European Union

R O
Area of Freedom, Security and Justice
Advocate General Szpunar: the UK’s decision to leave the EU should not affect the execution of a European arrest warrant issued by it

Renckhoff
Freedom of establishment
The posting on a website of a photograph that was freely accessible on another website with the consent of the author requires a new authorisation by that author

Foreign affairs chiefs from Poland, Lithuania, Latvia and Ukraine met in Georgia this week to take part in commemorations marking 10 years since Russia’s invasion of the Caucasus Republic during 2008's August War.

Written by Shara Monteleone and Laura Puccio,

© vector_master / Fotolia

In the 2015 Schrems case, the Court of Justice of the European Union (CJEU) declared the European Commission’s 2000 decision on the ‘adequacy’ of the EU-US Safe Harbour regime invalid. This regime had formed the legal basis to allow transfers of data, for commercial purposes, from the EU to the United States of America (USA).

One of the main concepts on which the reasoning of the Court relied is that of ‘equivalence’ – between the level of protection existing in a third country, and the European data protection system. The Court invalidated the Commission’s Safe Harbour adequacy decision as it did not contain any findings regarding the existence in the USA of laws and practices limiting interference on the right to privacy and data protection (e.g. interference by public authorities for security purposes), nor of effective judicial remedies for individuals. According to the judgment, laws which establish exceptions (such as enacting measures for security purposes) which could lead to conflict with fundamental rights should lay down clear and precise rules regarding the scope and application of the measure, and minimum safeguards against the risk of abuse, including unlawful access and further use of such data. The corollary of this statement is that derogations and restrictions to data protection should be allowed only if strictly necessary. Moreover, whereas the self-certification mechanism for US-based companies could be part of an adequate data protection system, it should be accompanied by effective enforcement and oversight mechanisms.

As a consequence, the judgment ruled the Safe Harbour framework, on which a large number of companies had relied, insufficient to ensure the high level of protection for EU citizens required under EU law. This invalidation of Safe Harbour created legal uncertainty and the need for a new arrangement. In the meantime, more than 4 000 US companies making data transfers switched to other existing tools, albeit more burdensome and limited, such as Binding Corporate Rules or Standard Contractual Clauses.

In 2016, the European Commission and the USA adopted a new framework for transatlantic exchange of personal data, known as the Privacy Shield. Within a year, more than 3000 companies had subscribed to the new framework, and the US Federal Trade Commission had already triggered three cases of non-compliance with Privacy Shield. In September 2017, the first joint annual review of Privacy Shield took place. Although considered to be working well, a number of recommendations for further improvements were issued. Moreover, a range of concerns still remain to be addressed (not least in view of the recent Facebook / Cambridge Analytica scandal). The European Parliament adopted a resolution in July 2018, which, although acknowledging some improvements, reiterates a number of persistent concerns on Privacy Shield, and calls on the Commission to suspend the Shield.. Unless the concerns can be resolved satisfactorily, the underlying legal uncertainty may not disappear, and Privacy Shield is also likely to end up challenged before the CJEU, like its predecessor.

Read the complete in-depth analysis on “The Privacy Shield: Update on the state of play of the EU-US data transfer rules“.

 

 

Redress mechanisms available to individuals

 

 

Avenues of redress for undue access and use by US public authorities

The EU has taken action to protect companies affected by the US sanctions against Iran and compensate them for losses incurred. The blocking statute also provides for the possibility of companies that comply with the trade restrictions being punished. Commentators are delighted with the EU's feisty stance but doubt the law will have the desired effect.

After the US's unilateral withdrawal from the nuclear deal, the new sanctions against Iran are a further step by Trump aimed at increasing the pressure on Tehran. Commentators examine the potential consequences of the Trump administration's strategy for the country.

Mobile phones will be prohibited in French schools when classes start again this autumn. The move is a bid to improve pupils' concentration levels in class and increase physical activity during breaks. Internet-enabled devices will be banned in most schools, while lycées (upper secondary schools) will be allowed to decide for themselves whether to impose the ban. Commentators disagree about how effective the measure will be.

The city of Vilnius will launch a new PR campaign in Berlin and London on Wednesday in a bid to raise the city's profile and attract tourists. The Lithuanian capital is presented as Europe's G-spot with the advertising slogan: "Nobody knows where it is, but when you find it it's amazing". The Lithuanian government had requested in vain that the launch of the campaign be postponed until after the Pope's visit at the end of September. Rightly so?

Members of the Christian Democratic Union in Germany have reignited the debate about reintroducing compulsory military or community service for men and women. In France, a month of national service will be compulsory as of this autumn. Commentators believe the move could be beneficial for society.