Europe’s highest court strikes down Safe Harbour data sharing between EU and US

[DontSayBanana]

I guess they actually decided based on facts, namely that your intelligence agencies are lawless and don't even adhere to the spirit of the US constitution or actual US legislation.

The only incident I'm aware of for which that claim could be made was the bulk metadata collection.  I'd agree that was lawless (although in fairness it's complicated enough that at least one appeals court with some pretty smart judges on found otherwise).

The bulk metadata program is being shut down and was not the basis of he ECJ decision.

The ECJ decision is based on:
(1) the fact that US intelligence agencies complying with the law can and do collect extensive data concerning foreign persons suspected of terrorist activities without a formal warrant, which can also include the of data of other (potentially innocent) persons who  communicated with the target.
(2) the fiction/misunderstanding that there is some other program out there ("PRISM" or some other acronym) under which US agencies have generalized access to electronic communications.

(2) the fiction/misunderstanding that there is some other program out there ("PRISM" or some other acronym) under which US agencies have generalized access to electronic communications.

I interpreted that not as a statement that PRISM doesn't exist (because it clearly does), but that what role it actually performs is being misinterpreted.

And Minsky, where do you get that bulk metadata collection is being shut down?  It expired, but was reauthorized soon afterward.

[Berkut]

So wait, is this really the case of the journalist misunderstanding the ruling, Minsky misunderstanding the article and then a bunch of ignorant blowhards going on a tirade about "stupid EU courts"?

Pot, meet kettle.

[ulmont]

The crux of the ruling is that the Commission had no authority to issue a safe harbour decision which would have the effect of preventing national courts from being able to examine, on their own, the facts of the case as to whether the US provides sufficient protection to data - in other words, the ECJ has ruled that this is a matter for national courts to decide when applying the data protection law.

The ruling goes further than that.

85      In this connection, Decision 2000/520 states in Part B of Annex IV, with regard to the limits to which the safe harbour principles' applicability is subject, that, '[c]learly, where US law imposes a conflicting obligation, US organisations whether in the safe harbour or not must comply with the law'.

86      Thus, Decision 2000/520 lays down that 'national security, public interest, or law enforcement requirements' have primacy over the safe harbour principles, primacy pursuant to which self-certified United States organisations receiving personal data from the European Union are bound to disregard those principles without limitation where they conflict with those requirements and therefore prove incompatible with them.

87      In the light of the general nature of the derogation set out in the fourth paragraph of Annex I to Decision 2000/520, that decision thus enables interference, founded on national security and public interest requirements or on domestic legislation of the United States, with the fundamental rights of the persons whose personal data is or could be transferred from the European Union to the United States. To establish the existence of an interference with the fundamental right to respect for private life, it does not matter whether the information in question relating to private life is sensitive or whether the persons concerned have suffered any adverse consequences on account of that interference (judgment in Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 33 and the case-law cited).

...

96      As has been found in particular in paragraphs 71, 73 and 74 of the present judgment, in order for the Commission to adopt a decision pursuant to Article 25(6) of Directive 95/46, it must find, duly stating reasons, that the third country concerned in fact ensures, by reason of its domestic law or its international commitments, a level of protection of fundamental rights essentially equivalent to that guaranteed in the EU legal order, a level that is apparent in particular from the preceding paragraphs of the present judgment.

97      However, the Commission did not state, in Decision 2000/520, that the United States in fact 'ensures' an adequate level of protection by reason of its domestic law or its international commitments.

98      Consequently, without there being any need to examine the content of the safe harbour principles, it is to be concluded that Article 1 of Decision 2000/520 fails to comply with the requirements laid down in Article 25(6) of Directive 95/46, read in the light of the Charter, and that it is accordingly invalid.

http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=245638

[chipwich]

The ECJ is well-respected,

How is the judicial branch of a phantom government that only sometimes has the will and power to enforce it's laws respected?

[Martinus]

The crux of the ruling is that the Commission had no authority to issue a safe harbour decision which would have the effect of preventing national courts from being able to examine, on their own, the facts of the case as to whether the US provides sufficient protection to data - in other words, the ECJ has ruled that this is a matter for national courts to decide when applying the data protection law.

The ruling goes further than that.

85      In this connection, Decision 2000/520 states in Part B of Annex IV, with regard to the limits to which the safe harbour principles' applicability is subject, that, '[c]learly, where US law imposes a conflicting obligation, US organisations whether in the safe harbour or not must comply with the law'.

86      Thus, Decision 2000/520 lays down that 'national security, public interest, or law enforcement requirements' have primacy over the safe harbour principles, primacy pursuant to which self-certified United States organisations receiving personal data from the European Union are bound to disregard those principles without limitation where they conflict with those requirements and therefore prove incompatible with them.

87      In the light of the general nature of the derogation set out in the fourth paragraph of Annex I to Decision 2000/520, that decision thus enables interference, founded on national security and public interest requirements or on domestic legislation of the United States, with the fundamental rights of the persons whose personal data is or could be transferred from the European Union to the United States. To establish the existence of an interference with the fundamental right to respect for private life, it does not matter whether the information in question relating to private life is sensitive or whether the persons concerned have suffered any adverse consequences on account of that interference (judgment in Digital Rights Ireland and Others, C‑293/12 and C‑594/12, EU:C:2014:238, paragraph 33 and the case-law cited).

...

96      As has been found in particular in paragraphs 71, 73 and 74 of the present judgment, in order for the Commission to adopt a decision pursuant to Article 25(6) of Directive 95/46, it must find, duly stating reasons, that the third country concerned in fact ensures, by reason of its domestic law or its international commitments, a level of protection of fundamental rights essentially equivalent to that guaranteed in the EU legal order, a level that is apparent in particular from the preceding paragraphs of the present judgment.

97      However, the Commission did not state, in Decision 2000/520, that the United States in fact 'ensures' an adequate level of protection by reason of its domestic law or its international commitments.

98      Consequently, without there being any need to examine the content of the safe harbour principles, it is to be concluded that Article 1 of Decision 2000/520 fails to comply with the requirements laid down in Article 25(6) of Directive 95/46, read in the light of the Charter, and that it is accordingly invalid.

http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=245638

I may be misreading these paragraphs, but they seem to me to focus on the formal side of the decision and not, as Minsky implied, on the factual analysis as to whether the American system is in fact providing appropriate protection of personal data.

The ruling challenges the decision because:
- it itself includes a possibility of derogation, thus providing insufficient protection to interests of EU citizens; and
- it does not include suitable reasoning as to why the American system can benefit from the safe harbour principles - it simply asserts that it does. 

[Razgovory]

Our intelligence agencies have laws.  They just don't protect foreign governments.

Foreign governments aren't at issue here.  Foreign individuals are.  The laws do protect such individuals because they put limitations on how and what information can be collected, and while there is more limitations vis-à-vis US citizens, authority is not unlimited as to foreign individuals.

What protections that Saudi citizens should enjoy in their own countries under the US Constitution are the Germans so unhappy about?

[The Minsky Moment]

(2) the fiction/misunderstanding that there is some other program out there ("PRISM" or some other acronym) under which US agencies have generalized access to electronic communications.

This is the problem.
Perhaps the NSA is to blame for the atmosphere where negative assumptions are made
But in courts usually affirmative evidence must be presented.

[The Minsky Moment]

And Minsky, where do you get that bulk metadata collection is being shut down?  It expired, but was reauthorized soon afterward.

IIRC it was only reauthorized temporarily for transitional purposes.
FWIW I never thought that program was such a big deal.
The bigger problem has always been the hide-the-ball nature of the FISA process and the apparent lack of serious review by the FISA court - but those problems date back to the 1970s.  Just no one aside from a couple ACLU activists seemed to care until Failed NSA Celebrity Apprentice fled to HK and revealed all the creepy-sounding bureaucratic acronyms.

[grumbler]

But you didn't let that stop you from drawing a conclusion, of course.

And for leaping on an obviously tongue-in-cheek comment as "racist" (of all things).  Racist? 

Then, Marti isn't known as the sharpest tool in the Languish shed.

[The Minsky Moment]

Where is the claim repeated? In the actual ruling or press coverage of it?

In the ruling.  Only press coverage I read was in the FT and said nothing about this.  In the ruling I count 3 instances:

34 . . .The right to respect for private life, guaranteed by Article 7 of the Charter and by the core values common to the traditions of the Member States, would be rendered meaningless if the State authorities were authorised to access electronic communications on a casual and generalised basis . . .
93. Legislation is not limited to what is strictly necessary where it authorises, on a generalised basis, storage of all the personal data of all the persons whose data has been transferred from the European Union to the United States without any differentiation, limitation or exception being made . . .
94 In particular, legislation permitting the public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life

The ECJ simply stated that the safe harbour decision is illegal, as the Commission does not have power to preclude a national court from making such a determination based on its own consideration of facts.

I didn't read it as limited in that way. It's true that the court seems to take the position in Para 66 that a national authority can "examine a claim" that there was a transfer of data without sufficient protection even though there is a Commission decision stating that the transferee country offers adequate protection.  But I read that in light of Paras 62 and 65 is being a procedural ruling - i.e the national authority can examine the claim as a preliminary matter, but if it determines there is valid basis, it can't grant relief without making a reference to the ECJ to challenge the validity of the Commission decision.

That reading appears to be confirmed in Para 67, where the ECJ states that in light of what it just said, " it should be examined whether [Decision 2000/520] complies with the requirements stemming from Directive 95/46 read in the light of the Charter" - i.e. the ECJ appears to saying it is ruling on the validity of the Decision in light of EU legislation and the Charter.  As far as I can tell, that is exactly what the the ECJ appears to do in rest of the text, culminating in the finding in Para 98 that Decision 2000/520 is invalid under EU law because - as per Para 96-97 and the earlier paras the Commission didn't have a proper basis to find an adequate level of protection.  It is the factual basis of that finding that I have been questioning here.