Privacy & Information Security Law Blog

On December 8, 2014, the Article 29 Working Party (the “ Working Party”) and the French Data Protection Authority (the “CNIL”) organized the European Data Governance Forum, an international conference centered around the theme of privacy, innovation and surveillance in Europe. The conference concluded with the presentation of a Joint Statement adopted by the Working Party during its plenary meeting on November 25, 2014.

In developing the Joint Statement, the independent EU data protection authorities (“DPAs”) assembled in the Working Party deliver key messages on how to create an ethical European framework that “enables private companies and other relevant bodies to innovate and offer goods and services that meet consumer demand or public needs, whilst allowing national intelligence services to perform their missions within the applicable law but avoiding a surveillance society.” The Joint Statement is intended to remind all relevant stakeholders (private and public) of their joint responsibility in designing and applying such a framework to the collection and use of personal data. It defines the essential principles to be included in this framework, as well as key actions that all relevant stakeholders must undertake when ensuring compliance with EU data protection law. The principles and actions include the following:

Data Protection as a Fundamental Right
The Joint Statement recalls that personal data includes meta data and must not be treated solely as an economic asset.

Need to Balance Data Protection Rights with Other Fundamental Rights and the Need for Security
The Joint Statement acknowledges that data protection must be balanced with other fundamental rights (such as non-discrimination and freedom of expression) but also with the need to ensure public security.

Need to Strengthen Public Awareness and Individual Empowerment to Help Individuals Limit Their Exposure to Excessive Surveillance
According to the Joint Statement, key measures include privacy education and opening collective judicial actions to individuals in order to facilitate the reporting of widespread EU data protection violations.

No Secret, Massive and Indiscriminate Surveillance
The Joint Statement recalls that such surveillance, whether by public or private actors in the EU or elsewhere, is neither lawful or ethically acceptable. According to the Working Party, none of the legal data transfer mechanisms (whether Safe Harbor, Binding Corporate Rules or the European Commission’s Standard Contractual Clauses) provide a legal basis for transferring personal data to a non-EU public authority for the purpose of massive and indiscriminate surveillance.

Limits on the Retention, Access and Use of Personal Data by National Competent Authorities
The Joint Statement further recalls that unrestricted bulk retention of personal data for security purposes is not acceptable.

No Unrestricted Direct Access of Foreign Law Enforcement Authorities to the Data of Individuals Processed in the EU
The Joint Statement suggests that such access should be possible only under limited conditions, e.g., with the prior authorization of a public authority in the EU or in the context of a mutual legal assistance treaty. The Joint Statement makes clear that foreign requests must not be served directly to companies under EU jurisdiction.

Storage of Data in the EU as an Effective Way to Ensure Control by an Independent Authority
The Joint Statement emphasizes that public or private parties should store data in such a way that an independent authority can effectively control their compliance with the EU data protection requirements when collecting massive amounts of data that provides very precise information on an individual’s private life. According to the Joint Statement, the storage of the relevant data on EU territory is an effective way to facilitate the exercise of such control.

Adoption of the Proposed EU Data Protection Regulation in 2015
The Joint Statement advises that the Proposed EU General Data Protection Regulation should be adopted in 2015.

Mandatory Nature of EU Data Protection Rules under Public and Private International Law
The Joint Statement emphasizes that foreign laws or international agreements cannot override EU data protection rules nor can organizations derogate from them by contract.

In terms of next steps, the Working Party welcomes comments on its Joint Statement by all interested stakeholders, public and private. Such comments may be addressed at edgf@cnil.fr. The Working Party announced that it will take these comments into account in its activities over the year 2015.