At present, not all these procedures are in place. The Commission is discussing with the other EU parties concerned (the Member States in the Article 31 Committee and the national supervisory authorities in the Article 29 working group) the relevant aspects of the procedures and will ensure that all the necessary decisions are in place before any decisions are taken on the basis of Article 25.6.
The present draft of the procedures paper represents the state of discussions between the Commission and the Department of Commerce. The two sides agree that such a paper would be a necessary part of any package resulting from their dialogue about the “safe harbor” and that the content of the paper needs to provide the assurances of transparency and due process provided by the present draft. The present text is a working draft developed by DG XV of the Commission, which is now being discussed with the article 31 Committee and the Article 29 working group.
Description of the Procedures Established for Handling Complaints About Transfers of Personal Data to Third Country Recipients Who Are the Subject of An “Adequate Protection” Finding Under Article 25.6 of the Data Protection Directive (95/46/ec)
The purpose of making findings of “adequate protection” under Article 25.6 of the Directive is to provide greater legal certainty and legal security for transfers of personal data to third countries. In the absence of an Article 25.6 decision, the assessment of adequacy is a decentralised process, with all the unpredictability that that entails. Article 25.4 provides for a process by which any disparate assessments are harmonised at the Community level, but before that happens, data flows may be blocked by national action (Article 25.3).
Where there is a decision based on Article 25.6 that “adequate protection” is in place, (“the decision”), national action to block transfers, as provided for under Article 25.3, is no longer possible. Prior notification and authorisation procedures in those Member States which require them for transborder data flows are also waived or granted automatically.(1*) Recipients of data in third countries have the assurance that, even where they are alleged not to be complying with the data protection rules approved in the decision, their data flows can only be interrupted by a Community level decision and then only after they and their national authorities (if they so wish) have had the opportunity to make their case, have had the evidence and views they have submitted taken into account, and have been given a reasonable opportunity to rectify the situation if necessary. (Temporary national blocking action might, however, be justified in exceptional circumstances, as defined in the decision.)(2)
The procedures for handling complaints about non-compliance with the rules on which Article 25.6 decisions are based are described in part A of the present paper. Action at a number of different levels is involved: in the third country concerned; in the Member State where the complainant resides or from which the transfer was made; and at EU level. Where the procedures described have been set out by those responsible for them, the references of the source documents are given.
Part B of this paper describes the procedures that relate to possible challenges to the soundness or legality of a decision taken under Article 25.6. Briefly, the finding of “adequacy”can only be overturned either by the same procedure by which it was adopted (i.e., Commission, supported by a qualified majority of Member States) or by the European Court of Justice.
A. Complaints about non-compliance with the requirements of an Article 25.6 decision
Stage 1 – Procedures in the third country
In many cases, companies and other organisations receiving data in third countries are
__________________________
*Numbers in parentheses (1-4) refer to endnotes.
likely to have their own internal complaint procedures. Moreover, the existence of independent mechanisms for dealing with complaints in the third countries concerned, whether of a judicial or other nature, will have been verified before any decision under Article 25.6 is taken. Data subjects are expected to use these channels to resolve any problems or disputes they may have. If the problems or disputes remain unresolved after stage 1, data subjects may bring the matter to the attention of the competent Member State authorities (usually data protection Commissioners).
Stage 2 – Procedures in the Member States
The procedures as described below are Member State procedures. They were discussed and an account of them was approved by the group set up under Article 29 of the Directive at its meeting on ……..
Data protection Commissioners are under obligation to investigate complaints and in some cases are subject to time limits for doing so. However, they will normally not take up cases unless they are satisfied that the data subjects have themselves taken all reasonable steps to resolve disputes with the data recipients concerned and/or through the relevant dispute resolution mechanism. Where there is a prima facie case for believing that the rules on which the decision is based are not being complied with, the competent authority will take the matter up with the recipient of the data transfer and subsequently, if necessary, with the independent dispute resolution mechanism and/or the third country authorities concerned and give due consideration to the evidence and views they submit.
If the competent authority does not find substantial grounds for considering that the presumption of “adequacy” created by the decision should be reversed, the competent authority will take no further action. If, on the other hand, the competent authority concludes, on the basis of the evidence presented by both sides, that there are substantial grounds for believing that there is non-compliance, and if the authority’s contacts with the recipient and the third country’s authorities fail to produce a solution acceptable to all sides, the authority will take the necessary steps to notify the Commission of the case. It will not do this without having given guidance to the recipient as to how to comply with the requirements of the decision and sufficient time to take the necessary action. It will also inform the authorities of the third country concerned.
The Member State authorities may not take action to block data flows to a recipient covered by a finding of “adequacy” taken under Article 25.6, unless the exceptional conditions laid down in the decision and the applicable procedural requirements are met. These are the same conditions and requirements that would need to be met under existing Member State procedures before provisional measures are taken (the relevant Article 25.6 decision refers). These procedures are described in the annex to this paper.
Stage 3 – Action by the European Commission
The following description of the Commission’s action is drawn from its explanatory memorandum to its decisions under Article 25.6 [or its decision concerning ……..].
Once notified by a competent Member State authority of a complaint about non-compliance with the requirements of an Article 25.6 decision, the Commission will notify the data subject, the data recipient and the third country authorities concerned and provide them with the opportunity to submit evidence and comments, in addition to those already provided to the Member State that has notified the case.
The Commission may conclude on its own authority that no substantial grounds have been established which justify calling into question the presumption of adequate protection created by the decision. In such cases and where the Member State concerned agrees with that conclusion, the Commission will take no further action and will inform all the parties concerned accordingly.
If the Commission concludes that there are substantial grounds based on the evidence submitted by the parties that the recipient is not complying with the rules on which the decision is based, the Commission, in co-operation with the Member State authorities concerned, will continue the efforts already made to resolve the problem in a way which ensures compliance with the rules that are the basis for the decision and avoids the blocking of data transfers. In agreement with the member State concerned, it will in particular propose to the recipient, directly and/or through the third country’s authorities, the measures it should take to comply with the requirements of the decision. Where such measures are taken, the Commission will take no further action, other than to inform the parties concerned and the other Member States of the outcome.
In cases where either the Commission and the Member State concerned are in disagreement about whether there are substantial grounds to call the presumption into question, or the recipient fails to take the measures necessary to comply with the requirements of the decision within a reasonable time, the Commission will notify the recipient and the third country’s authorities of its intention to bring the matter formally to the attention of the Committee established by Article 31 of the Directive and give the third country’s authorities the opportunity, if they so request, to encourage the recipient to take the measures necessary to comply before such proceedings begin. Where the recipient indicates its willingness to take the measures necessary to comply with the decision, it will be given sufficient time to do so, but the matter will not regarded as closed until the action has been taken.
The Commission will normally either resolve a case (i.e., find that there are no substantial grounds for determining non-compliance, or obtain the agreement of the recipient of the data to make the changes necessary to comply with the requirements of the decision) or bring it formally to the attention of the Article 31 Committee within 12 weeks of its having been notified. The Commission will in any case inform the Article 31 Committee of the outcome of its examination of all cases notified to it of alleged non-compliance with the requirements of Article 25.6 decisions.
The role of the Article 31 Committee in procedures for handling complaints about compliance with Article 25.6 decisions is set out in the Committee’s rules of procedure.
The Commission will present the facts of any cases which it brings to the attention of the Article 31 Committee. The Member State concerned will also present its views, if it is in disagreement with the Commission. The recipient of the data transfer and the authorities of the third country concerned will also have the opportunity to submit their evidence and views in writing to the Committee. The Committee will give due consideration to all the evidence and views submitted to it. In the light of the Committee’s deliberations, the Commission will either decide to close the case, on the grounds that there is insufficient evidence to overturn the presumption of adequate protection established by the decision, or will recommend to the data recipient, directly and/or through the authorities of the third country concerned, the measures necessary to bring the data recipient into compliance with the requirements of the decision. In the latter case, if the recipient takes the necessary measures within a reasonable time, the case will be closed. If it fails to do so, the Commission will seek the agreement(3) of the Committee to the measures it proposes to take to revoke the presumption of “adequacy” for the recipient(s) concerned. The Commission’s decision will be binding on the Member States. The Commission will notify its decisions to the parties concerned.
National courts as an alternative forum for hearing complaints about non-compliance with an Article 25.6 decision
It is possible that complaints about the compliance of recipients of data transfers will be brought before national courts rather than before the data protection commissioner or other competent Member State authorities, despite this being often more costly and probably slower. This procedure might be chosen by data subjects from the start, or in order to contest the conclusion of the procedures described above.(4)
Member States courts hear such cases in accordance with their normal procedures, which guarantee a fair hearing to all parties. Where a court finds that a recipient of data transferred from the EU is not complying with the requirements of the decision, the party can seek to execute its judgement in the third country and oblige the recipient to make the changes necessary to comply, but the court cannot require transfers of data to be blocked, unless exceptional circumstances corresponding to those set out in the Article 25.6 decision justify such action. The Member State authorities concerned notify the matter to the Commission if they consider action to be necessary to stop data flows. The Commission initiates formal procedures in the Article 31 Committee.
In the exceptional case where provisional measures are taken at the national level, the fact will be notified immediately to the Commission which will itself immediately inform the members of the Article 31 Committee and the authorities of the third country concerned. [To be completed. Further research needed on the case where the provisional measures are taken by a court.]
B. Challenges to the Article 25.6 decision
The decision that the protection provided by a particular law or set of rules or principles in a third country is “adequate” might be challenged on grounds of substance or of procedure. Two broad possibilities exist for such challenges:
-- First, a Member State or another EU institution might challenge the legitimacy of the Commission’s decision before the European Court of Justice under Article 173 of the Treaty. All Article 25.6 decisions will be taken with the support of at least a qualified majority of votes in the Article 31 Committee, but such a challenge cannot be excluded. The Commission would in all cases appear before the Court to defend its decision(s). If the Court finds that a decision infringes Community law, in particular the Directive, or involves a misuse of powers, the decision would be declared void, under Article 174 of the Treaty.
· Second, an individual or group of individuals might claim that their interests were prejudiced by transfers, not because the recipient had failed to comply with the rules that were accepted as adequate, but because the rules themselves did not provide adequate protection. Such an action could be initiated in Member State courts. A Member State court could either uphold the Commission’s decision, or – if it were convinced that the decision was not legal – refer the matter to the European Court of Justice for a ruling under Article 177 of the Treaty. The European Court (and only the European Court) can declare a Commission decision to be void.
Endnotes