1.4 Application Of The “Essentially Equivalent” Test
1.4.3 The “Essentially Equivalent” Test Cannot Result
Member States Or Other WTO Countries Outside The EU
The international commitments of the EU form a part of the EU legal order that have been reflected in previous Commission adequacy decisions under Article 25. They must be reflected in future decisions of the Commission and DPAs.
When the European Commission prepared the Safe Harbour Decision in 2000, it requested advice from the Article 31 Committee.118 On 31 May 2000, this
Committee published its “Text On Non-Discrimination,”119 which stated:
“[T]hird countries have raised concerns that enforcement actions in the EU may be more severe vis-à-vis third country entities than they are vis-à-vis EU
“Courts must, among other things, not only establish whether the evidence relied on is
factually accurate, reliable and consistent but also ascertain whether that evidence contains all the information which must be taken into account in order to assess a complex situation and whether it is capable of substantiating the conclusions drawn from it.”
114Schrems, para. 63.
115 European Commission, Code of Good Administrative Behaviour (2000),
http://ec.europa.eu/transparency/code/_docs/code_en.pdf.
116See infra Part 1.4.3.
117See infra Part 2.2.1.
118 Article 31 of Directive 95/46 provides that such a Committee shall be set up to assist the
Commission.
data controllers and that there may also be discrimination between the entities from different third countries. The Committee is confident that these concerns will prove to be unfounded …. [T]he Directive’s enforcement should, in the Committee’s view, be impartial both as between different third countries and as between third countries’ and EU entities.”120
In Recital 4 to the Safe Harbour Decision, as in its other adequacy decisions,121 the Commission noted that these decisions “should be enforced in a way that does not arbitrarily or unjustifiably discriminate against or between third countries where like conditions prevail nor constitute a disguised barrier to trade taking into account the Community’s present international commitments.”
The “present international commitments” referred to in Recital 4 are set out in the WTO’s General Agreement on Tariffs and Trade (GATT) and the General Agreement on Trade in Services (GATS). Within their scope of application, GATT and GATS require the EU and its Member States to grant, as a rule, “Most Favoured Nation Treatment” (MFN) and “National Treatment,” and they must also “administer measures in a reasonable way.”122 This essentially means that, as a rule, the EU and its Member States may not accord less favourable treatment to US goods, US services, and US service providers than they do to like EU goods and suppliers, or to other third countries that are GATT or GATS members. When the EU or its Member States do restrict MFN or National Treatment, such restrictions may not amount to “arbitrary or unjustifiable discrimination.”123
120Id. (emphasis added).
121E.g., Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European
Parliament and of the Council on the adequate protection of personal data provided in Switzerland (2000/518/EC), OJ 2000 L215/1, recital (4); Commission Decision of 31 January 2011 pursuant to Directive 95/46?EC of the European Parliament and of the Council on the adequate protection of personal data by the State of Israel with regard to automated processing of personal data
(2011/61/EU), OJ 2011 L27/39, recital (4); and Commission Decision of 19 December 2012 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data by New Zealand (2013/65/EU), OJ 2013 L28/12, recital (4).
122 GATS Articles II, XVII, XVI:2(a); GATT 1994, Articles I:1; III:4; X:3(a).
123 GATS Article XIV(c)(ii) (“Subject to the requirement that such measures are not applied in a
manner which would constitute a means of arbitrary or unjustifiable discrimination between countries where like conditions prevail, or a disguised restriction on trade in services, nothing in this Agreement shall be construed to prevent the adoption or enforcement by any Member of measures… necessary to secure compliance with laws or regulations which are not inconsistent with the provisions of this Agreement including those relating to… the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts”); GATT 1994, Article XX(d).
Discrimination is arbitrary or unjustifiable if a WTO Member does not provide some degree of certainty that the application of the measure will be applied in a fair and just way by the designated domestic bodies.124 Therefore, arbitrary or unjustifiable discrimination would arise if a Member State knowingly and without any rational reason subjects data flows to the US to higher standards than data flows to other Member States or to other countries covered by an “Article 25(6) decision.”125 Examination of the US legal order therefore must take into account recent Article 25(6) decisions in which the European Commission has recognized that third
countries are entitled to restrict data privacy rights on public policy grounds, provided that the public policy grounds are “similar in spirit” or “reflect” the provisions of
Directive 95/46. Restrictions of data protection rights permitting surveillance may be acceptable even if “there is no exact corresponding exception in the Directive.” In Opinion 11/2011, for example, the Article 29 Working Party assessed a principle of New Zealand law permitting an agency to collect personal data without respecting the principle of fairness where “[t]he agency believes, on reasonable grounds, that compliance would prejudice the purposes of the collection.”126 The Article 29
Working Party took a favourable view of this exception which was likely to be used in connection with monitoring and surveillance activities even though there was “no corresponding exception in the Directive”:
“(viii) The agency believes, on reasonable grounds, that compliance would prejudice the purposes of the collection. Although there is no exact
corresponding exception in the Directive, this exception reflects the exceptions provided for in article 13(a) to (f) and is likely to be used in connection with monitoring and surveillance activities, in particular in the employment and law enforcement areas.”
Compliance with GATT and GATS obligations would not permit applying a stricter standard to United States goods, services, or service providers without properly substantial grounds.
124 See Appellate Body Reports, US – Shrimp, para. 181 and EC – Seal Products, para. 5.328, stating
that there is arbitrary or unjustifiable discrimination where exporting Members can in no way be certain that the relevant provisions or guidelines were applied in a fair and just manner by the appropriate governmental agencies of the importing Member.
125 See Appellate Body Reports, Brazil – Retreaded Tyres, paras. 229 & 246 and EC – Seal Products,
para. 5.306, stating that there is arbitrary or unjustifiable discrimination when the reasons given for the discrimination bear no rational connection to the objective of the measure.
126 Principle 4 of the New Zealand Privacy Act “covers the issue of fairness by providing that an
agency may not collect personal information: (a) By unlawful means; or (b) By means that, in the circumstances of the case, -- (i) Are unfair; or (ii) Intrude to an unreasonable extent upon the personal affairs of the individual concerned.” Available at: http://ec.europa.eu/justice/data-protection/article- 29/documentation/opinion-recommendation/files/2011/wp182_en.pdf.
PART TWO:
COMPARISON OF THE LEGAL ORDERS ON GOVERNMENT SURVEILLANCE SHOWS THAT US SURVEILLANCE OF EUROPEAN PERSONAL DATA TRANSFERRED TO THE US IS NOT “MASS AND UNDIFFERENTIATED” AND IS
CONSISTENT WITH THE LEGAL ORDER WITHIN THE EU
Part One demonstrates that a decision under Article 25(2) or 25(6) of Directive 95/46 must take full account of the EU legal order (including the interferences to data protection permitted under EU law) and that the standard applied to the United States cannot, as a rule, be stricter than the standard applicable to EU Member States or to WTO member countries (and in particular the third countries that are subject to an Article 25(6) Decision). This chapter turns to comparison of the EU and US legal orders in the context of government surveillance.
This part presents the results of a preliminary overview of surveillance laws in a sample consisting of eight Member States, four of the largest ones and four others: Belgium, France, Germany, Italy, Ireland, Poland, the Netherlands, and the United Kingdom (Illustrative Member States). It also benefits from the recent analysis across all Member States by the European Union Agency for Fundamental Rights (FRA),127 as well as other, less-recent comparative reviews.
This report then looks at how US surveillance laws fit within this bandwidth of Member State laws. In conducting the comparison, the report focuses on US laws most likely to affect data of EU citizens transferred to the US and the analogous laws in the Illustrated Member States. These are laws affecting electronic communication and, in particular, those laws affecting what the FRA categorized as “signals
intelligence,” comprising the collection, processing, and analysis of information transmitted or stored in digital form. The FRA used the following conceptual model of signals intelligence128:
127 Surveillance by intelligence services : fundamental rights safeguards and surveillance and
remedies in the EU (November 2015) (FRA Report),
http://fra.europa.eu/en/publication/2015/surveillance-intelligence-services.
128 The FRA’s model was derived from a model published by the US National Research Council in a
review of surveillance technologies undertaken at the request of President Obama. See United States, National Research Council, Bulk Collection of Signals Intelligence: Technical Options 28 (2015), available for download at http://www.nap.edu/download.php?record_id=19414#.
The ECtHR has conducted some examination of collection of signals intelligence under the ECHR. In Weber & Saravia v. Germany, the ECtHR ruled that Member States have a “fairly wide margin of appreciation in choosing the means for achieving the legitimate aim of protecting national security” through signals intelligence.129 The ECtHR does require that “there exist adequate and effective guarantees against abuse,”130 but using “catchwords” or “search terms” (i.e., selectors or discriminants) is a recognized method to maintain the proportionality of the interference.131
The examination of Illustrative Member State signals intelligence laws and other key surveillance laws follows the criteria for the EU Benchmark established in Part 1.4. Parts 2.1 and 2.2 below examine how the Illustrative Member States and the US each implement these criteria to provide guarantees against abuse and maintain proportionality. Part 2.3 then conducts a direct comparison to establish that safeguards against abuse of surveillance under the US legal order meet the “essentially equivalent” test.
129 ECLI:CE:ECHR:2006:0629DEC005493400, § 106. 130Id.
131Id.; see also Liberty v. United Kingdom, ECLI:CE:ECHR:2008:0701JUD005824300, § 68, in which
the German model of applying search terms was held up as a model for the United Kingdom: “[T]he G10 Act stated that the Federal Intelligence Service was authorized to carry out monitoring of communications only with the aid of search terms which served, and were suitable for, the investigation of the dangers described in the monitoring order.”
2.1 The EU Legal Order On Surveillance Reflects Wide Discretion As To