Herwig Hofmann on the Schrems Decision

Few recent decisions of the Court of Justice have attracted as much comment -- or controversy -- as the Schrems decision on the data protection "safe harbor."  As part of our ongoing series of posts regarding the case, we are delighted to publish here an analysis and comment by network member Herwig Hofmann (Luxembourg).  Herwig's perspective is of particular interest, as he represented Max Schrems before the Court of Justice in the case.  In the post below, he explores some of the broader implications of the decision.

* * *

The Essence of EU Fundamental Rights and their Global Reach 

Herwig C.H. Hofmann[1]

The CJEU ruling in Schrems v Data Protection Commissioner[2] will be subject to many discussions on constitutional matters for the time to come. It is a landmark case not only for clarifying and applying the basic conceptual understanding of fundamental rights in the EU. The Schrems case clarifies therein many further aspects of conditions for effective protection of a right, supervision by Member State authorities as well as the global reach of EU fundamental rights, at least regarding information rights and their protection. As is typical for many essential developments in public law, these developments originate from the very specific structural and substantive context of a specific policy area’s administrative law details. But the consequences will radiate also into debates on pluralism of multi-level legal orders in an inter-connected world.

The background to Schrems v DPC is as follows: Supervision of compliance with EU data protection rules takes place by national authorities vested with “complete independence”[3] within the territory of each Member State. Transfer of data from the EU to a third country is possible only if that country has an “adequate level” of data protection, a fact the European Commission may certify by means of a decision.[4] In 2000, the Commission had taken an adequacy decision with respect to the United States of America, a decision became known as the “Safe Harbour Decision”.[5] The Court of Justice of the European Union (CJEU) had the opportunity to review the compliance of the various elements of the data protection regime, especially the conditions of the Commission decisions declaring a third country to maintain an adequate level of protection, upon request for preliminary reference by the High Court of Ireland in a judicial review procedure of a decision of the Irish Data Protection Commissioner (DPC) not to accept a complaint about Facebook Ireland transferring personal data to Facebook servers in the US.

More on Schrems/Safe Harbor: Jean Monnet Center-NYU to hold lunchtime seminar on Thursday October 22 (RSVP req'd)

The Jean Monnet Center for International and Regional Economic Law & Justice at NYU Law School is organizing lunchtime seminar on the recent and high-profile Schrems/Safe Harbor judgment of the EU Court of Justice.  The Court’s ruling invalidated the arrangements for transatlantic data flows, on the ground that US law does not offer adequate protection of Europeans' right to privacy.  It raises a range of important questions concerning international jurisdiction, surveillance oversight, privacy standards, transatlantic commerce, and internet regulation.

The seminar will take place on Thursday October 22 from 1:00-2:30 pm in the 1st Floor Lounge at 22 Washington Square North in New York City.  The discussion will be introduced by a panel, consisting of Hauser Global Scholar Thomas Streinz, Senior Global Emile Noël Fellow Professor Piet Eeckhout, Professor Richard Epstein, and Zachary Goldman of the Center on Law and Security.  Professor Gráinne de Búrca will moderate.

If you are interested in attending, please RSVP by email to jeanmonnet@nyu.edu.  Lunch will be served from 12:30 PM and the presentation will begin at 1:00 PM.

Schrems/Safe Harbor Forum: A Sample of Some Critical US Commentary

With network member Herwig Hofmann (Luxembourg) representing the plaintiff, Max Schrems (Vienna PhD candidate in law), in the action that led to the CJEU judgment invalidating the US-EU data-sharing agreement known as 'safe harbor', a flood of commentary is to be expected.  We at Europaeus urge network members to send us their thoughts for posting or cross-posting.  In the interim, to give a sense of how the judgment has been received in some quarters on this side of the Atlantic, we publish excerpts from some critical US commentary below, and we look forward to posting views on all sides of the debate in the future.

* * *

Timothy Edgar (Brown), writing in Lawfare ("Schrems v. Data Protection Commissioner: Some Inconvenient Truths The European Court of Justice Ignores"), notes that the judgment fails to take into consideration at least two crucial facts:

First, Max Schrems’s Facebook data actually has more protections in US law when it is on a server in the US than when it is in the EU.  As I explained earlier this year in TechCrunch, offshoring data won’t protect it from the NSA, and neither will keeping data in Europe.  When content is located inside the United States, it cannot be collected except by order of the Foreign Intelligence Surveillance Court (FISC). The court imposes detailed oversight and auditing requirements, and has enforced those rules with threats of contempt of court....

Second, for the NSA to obtain Max Schrems’s Facebook data in the US, the NSA will face more legal scrutiny under US law than most intelligence services in the world, including in EU countries, ever will.  As I’ve explained before on this site, many European countries do not require judicial orders for intelligence surveillance....

The bottom line is that, if the fact that a country provides broad legal authority for national security surveillance means that the EU doesn’t consider it a safe jurisdiction for storing data about its citizens, it might want to take a good long look at the laws of its own member states....

And that’s where this decision by the ECJ offers an extraordinary opportunity for global surveillance reform.  If the ECJ is serious about subjecting national security surveillance laws to real scrutiny, it could build serious momentum for reform of those laws – and not just in the United States.

Edgar's suggestion is echoed by Evgeny Morozov, a senior editor at The New Republic.  Writing in the Financial Times, ("Worldwide fight over personal data has barely begun"), Morozov notes:

Alas, Europe’s own record on surveillance is disappointing. One would be hard pressed to find the differences between core provisions of the new surveillance law in France ... and those at work in America.... 

In this instance, one can’t blame Americans for complaining about hypocrisy when Europe’s stance on surveillance is full of contradictions. 

Finally, Richard Epstein (NYU), writing in Politico ("Europe’s top court goes off the rails"), criticizes several "astonishing" features of the Court's judgment, notably "that it paid no heed whatsoever to the reliance-interest of thousands of companies," and "that the ECJ attached no weight whatsoever to the massive dislocation that its decision would impose on all the companies in question."  He concludes:

Normally, decisions to shut down major programs require some balance of the equities on both sides. That was wholly ignored by the ECJ. Starting from its dubious premises, the ECJ has ripped apart a system that will take a great deal of effort to put back together. In the interim, virtually all the companies in question are left adrift on the question of whether they should shut down their networks immediately or risk serious civil and criminal penalties for moving further forward in this direction. It takes years to put into place successful complex systems of data transmission. It takes only one arrant complaint and a dubious decision of the ECJ to rip it all apart.

No doubt others will have different opinions.  We look forward to posting more commentary from the network on this important decision in the near future.