---------- Forwarded message ---------- From: La Quadrature du Net <[email protected]> Date: Thu, Apr 7, 2016 at 11:08 PM Subject: [opennetcoalition] Open Letter from the OLN to the WP29 and the European Parliament on the Privacy Shield To: [email protected] Press Release *Tags :* PRIVACY SHIELD, SAFE HARBOR, WP29, PRIVACY, DATA PROTECTION La Quadrature du Net — For immediate release Permanent link: https://www.laquadrature.net/en/open-letter-oln-wp29-privacy-shield <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=510&qid=46114> Open Letter from the OLN to the WP29 and the European Parliament on the Privacy Shield Paris, 7 April 2016 — *The Privacy Shield, a framework for personal data transfers towards US-based companies, is currently under negotiation. This new agreement follows the invalidation of the Safe Harbor by the European Court of Justice (ECJ), who ruled that it did not uphold a substantially equivalent protection for personal data of people protected under European law, and suggested new measures to address it. Since the draft Privacy Shield does not take these measures into account, the resulting agreement is bound to reduce the fundamental rights of Europeans.* Joint communiqué from the *Observatoire des Libertés et du Numérique* (Freedoms and Digital Observatory)1 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=511&qid=46114> Dear Mrs President, Dear Mr President, Dear Members of the LIBE Committee, Following its signature by the European Commission in 2000, the Safe Harbor agreement2 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=512&qid=46114> was supposed to certify that transaltantic companies complied with data protection standards of similar effect as the European standards, despite the scepticism from the WP29 especially regarding US law. Edward Snowden's revelations in 20133 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=513&qid=46114> showed the world the scope of US surveillance using the Patriot Act, concerning data processed and hosted on their territory (or on foreign ground) by international companies. Consequently, on the 6 October 2015, the ECJ has invalidated the Safe Harbor with its Schrems ruling4 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=514&qid=46114>. This ruling set the basis for a new agreement, by laying down the minimum criteria that the Commission should follow. Unfortunately, the new agreement's draft, called the Privacy Shield5 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=515&qid=46114>, does not include all the guarantees deemed necessary by the ECJ. If signed as it is today, the agreement would joepardise the protection of fundamental rights to data protection and to privacy, required by the Court of justice. In particular, the ECJ highlighted the following points: - the need that such an agreement should foresee the*"possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasureof such data"*6 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=516&qid=46114>. This possibility does not exist in the draft agreement, that merely bemoans the weakness of existing legal remedies7 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=517&qid=46114>, or merely refers to some US laws allowing access requests for information from US federal agencies, without the possibility for rectification8 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=518&qid=46114>. To address this lacuna, the draft agreement should at least lay down the *specific conditions* for national data protection authorities to suspend transfers 9 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=519&qid=46114> ; - such possibility must be accompanied by "the *existence of effective legal protection against interference*"10 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=520&qid=46114>. In theory, the draft Privacy Shield sets up a ombudsman in the US to deal with requests by European authorities investigating surveillance cases. But in practice, its independence has been called into question11 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=521&qid=46114> by the European Ombudsman12 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=522&qid=46114>. Furthermore, the competences of the Ombudsman should not be limited to surveillance; - the Court's *fundamental opposition to mass surveillance*. The Court has also required that the soon-to-be agreement would not allow "public authorities to have access on a generalised basis to the content of electronic communications"13 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=523&qid=46114>, nor the retention "on a generalised basis, storage of all the personal data of all the persons whose data has been transferred from the European Union to the United States"14 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=524&qid=46114>. However, the commitments made by the US refer to six15 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=525&qid=46114> purposes allowing them to keep on proceeding to the undiscriminated collection of data from users of services such as those provided by Google or Facebook. The Commission explicitly underlines in the draft of the agreement that access to collected data will be strictly limited to specific and legitimate national defence purposes16 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=526&qid=46114>. However, this is not reflected at all in any law or political commitment made by the US. The ECJ had invalidated the Safe Harbor, for it did not protect the data transferred to the US from Europe against American mass surveillance. But the European Commission is about to accept a new agreement that does not provide better protection of Europeans' personal data. Similarly, the European Commission refused to investigate the national security policies of Member States in terms of mass data collection, thus going against all decisions of the ECJ17 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=527&qid=46114> . Finally, the *legal value* of this text is only relative, and largely based on political promises that the up-coming presidential elections might sweep away18 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=528&qid=46114>, as some MEPs pointed out during the expert hearing at the European Parliament of 17 March. Therefore, this agreement, that is not ratified by the US Congress, gives absolutely no guarantees to people whose personal data is being transferred to the US. *L'Observatoire des Libertés et du Numérique (OLN) supports the reservations made by the WP29 and the European Parliament, and calls to maintain the pressure on the European Commission in order to incite it to produce a legal analysis on the compliance of the draft with existing European legislation on data protection19 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=529&qid=46114>. On this basis, the OLN calls for resuming negotiations with US authorities in order to properly examine the compliance of existing transfers.* *This draft agreement is dangerous and does not live up to the standards of the protection of fundamental rights in Europe. As it is now, there is no doubt that the text would once again be challenged and invalidated by the ECJ, resulting in a legal instability that undermines trust in the digital economy. Going back to the negotiation table is hence crucial for the protection of our fundamental rights!* - 1. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=530&qid=46114> The *Observatoire des Libertés et du Numérique* includes: Amnesty International France <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=531&qid=46114>, the Cecil <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=532&qid=46114>, Creis-Terminal <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=533&qid=46114>, the Human Rights League <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=534&qid=46114>, the *Syndicat de la magistrature* <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=535&qid=46114>, the *Syndicat des Avocats de France* <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=536&qid=46114> and La Quadrature du Net. - 2. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=537&qid=46114> The decision of the 20 July 2000 by the European Commission: http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32000D0520&from... <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=538&qid=46114> - 3. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=539&qid=46114> Article in French newspaper Le Monde on Snowden: https://www.laquadrature.net/en/node/8925 <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=540&qid=46114> - 4. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=541&qid=46114> To read the decision see: http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pageIn... <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=542&qid=46114> - 5. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=543&qid=46114> See the draft of the Privacy Shield: http://ec.europa.eu/justice/data-protection/files/privacy-shield-adequacy-de... <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=544&qid=46114> - 6. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=545&qid=46114> Paragraph 95 of the above mentioned Schrems ruling. - 7. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=546&qid=46114> Paragraphs 98 and 99 of the aforementioned draft Privacy Shield. - 8. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=547&qid=46114> Paragraphs 96 to 104 of the draft Privacy Shield. - 9. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=548&qid=46114> Mentioned in point 44 of the draft agreement - 10. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=549&qid=46114> Paragraph 89 of the Schrems ruling. - 11. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=550&qid=46114> http://www.ombudsman.europa.eu/en/resources/otherdocument.faces/en/64157/htm... <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=551&qid=46114> - 12. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=552&qid=46114> Indeed, Annex III of the draft Privacy Shield establishes the mandate of the Ombudsman, but does not include the obligation to inform the European authority whether the individual who requested the investigation is indeed under surveillance or not. By the same token, it does not include an obligation to inform the authority on how the violation against the natural person's privacy was ended, in case of illegal surveillance. - 13. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=553&qid=46114> Paragraph 94 of the Schrems ruling. - 14. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=554&qid=46114> Paragraph 93 of the Schrems ruling. - 15. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=555&qid=46114> Paragraph 61 of the draft Privacy Shield. - 16. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=556&qid=46114> Paragraph 63 of the draft Privacy Shield. - 17. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=557&qid=46114> Digital Rights ruling ( http://curia.europa.eu/juris/document/document.jsf?text=&docid=150642&pa... <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=558&qid=46114> ) and Schrems ruling ( http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pa... <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=542&qid=46114> ). - 18. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=559&qid=46114> Video of D. Trump on his first decisions if he was to be elected president of the USA: https://www.youtube.com/watch?v=8HmLxrbIrjc&t=0m9s <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=560&qid=46114> - 19. <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=561&qid=46114> This analysis should be carried out in light of the "Safe Harbor" ruling (already mentioned), of the 1995 Directive on Data Protection, of the upcoming Regulation on Data Protection, and of the Charter of Fundamental Rights of the EU. About La Quadrature du Net La Quadrature du Net is an advocacy group that defends the rights and freedoms of citizens on the Internet. More specifically, it advocates for the adaptation of French and European legislations to respect the founding principles of the Internet, most notably the free circulation of knowledge. In addition to its advocacy work, the group also aims to foster a better understanding of legislative processes among citizens. Through specific and pertinent information and tools, La Quadrature du Net hopes to encourage citizens' participation in the public debate on rights and freedoms in the digital age. La Quadrature du Net is supported by French, European and international NGOs including the Electronic Frontier Foundation, the Open Society Institute and Privacy International. List of supporting organisations: https://www.laquadrature.net/en/they-support-la-quadrature-du-net <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=562&qid=46114> Press contact and press room [email protected] – +33 (0)972 294 426 https://www.laquadrature.net/en/press-room <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=563&qid=46114> *To unsubscribe, click here <http://www.laquadrature.net/civicrm/mailing/optout?reset=1&jid=152&qid=46114&h=1b8b9b8bba9122dd>* *La Quadrature du Net60, rue des OrteauxParis, 75020* _______________________________________________ Opennetcoalition mailing list [email protected] https://lists.laquadrature.net/cgi-bin/mailman/listinfo/opennetcoalition -- Check out the Commons Transition Plan here at: http://commonstransition.org P2P Foundation: http://p2pfoundation.net - http://blog.p2pfoundation.net <http://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation>Updates: http://twitter.com/mbauwens; http://www.facebook.com/mbauwens #82 on the (En)Rich list: http://enrichlist.org/the-complete-list/