3 - The Role of Proportionality in Assessing Trans-Atlantic Flows of Personal Data

Summary

INTRODUCTION

Security and law enforcement agencies have become reliant on the mass collection and analysis of data, especially personal data or potentially personal data, as an investigative tool, and oft en as a tool of first recourse The mass collection and processing of data is, moreover, notionally independent of the geographical or legal jurisdiction in which the data originates These evolving practices give rise to considerable difficulties in determining the appropriate balance between national security and law enforcement objectives, on the one hand, and the protection of fundamental rights, on the other Under the law of the European Union (the EU), the principle of proportionality is the single most important legal concept in establishing the balance between public interests, especially the interest in national security, and the fundamental rights to privacy and data privacy There are, nevertheless, significant complexities – both conceptual and practical – and unresolved issues, in satisfactorily applying this contested principle to rapidly changing social and technological circumstances, such as surveillance practices These difficulties are exacerbated where surveillance practices cut across legal borders, including where data is transferred from one legal territory to another, such as occurs with trans-Atlantic flows of personal data.

In Maximillian Schrems v Data Protection Commissioner (‘Schrems’), the Court of Justice of the European Union (CJEU) ruled that the Commission decision on the Safe Harbour Agreement, which effectively authorised flows of personal data from the EU to the US, was invalid The Court invalidated the decision on the basis that, contrary to Art 25(1) of the 1995 Data Protection Directive (DPD), the agreement failed to provide an adequate level of protection for personal data Underpinning this conclusion, however, were concerns with the disproportionate mass and indiscriminate collection and access to personal data (including data originating in the EU) by US intelligence agencies, as revealed by the whistle-blower, Edward Snowden While these US practices complied with the Safe Harbour Agreement, the Court, in effect, held that such widespread, unconstrained surveillance would breach the fundamental rights to privacy and data privacy guaranteed by EU law which, under CJEU jurisprudence, must be protected to a ‘high level’ .