[P2P-F] Fwd: [opennetcoalition] Open Letter from the OLN to the WP29 and the European Parliament on the Privacy Shield

Thu Apr 7 22:32:49 CEST 2016

---------- Forwarded message ----------
From: La Quadrature du Net <contact at laquadrature.net>
Date: Thu, Apr 7, 2016 at 11:08 PM
Subject: [opennetcoalition] Open Letter from the OLN to the WP29 and the
European Parliament on the Privacy Shield
To: opennetcoalition at laquadrature.net

Press Release

*Tags :* PRIVACY SHIELD, SAFE HARBOR, WP29, PRIVACY, DATA PROTECTION

La Quadrature du Net — For immediate release

Permanent link:
https://www.laquadrature.net/en/open-letter-oln-wp29-privacy-shield
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=510&qid=46114>
Open Letter from the OLN to the WP29 and the European Parliament on the
Privacy Shield

Paris, 7 April 2016 — *The Privacy Shield, a framework for personal data
transfers towards US-based companies, is currently under negotiation. This
new agreement follows the invalidation of the Safe Harbor by the European
Court of Justice (ECJ), who ruled that it did not uphold a substantially
equivalent protection for personal data of people protected under European
law, and suggested new measures to address it. Since the draft Privacy
Shield does not take these measures into account, the resulting agreement
is bound to reduce the fundamental rights of Europeans.*
Joint communiqué from the *Observatoire des Libertés et du Numérique*
(Freedoms and Digital Observatory)1
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=511&qid=46114>

Dear Mrs President,
Dear Mr President,
Dear Members of the LIBE Committee,

Following its signature by the European Commission in 2000, the Safe Harbor
agreement2
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=512&qid=46114>
was supposed to certify that transaltantic companies complied with data
protection standards of similar effect as the European standards, despite
the scepticism from the WP29 especially regarding US law. Edward Snowden's
revelations in 20133
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=513&qid=46114>
showed the world the scope of US surveillance using the Patriot Act,
concerning data processed and hosted on their territory (or on foreign
ground) by international companies.

Consequently, on the 6 October 2015, the ECJ has invalidated the Safe
Harbor with its Schrems ruling4
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=514&qid=46114>.
This ruling set the basis for a new agreement, by laying down the minimum
criteria that the Commission should follow.

Unfortunately, the new agreement's draft, called the Privacy Shield5
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=515&qid=46114>,
does not include all the guarantees deemed necessary by the ECJ. If signed
as it is today, the agreement would joepardise the protection of
fundamental rights to data protection and to privacy, required by the Court
of justice.

In particular, the ECJ highlighted the following points:

   - the need that such an agreement should foresee the*"possibility for an
   individual to pursue legal remedies in order to have access to personal
   data relating to him, or to obtain the rectification or erasureof such
   data"*6
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=516&qid=46114>.
   This possibility does not exist in the draft agreement, that merely bemoans
   the weakness of existing legal remedies7
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=517&qid=46114>,
   or merely refers to some US laws allowing access requests for information
   from US federal agencies, without the possibility for rectification8
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=518&qid=46114>.
   To address this lacuna, the draft agreement should at least lay
down the *specific
   conditions* for national data protection authorities to suspend transfers
   9
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=519&qid=46114>
   ;
   - such possibility must be accompanied by "the *existence of effective
   legal protection against interference*"10
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=520&qid=46114>.
   In theory, the draft Privacy Shield sets up a ombudsman in the US to deal
   with requests by European authorities investigating surveillance cases. But
   in practice, its independence has been called into question11
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=521&qid=46114>
   by the European Ombudsman12
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=522&qid=46114>.
   Furthermore, the competences of the Ombudsman should not be limited to
   surveillance;
   - the Court's *fundamental opposition to mass surveillance*. The Court
   has also required that the soon-to-be agreement would not allow "public
   authorities to have access on a generalised basis to the content of
   electronic communications"13
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=523&qid=46114>,
   nor the retention "on a generalised basis, storage of all the personal data
   of all the persons whose data has been transferred from the European Union
   to the United States"14
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=524&qid=46114>.
   However, the commitments made by the US refer to six15
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=525&qid=46114>
   purposes allowing them to keep on proceeding to the undiscriminated
   collection of data from users of services such as those provided by Google
   or Facebook. The Commission explicitly underlines in the draft of the
   agreement that access to collected data will be strictly limited to
   specific and legitimate national defence purposes16
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=526&qid=46114>.
   However, this is not reflected at all in any law or political commitment
   made by the US.

The ECJ had invalidated the Safe Harbor, for it did not protect the data
transferred to the US from Europe against American mass surveillance. But
the European Commission is about to accept a new agreement that does not
provide better protection of Europeans' personal data. Similarly, the
European Commission refused to investigate the national security policies
of Member States in terms of mass data collection, thus going against all
decisions of the ECJ17
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=527&qid=46114>
.

Finally, the *legal value* of this text is only relative, and largely based
on political promises that the up-coming presidential elections might sweep
away18
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=528&qid=46114>,
as some MEPs pointed out during the expert hearing at the European
Parliament of 17 March. Therefore, this agreement, that is not ratified by
the US Congress, gives absolutely no guarantees to people whose personal
data is being transferred to the US.

*L'Observatoire des Libertés et du Numérique (OLN) supports the
reservations made by the WP29 and the European Parliament, and calls to
maintain the pressure on the European Commission in order to incite it to
produce a legal analysis on the compliance of the draft with existing
European legislation on data protection19
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=529&qid=46114>.
On this basis, the OLN calls for resuming negotiations with US authorities
in order to properly examine the compliance of existing transfers.*

*This draft agreement is dangerous and does not live up to the standards of
the protection of fundamental rights in Europe. As it is now, there is no
doubt that the text would once again be challenged and invalidated by the
ECJ, resulting in a legal instability that undermines trust in the digital
economy. Going back to the negotiation table is hence crucial for the
protection of our fundamental rights!*

   - 1.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=530&qid=46114>
   The *Observatoire des Libertés et du Numérique* includes: Amnesty
   International France
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=531&qid=46114>,
   the Cecil
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=532&qid=46114>,
   Creis-Terminal
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=533&qid=46114>,
   the Human Rights League
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=534&qid=46114>,
   the *Syndicat de la magistrature*
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=535&qid=46114>,
   the *Syndicat des Avocats de France*
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=536&qid=46114>
   and La Quadrature du Net.
   - 2.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=537&qid=46114>
   The decision of the 20 July 2000 by the European Commission:
   http://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32000D0520&from=EN
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=538&qid=46114>
   - 3.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=539&qid=46114>
   Article in French newspaper Le Monde on Snowden:
   https://www.laquadrature.net/en/node/8925
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=540&qid=46114>
   - 4.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=541&qid=46114>
   To read the decision see:
   http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=293038
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=542&qid=46114>
   - 5.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=543&qid=46114>
   See the draft of the Privacy Shield:
   http://ec.europa.eu/justice/data-protection/files/privacy-shield-adequacy-decision_en.pdf
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=544&qid=46114>
   - 6.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=545&qid=46114>
   Paragraph 95 of the above mentioned Schrems ruling.
   - 7.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=546&qid=46114>
   Paragraphs 98 and 99 of the aforementioned draft Privacy Shield.
   - 8.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=547&qid=46114>
   Paragraphs 96 to 104 of the draft Privacy Shield.
   - 9.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=548&qid=46114>
   Mentioned in point 44 of the draft agreement
   - 10.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=549&qid=46114>
   Paragraph 89 of the Schrems ruling.
   - 11.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=550&qid=46114>
   http://www.ombudsman.europa.eu/en/resources/otherdocument.faces/en/64157/html.bookmark
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=551&qid=46114>
   - 12.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=552&qid=46114>
   Indeed, Annex III of the draft Privacy Shield establishes the mandate of
   the Ombudsman, but does not include the obligation to inform the European
   authority whether the individual who requested the investigation is indeed
   under surveillance or not. By the same token, it does not include an
   obligation to inform the authority on how the violation against the natural
   person's privacy was ended, in case of illegal surveillance.
   - 13.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=553&qid=46114>
   Paragraph 94 of the Schrems ruling.
   - 14.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=554&qid=46114>
   Paragraph 93 of the Schrems ruling.
   - 15.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=555&qid=46114>
   Paragraph 61 of the draft Privacy Shield.
   - 16.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=556&qid=46114>
   Paragraph 63 of the draft Privacy Shield.
   - 17.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=557&qid=46114>
   Digital Rights ruling (
   http://curia.europa.eu/juris/document/document.jsf?text=&docid=150642&pa...
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=558&qid=46114>
   ) and Schrems ruling (
   http://curia.europa.eu/juris/document/document.jsf?text=&docid=169195&pa...
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=542&qid=46114>
   ).
   - 18.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=559&qid=46114>
   Video of D. Trump on his first decisions if he was to be elected president
   of the USA: https://www.youtube.com/watch?v=8HmLxrbIrjc&t=0m9s
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=560&qid=46114>
   - 19.
   <http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=561&qid=46114>
   This analysis should be carried out in light of the "Safe Harbor" ruling
   (already mentioned), of the 1995 Directive on Data Protection, of the
   upcoming Regulation on Data Protection, and of the Charter of Fundamental
   Rights of the EU.

About La Quadrature du Net

La Quadrature du Net is an advocacy group that defends the rights and
freedoms of citizens on the Internet. More specifically, it advocates for
the adaptation of French and European legislations to respect the founding
principles of the Internet, most notably the free circulation of knowledge.

In addition to its advocacy work, the group also aims to foster a better
understanding of legislative processes among citizens. Through specific and
pertinent information and tools, La Quadrature du Net hopes to encourage
citizens' participation in the public debate on rights and freedoms in the
digital age.

La Quadrature du Net is supported by French, European and international
NGOs including the Electronic Frontier Foundation, the Open Society
Institute and Privacy International.

List of supporting organisations:
https://www.laquadrature.net/en/they-support-la-quadrature-du-net
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=562&qid=46114>
Press contact and press room

contact at laquadrature.net – +33 (0)972 294 426

https://www.laquadrature.net/en/press-room
<http://www.laquadrature.net/sites/all/modules/civicrm/extern/url.php?u=563&qid=46114>
*To unsubscribe, click here
<http://www.laquadrature.net/civicrm/mailing/optout?reset=1&jid=152&qid=46114&h=1b8b9b8bba9122dd>*

*La Quadrature du Net60, rue des OrteauxParis, 75020*

_______________________________________________
Opennetcoalition mailing list
Opennetcoalition at laquadrature.net
https://lists.laquadrature.net/cgi-bin/mailman/listinfo/opennetcoalition

-- 
Check out the Commons Transition Plan here at: http://commonstransition.org

P2P Foundation: http://p2pfoundation.net  - http://blog.p2pfoundation.net

<http://lists.ourproject.org/cgi-bin/mailman/listinfo/p2p-foundation>Updates:
http://twitter.com/mbauwens; http://www.facebook.com/mbauwens

#82 on the (En)Rich list: http://enrichlist.org/the-complete-list/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.ourproject.org/pipermail/p2p-foundation/attachments/20160408/052e83c7/attachment-0001.htm 