1. Clash of jurisdictions in the area of data protection

2. Part 1: PRISM / SAFE HARBOR
@maxschrems

3. FACTS
@maxschrems

6. FISA § 1881a Electronic Communication Service Provider
„Foreign Intelligence Information“
Certification for one year („FISA Court“)
Minimizing / Targeting procedures (US persons)
„Directive“ at Service Provider
API (?)

7. ? DISPUTED Technical implementation Amount of data „pulled“
Review mechanisms … ?

8. LEGAL ARGUMENT
@maxschrems

9. „ADEQUATE PROTECTION“ ?
Facebook Inc.
Facebook Ireland Ltd.

10. Strategic Approach NSA + ECSPs = “Public/Private Surveillance”
Facebook is subject to US and EU law
EU law regulates third country transfers
EU law has to be interpreted in the light of the CFR and the ECHR

11. Art 7 & 8 CFR „PRISM“ -v- Data Retention Content Data -v- Meta Data
„Available“ -v- Storage
Endless -v- 24 Months …

12. Interference (simplified)
Data pulled?
Data accessible?

13. Art 8 CFR
„Making Available“
EU proportionality test
Facebook Inc.

14. Interference Art 8 ECHR (simplified)

15. PROCEDURE
@maxschrems

16. PROCEDURE: DPCs
@maxschrems

18. Foto: James Flynn
„I don’t think it will come as much of a surprise that in fact US intelligence services do have access from US companies“

20. CJEU
@maxschrems

22. Findings (CFR) SH is invalid: (overnight)
Mass Surveillance violates “essence” of Art 7 CFR
Legal Redress in the US violates “essence” of Art 47 CFR

23. “Essence” Proportionality No Interference Essence
Legitimate aim for the measure
Measure suitable to achieve the aim
Measure must be necessary to achieve the aim (Less onerous way?)
Measure must be reasonable, considering the competing interests of different groups at hand

24. Other Key Findings “Essentially Equivalent” Protection in 3rd Country
Effective Detection and Supervision Mechanisms
Legal Redress in Line with Art 47 CFR
...higher standard than many MS?

25. GRC EO
FISA 702

26. Part 2: PRIVACY SHIELD
@maxschrems

28. TWO HURDLES
@maxschrems

29. = CFR . ≈ 95/46. Art 25 of 95/46/EC CFR Art 7, 8 & 47
„Ess. Equivalent”
CFR
Art 7, 8 & 47

30. PRIVATE SECTOR NOTICE & CHOICE
@maxschrems

31. collection,
recording,
organization,
storage,
adaptation or alteration,
retrieval,
consultation,
dissemination or otherwise making available,
and any other form of “processing”;
blocking,
erasure,
destruction;
use,
alignment or combination,
“Opt Out” for two specific situations
disclosure by transmission,
change of purpose,

32. Collection Use Storage
Disclosure
Change of Purpose
Collection
Use
Storage

33. HOW TO KILL THE TWO LIMITS IN TWO LINES?

34. UNLIMITED DATA PROCESSING
USE A BROAD PURPOSE +
THIRD PARTY CLAUSE =
UNLIMITED DATA PROCESSING

35. PRIVATE SECTOR REDRESS
@maxschrems

36. Choice / $$$
DPAs
. Panel

37. SURVEILLANCE ASSESSMENT
@maxschrems

38. “The US authorities ... assured there is no indiscriminate or mass surveillance by national security authorities.”
EU-COM, February 29th, 2016

39. ANNEX VI, PAGE 4

40. PPD-28, PAGE 3

41. PPD-28, PAGE 3, FN 5

42. SURVEILLANCE REDRESS
@maxschrems

43. DPA „has been investigated“ „complied or remedied“
„will neither confirm nor deny that whether the individual has been the target of surveillance“ nor „confirm specific remedy“
ANNEX III, Paragraph 4(e)

45. THANKS
@maxschrems