: DETAILS OF THE PLANNED REFERENDUM”

Commission recent withdrawal of legislative proposals : Easter’s “house cleaning” or a growing threat to the EU institutional balance ?

by Emilio De Capitani

On March 7 the Commission published on the official journal a list of legislative proposals which it has decided to withdraw. (1) The immediate consequence is that legislative negotiations between the European Parliament and the Council on some of these texts can go no further (even if the co-legislators are still interested in finalizing their work). (2) As it would happen if a referee snatches the ball during a match of football , several parliamentary committees have loudly protested.(3)

The problem was not only that the game abruptly interrupted but also that no one could predict when it would start again (even after the Lisbon Treaty the European Parliament and the Council still lack the power to initiate new legislation and can play their legislative role only by amending, (as a general rule), a Commission legislative proposal.

This bizarre situation dates back to the first phase of the European Communities when the Commission was the only institution which could limit the risk that the members states through the Council could re-nationalise the powers conferred by the Treaties to the Community. Since then the rule has been that “…Union legislative acts may only be adopted on the basis of a Commission proposal, except where the Treaties provide otherwise” ( current art 17 p 2, first phrase TEU) and such a Commission’s monopoly of initiative has been further strengthened by two other elements: Member States can change the Commission proposal only by an unanimous vote and conversely the Commission can amend its own proposals all along the procedure “… As long as the Council has not acted(..)”(art. 294 TFEU). In the real world this means that the Commission has to modify its proposal when it shares a majoritarian position emerges in the Council ( so that unanimity is no more needed). To strengthen even more its power to influence the Council position the Commission has developed (in the silence of the treaties) a legal theory according to which the right of initiative not only cover the right to amend a text but also the rights to withdraw it when the Commission consider that its “power” of legislative initiative risks to be abused by the Council in a way which according to the Brussels’s executive is contrary to the EU interest.

In 2013 the beginning of an interinstitutional “Game of thrones” .. Continue reading “Commission recent withdrawal of legislative proposals : Easter’s “house cleaning” or a growing threat to the EU institutional balance ?”

Legal aid in criminal proceedings : will the European Parliament improve the Council’s “general approach” ?

by Claire Perinaud (FREE Group Trainee)

State of implementation of the Procedural rights roadmap.

After years of unsuccessful attempts, starting in 2004 with a general Commission proposal on procedural rights it was only from the end of 2009 that the EU legislation on procedural rights for suspects and accused persons in criminal proceedings has progressively taken shape. This was due to the entry into force of the Treaty of Lisbon (TFEU art. 82(2) now confer the power to adopt legislation on this issue), to article 47 of the Charter of Fundamental Rights (providing for the right to a fair trial) and to a political “roadmap” by which, in November 2009 the Council relaunched the Commission original proposals following a step-by-step approach instead of trying to adopt comprehensive legislation as initially foreseen in 2004.

However it is more than likely that this pragmatic approach and the transition from unanimity to qualified majority voting of the EU Member States in the Council (as from the entry into force of the Treaty of Lisbon) has made possible the adoption in co-decision with the European Parliament of the three first legislative measures on suspects’ rights: Directive 2010/64/EU on the right to interpretation and translation in criminal proceedings; Directive 2012/13/EU on the right to information in criminal proceedings; and Directive 2013/48/EU on the right of access to a lawyer in criminal proceedings.

Building on this success, at the end of November 2013 the Commission proposed a second “package” of suspects’ rights measures, comprising: a directive on procedural safeguards for children who are suspected or accused in criminal proceedings; a recommendation on procedural safeguards for vulnerable people suspected or accused in criminal proceedings; a directive strengthening of certain aspects of the presumption of innocence and of the right to be present at trial in criminal proceedings; a directive on the right to provisional legal aid for citizens suspected or accused of a crime; and a recommendation on the right to legal aid for suspects or accused persons in criminal proceedings.

In 2014 the Council already reached a general approach on the proposal for a directive on procedural safeguards for children and on the directive on the presumption of innocence. On this basis the dialogue between the Council and the European Parliament (EP) is about to start and it is possible that in the coming months an agreement could be reached so that these texts could be adopted already at the EP’s “first reading” .
Last week the Council has reached (after eight months of internal negotiations!) a general approach also on the draft Directive on provisional legal aid for persons deprived of liberty in criminal proceedings and will start in the coming weeks the dialogue with the Parliament also on this text.

The coming months will then be extremely important for EU procedural rights in criminal matters even if it will not be easy to achieve the high results that the European Parliament and some Member States were expecting. In the absence of the energetic push of the former Commission Vice President Reding there is a risk that the negotiations may achieve the lowest common denominator between the Member States also due to the unwillingness of some of them to adopt any EU legislation which can create further financial and internal institutional tensions.

Legal aid : why make it simple when you can make it tricky ? Continue reading “Legal aid in criminal proceedings : will the European Parliament improve the Council’s “general approach” ?”

EU Accession to the ECHR: What to Do Next

ORIGINAL PUBLISHED ON VERFASSUNGblog
Fri 13 Mar 2015

by Andrew Duff

Some weeks have passed since the European Court of Justice delivered its startling binding Opinion 2/13 against the accession of the European Union to the European Convention on Human Rights (ECHR). There has already been much academic commentary on the complex Opinion. The European Commission has declared the need for a period of reflection. Mindful of its legal duty under Article 6(2) TEU to achieve the EU’s accession to the Convention, the Commission considers itself still empowered by the Council decision of June 2010 to continue negotiations in due course with the Council of Europe. But the political reaction is muted: some EU member states would like to knock the matter into the long grass; and the European Parliament has not yet found its voice. In truth, nobody can relish the thought of re-opening negotiations at this juncture on the Draft Accession Agreement (DAA) with either Russia or Turkey, both of whose leaders appear to have abandoned the democratic rule of law and turned against Western values.

Yet the Court of Justice (CJEU) raises important issues which the other institutions cannot simply ignore. Its Opinion adds to the already fairly improbable conditions which the Treaties themselves attach to the EU’s accession to the ECHR: Protocol No 8 says that accession shall not affect the ‘specific characteristics of the Union and Union law’, that the competences of the EU and the powers of its institutions shall be preserved, that the situation of member states vis-à-vis the ECHR should not be changed, and further, that no intra-EU dispute should go to the European Court of Human Rights (ECtHR). Article 52 of the Charter says that where its provisions correspond to the ECHR their ‘meaning and scope … shall be the same’; while Article 53 denies that the Charter restricts or adversely affects rights ‘as recognised, in their respective fields of application, by Union law and international law’ – notably the ECHR. Whereas Articles 53 (coincidentally) of both the ECHR and the Charter allow their signatories to offer more extensive protection than the Convention, the CJEU has been anxious to insist that after accession the EU member states should not seek to outpace or undermine the ‘primacy, unity and effectiveness’ of Union law.

Read it again Continue reading “EU Accession to the ECHR: What to Do Next”

A Constitutional Defense of CJEU Opinion 2/13 on EU Accession to the ECHR (and the way forward)

Original published on VERFASSUNGSblog

by Daniel Halberstam

The Court of Justice of the European Union has arrived! Gone are the days of hagiography, when in the eyes of the academy the Court could do no wrong. The judicial darling, if there is one today, is Strasbourg not Luxembourg. Only hours after Opinion 2/13 struck down the Draft Agreement (“DA”) on EU Accession to the European Convention on Human Rights (“ECHR”), scholars condemned the opinion as “exceptionally poor.” Critical voices mounted ever since, leading to nothing short of widespread “outrage.”

.
I disagree with the critics. In an article, “‘It’s the Autonomy, Stupid!’ A Modest Defense of Opinion 2/13 on EU Accession to the ECHR, and a Way Forward” forthcoming in the German Law Journal, I provide the first comprehensive legal analysis and constitutional reconstruction explaining why the Court’s concerns are mostly warranted. I also identify the changes that must be – and reasonably can be – made to move accession forward. Finally, and in a twist of irony, I show that one of the Court’s greatest concerns – mutual trust – goes to the very survival of the Union and demands not an exemption, but full accession.

My defense is not a nostalgic plea for a return to gentler days. To the contrary, as a critic on record of both the CJEU[1] and the Bundesverfassungsgericht,[2] I have little patience for judicial hagiography. No court is an entirely innocent actor. Opinion 2/13’s abrasive and uncompromising style, to which the title of my article alludes, suggests Strasbourg is not welcome in Luxembourg. Wary of its younger overburdened sibling, the CJEU seems intent on guarding its privileged judicial position in Europe.

And yet, dismissing the Court as selfish would be throwing out the baby with the bathwater. The bracing exchange of pluralism, which I support, lacks value (and values) if constitutionalism is not part of the mix. The internal constitutional perspective of actors considering external legal claims does not undermine pluralism. To the contrary, constitutionalism provides legitimacy to the exercise of public power. As a result, constitutionalism supplies the terms on which the pluralist contestation takes place. As I have argued repeatedly elsewhere, constitutionalism supplies the grammar of legitimacy that governs the pluralist contest by insisting that power always vindicate a combination of voice, rights, and expertise. We must, therefore, never forget the role that constitutionalism plays in a pluralist constellation.

But the current critics did just that: they rushed to embrace Strasbourg while forgetting about the constitutional dimension of EU governance along the way. A singular focus on international human rights regimes, however, can be misleading. On the Verfassungsblog, for instance, the President of the CJEU has been quoted as saying: “The Court is not a human rights court. It is the Supreme Court of the European Union.” Critics interpret this to indicate the CJEU is not taking rights seriously. The argument echoes a rather old debate,[3] recently renewed by suspicions about the Court’s bona fides regarding labor rights after Viking andLaval[4] and asylum rights after M.S.S. and Abdullahi.

Rights lapses at the Court must be condemned, but there is nevertheless a good deal of respectable truth to the President’s internal perspective. The CJEU has come around (even if only after a prolonged pluralist struggle with Member State high courts) to protect rights as an essential feature of the legality and legitimacy of EU law. Today, the EU is firmly committed to protecting fundamental rights, which may include participation in international human rights regimes – as well it should. But such participation should not undermine the constitutional nature of the EU’s legal order, which is geared to vindicating all three constitutional values. The EU may sign on to the ECHR as an extension, but not substitution, of its own project of constitutional governance.

The EU’s constitutional engagement with the world, then, leaves ample space for hard pluralist contestation. But we must first understand the “constitutional” element of the EU’s side of the contest. It is in this spirit that I reconstruct the Court’s objections to the Draft Agreement.

My main concern, then, is not for the reputation of the Court, but for a sensible project of accession that gives due consideration to the constitutional quality of the Union. In the remaining space, I cannot summarize the Opinion, the issues, let alone my article. I can give only a quick sense of some conclusions that follow from my plural constitutionalist approach. Continue reading “A Constitutional Defense of CJEU Opinion 2/13 on EU Accession to the ECHR (and the way forward)”

WHEN SUPER-REGULATORS FIGHT: THE ‘ONE-STOP SHOP’ IN THE PROPOSED DATA PROTECTION REGULATION

ORIGINAL PUBLISHED ON EU LAW ANALYSIS

by Steve Peers

A guilty pleasure for fans of superhero comic books is the moment when our heroes pause in their valiant efforts to save the public from the nefarious plans of the supervillains – and start beating the hell out of each other instead. This is usually triggered by some trivial difference of opinion, perhaps concerning a continuity error or intellectual property rights.
Similarly, the EU vests its hopes for the effective enforcement of data protection law upon national data protection authorities (DPAs): the superheroes of the data protection world. They have considerable powers under the current data protection Directive, and the proposed Regulation would also give them more powers. But what if they disagree with each other? There’s nothing in the current legislation to settle this problem, which gives each DPA the power to regulate actions on its own territory without addressing the obvious complications that result in a digital age, when many forms of processing of personal data (most obviously via the Internet) take place across borders.

To deal with this problem, the Commission proposal contains a conflict rule to determine who is the lead regulator in cross-border cases, with the possibility that a ‘European Data Protection Board’ or the Commission itself can issue an opinion on the issue. This has been dubbed the ‘one-stop shop’ rule. However, due to legal concerns, both the Council (which is about to adopt its position on this part of the proposed Regulation: see the draft texthere), and the European Parliament (EP), which has already adopted its position on the entire text, propose instead that the Board must be able to make binding decisions to settle disputes.

So this is set to become one of the most significant innovations of the new legislation. Let’s take a look at what the future rules will likely say about the role of national DPAs, the one-stop-shop process and the powers of the Board.

National data protection authorities

The current Directive already provides for the existence of DPAs, and insists that they must exercise their powers in ‘complete independence’. CJEU case law (discussed here) has set out a very strong interpretation of this notion, ruling that Germany, Austria and Hungary breached it, because they provided for too much accountability to national parliaments (Germany), failed to separate the DPA from the ordinary civil service (Austria) and defenestrated the DPA boss before his normal term of office expired (Hungary).

The proposed Regulation would retain and elaborate upon this concept, and the Council and EP agree with most of the Commission’s suggestions. Admittedly, the DPAs have to be appointed by public authorities in the first place: after all, their powers don’t stem from being bitten by a radioactive spider, or orphaned in a bat-infested back alley. The Council would amend the proposal so that they don’t have to be appointed by the government or parliament, but could instead be appointed by the head of state or independent body. Only the last alternative would fully ensure their independence from the outset (although who appoints the ‘independent body’?)

Three points of concern here. First, the proposal would usefully require the national DPAs to be adequately funded. That is easier said than done, for most DPAs complain of an absence of sufficient funding. For instance, the Irish DPA occupies a small office next to a corner shop – but purports to regulate (among many other things) all of Facebook’s activities in the EU. Secondly, the Council would remove the proposed rule requiring that DPAs be independent ‘beyond doubt’ when they are appointed; but DPAs should not be a resting ground for political hacks and bagmen. Thirdly, the Council would remove most of the details concerning the loss of office of DPAs, retaining only the minimum rule of four years in office. As the termination of the Hungarian DPA showed, it’s hard to exercise your powers independently if you constantly fear that there may be Kryptonite in your coffee.

As for the powers of the DPAs, the Regulation would strengthen and elaborate upon their current advisory and enforcement roles. In particular, the current powers to investigate, intervene and engage in legal proceedings would be fleshed out, by adding powers concerning audits, access to the premises of the controller and processor, ordering compliance with a data subject’s request, the suspension of data flows, or the imposition of fines.

But with these great powers will come only limited accountability. DPAs will have to publish an annual public report (and the EP even wants to weaken this obligation). But that’s the only way that their decisions can be controlled, unless a cross-border complication means that other DPAs, or the European Data Protection Board (a sort of uber-DPA) gain jurisdiction, as discussed below. Otherwise, the only bodies which can watch these watchmen are the courts. Continue reading “WHEN SUPER-REGULATORS FIGHT: THE ‘ONE-STOP SHOP’ IN THE PROPOSED DATA PROTECTION REGULATION”