Negotiation of Agreement on Data Transfers
The transfer of individuals’ personal data between authorities in the EU and third countries, particularly the USA, in the name of the fight against terrorism has given rise to a number of difficulties – as the process in agreeing the SWIFT and PNR agreements shows. Particularly since Lisbon, the European Parliament has sought to exercise its powers of approval, seemingly whenever possible. As a result of the obvious sensitivities in this area, the Parliament called for an EU-US agreement on data protection that ensures adequate protection of civil liberties and personal data and the European Council, back in December 2009, asked the Commission to propose a recommendation “for the negotiation of a data protection and, where necessary, data sharing agreements for law enforcement purposes with the US”. The Commission did, indeed, produce a draft mandate in May 2010 to cover personal data that have been transferred and are then processed in the context of police and judicial co-operation in criminal matters.
According to the Commission, the agreement would:
Require that personal data is processed fairly for a specific, legitimate purpose and retained for a limited time only;
Demand limitations in case of onward transfers of this data to a third country;
Stipulate that every person has the right to access the personal data that has been collected about the individual and the right to have it corrected or erased;
Require that compliance with these rules is overseen by independent public authorities on both sides of the Atlantic;
Ensure that there are mechanisms for seeking redress, as well as compensation for any damages suffered as a result of breaches.
While this sounds worthy enough, the process has run in to more problems, problems of a constitutional nature. A number of Member States are now arguing that the agreement is a mixed agreement, that is an agreement which has to be agreed not just by the EU (and its institutions) but by the Member States too. This would mean that the national parliaments would be involved in the process too. The Member States objecting are the UK, Sweden, Czech Republic and Germany. Whatever the reasons for the objections of the other Member States, Germany’s issues – following the difficulties it had in the ratification process of the Lisbon Treaty – can clearly be seen. One of the key issues there had been the need to ensure that the Bundestag did not continue to lose power to the European level. The EU institutions are less enthusiastic; the EP suggests that the agreement would take too long to agree with the involvment of all the Member States – and certainly there is a great deal of divergence amongst the various states as to what sort of data transfers might be acceptable.
Meanwhile, the Data Protection Commissioners Group have expressed concerns about their lack of involvement in the process of negotiation too. While the Group welcomes the possibility of an umbrella agreement, it emphasised that any such agreement must respect the terms of the Charter and the ECHR. The Group referred back to the ‘unsatisfactory outcome’ in respect of the SWIFT agreement, and expressed concern that a similar outcome might arise here too. The group therefore emphasised the need for several data protection safeguards to be included in the future agreement, including full, effective and enforceable rights for all individuals, including both administrative and judicial redress; limitations to bulk transfers.; and “very strict rules” for the
onward transfer of EU-originating data to other countries or non-law enforcement agencies
within the US. The Group also stated that the proposed agreement should be subject to review.
As a backdrop to this story it is interesting to note the information arising from Wikileaks, summarised by a project looking at the Legal Issues in the Fight Against Terrorism; the summary shows the tremendous pressure the USA put members of the German government under in order to ensure that data protection concerns did not hold up the agreement of the interim SWIFT agreement – at least inCouncil/COREPER.