Clash of jurisdictions in the area of data protection

Part 1: PRISM / SAFE HARBOR @maxschrems

FACTS @maxschrems

FISA § 1881a Electronic Communication Service Provider „Foreign Intelligence Information“ Certification for one year („FISA Court“) Minimizing / Targeting procedures (US persons) „Directive“ at Service Provider API (?)

? DISPUTED Technical implementation Amount of data „pulled“ Review mechanisms … ?

LEGAL ARGUMENT @maxschrems

„ADEQUATE PROTECTION“ ? Facebook Inc. Facebook Ireland Ltd.

Strategic Approach NSA + ECSPs = “Public/Private Surveillance” Facebook is subject to US and EU law EU law regulates third country transfers EU law has to be interpreted in the light of the CFR and the ECHR

Art 7 & 8 CFR „PRISM“ -v- Data Retention Content Data -v- Meta Data „Available“ -v- Storage Endless -v- 24 Months …

Interference (simplified) Data pulled? Data accessible?

Art 8 CFR „Making Available“ EU proportionality test Facebook Inc.

Interference Art 8 ECHR (simplified)

PROCEDURE @maxschrems

PROCEDURE: DPCs @maxschrems

Foto: James Flynn „I don’t think it will come as much of a surprise that in fact US intelligence services do have access from US companies“

CJEU @maxschrems

Findings (CFR) SH is invalid: (overnight) Mass Surveillance violates “essence” of Art 7 CFR Legal Redress in the US violates “essence” of Art 47 CFR

“Essence” Proportionality No Interference Essence Legitimate aim for the measure Measure suitable to achieve the aim Measure must be necessary to achieve the aim (Less onerous way?) Measure must be reasonable, considering the competing interests of different groups at hand

Other Key Findings “Essentially Equivalent” Protection in 3rd Country Effective Detection and Supervision Mechanisms Legal Redress in Line with Art 47 CFR ...higher standard than many MS?

GRC EO 12.333 FISA 702

Part 2: PRIVACY SHIELD @maxschrems

TWO HURDLES @maxschrems

= CFR . ≈ 95/46. Art 25 of 95/46/EC CFR Art 7, 8 & 47 „Ess. Equivalent” CFR Art 7, 8 & 47

PRIVATE SECTOR NOTICE & CHOICE @maxschrems

collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, dissemination or otherwise making available, and any other form of “processing”; blocking, erasure, destruction; use, alignment or combination,   “Opt Out” for two specific situations disclosure by transmission, change of purpose,

Collection Use Storage Disclosure Change of Purpose Collection Use Storage

HOW TO KILL THE TWO LIMITS IN TWO LINES?

UNLIMITED DATA PROCESSING USE A BROAD PURPOSE + THIRD PARTY CLAUSE = UNLIMITED DATA PROCESSING

PRIVATE SECTOR REDRESS @maxschrems

Choice / $$$ DPAs . Panel

SURVEILLANCE ASSESSMENT @maxschrems

“The US authorities ... assured there is no indiscriminate or mass surveillance by national security authorities.” EU-COM, February 29th, 2016

ANNEX VI, PAGE 4

PPD-28, PAGE 3

PPD-28, PAGE 3, FN 5

SURVEILLANCE REDRESS @maxschrems

DPA „has been investigated“ „complied or remedied“ „will neither confirm nor deny that whether the individual has been the target of surveillance“ nor „confirm specific remedy“ ANNEX III, Paragraph 4(e)

THANKS @maxschrems