47
nevertheless process data related to EU residents (Article 3 GDPR;
Christopher Kuner 2015; Svantesson 2015; de Hert and Czerniawski
2016). In the US, data privacy statutes do not have a similar extraterritorial effect.
Lastly, in contrast to US legislation, EU data protection law also regulates international data transfers. Article 44 GDPR establishes that personal data can freely circulate among member states, but cannot be
transferred to third countries unless they provide an adequate level of protection. Article 48 of the GDPR even explicitly prohibits any data disclosure requested by a foreign authority, unless based on an international
treaty. The European Commission can adopt a decision certifying the
adequacy of the level of data protection of a third country (Article 45
GDPR). Countries like Israel, Argentina, Uruguay, and recently Japan,
have been certified as providing an adequate level of protection (European
Commission 2019). Conversely, the Commission has only issued a partial
adequacy decision in relation to the United States.
In 2000, the European Commission adopted Decision 2000/520/EC
(so called “Safe Harbor”) which established the adequacy of US data protection rules: in particular, US corporations that are subject to the supervision of the Federal Trade Commission could self-certify their respect of
the Safe Harbor Principles (Greer 2011). However, in the aftermath of the
Snowden revelations about the existence of US mass surveillance programmes, this decision was invalidated by the European Court of Justice
(ECJ). In the Schrems case (C-362/14), decided in 2015, the ECJ held
that the Commission, by certifying the adequacy of the Safe Harbor
scheme, failed to take into account the power of US law enforcement
authorities to access on a generalised basis EU data transferred under the
Safe Harbor scheme (Cole and Fabbrini 2016; Padova 2016). According
to the ECJ, such a model of bulk surveillance cannot be tolerated as it
compromises the essence of the right to privacy protected by the EU
Charter of Fundamental Rights (para 94 of the judgment; see Ojanen 2017).
The Safe Harbor scheme was promptly replaced by the so-called
“Privacy Shield”, which was negotiated between the European Commission
and the US authorities in 2016 and entered into force with Decision
2016/1250. The new system is very similar to the Safe Harbor in terms of
functioning, but has been accompanied by a series of further guarantees,
especially in relation to the individual right of redress (Tracol 2016; cf.
Bender 2016). Moreover, after the Snowden revelations, the US started a
progressive revision of its law enforcement legislation (Cole and Fabbrini
3 COMPETING JURISDICTIONS: DATA PRIVACY ACROSS THE BORDERS
nevertheless process data related to EU residents (Article 3 GDPR;
Christopher Kuner 2015; Svantesson 2015; de Hert and Czerniawski
2016). In the US, data privacy statutes do not have a similar extraterritorial effect.
Lastly, in contrast to US legislation, EU data protection law also regulates international data transfers. Article 44 GDPR establishes that personal data can freely circulate among member states, but cannot be
transferred to third countries unless they provide an adequate level of protection. Article 48 of the GDPR even explicitly prohibits any data disclosure requested by a foreign authority, unless based on an international
treaty. The European Commission can adopt a decision certifying the
adequacy of the level of data protection of a third country (Article 45
GDPR). Countries like Israel, Argentina, Uruguay, and recently Japan,
have been certified as providing an adequate level of protection (European
Commission 2019). Conversely, the Commission has only issued a partial
adequacy decision in relation to the United States.
In 2000, the European Commission adopted Decision 2000/520/EC
(so called “Safe Harbor”) which established the adequacy of US data protection rules: in particular, US corporations that are subject to the supervision of the Federal Trade Commission could self-certify their respect of
the Safe Harbor Principles (Greer 2011). However, in the aftermath of the
Snowden revelations about the existence of US mass surveillance programmes, this decision was invalidated by the European Court of Justice
(ECJ). In the Schrems case (C-362/14), decided in 2015, the ECJ held
that the Commission, by certifying the adequacy of the Safe Harbor
scheme, failed to take into account the power of US law enforcement
authorities to access on a generalised basis EU data transferred under the
Safe Harbor scheme (Cole and Fabbrini 2016; Padova 2016). According
to the ECJ, such a model of bulk surveillance cannot be tolerated as it
compromises the essence of the right to privacy protected by the EU
Charter of Fundamental Rights (para 94 of the judgment; see Ojanen 2017).
The Safe Harbor scheme was promptly replaced by the so-called
“Privacy Shield”, which was negotiated between the European Commission
and the US authorities in 2016 and entered into force with Decision
2016/1250. The new system is very similar to the Safe Harbor in terms of
functioning, but has been accompanied by a series of further guarantees,
especially in relation to the individual right of redress (Tracol 2016; cf.
Bender 2016). Moreover, after the Snowden revelations, the US started a
progressive revision of its law enforcement legislation (Cole and Fabbrini
3 COMPETING JURISDICTIONS: DATA PRIVACY ACROSS THE BORDERS