Tag the Court of Justice

Whilst the Court of Justice alone has jurisdiction to declare an EU act invalid, where a claim is lodged with the national supervisory authorities they may, even where the Commission has adopted a decision finding that a third country affords an adequate level of protection of personal data, examine whether the transfer of a persons data to the third country complies with the requirements of the EU legislation of the protection of that data and, in the same way as the person concerned, bringing the matter before the national courts, in order that the national courts make a reference for a preliminary ruling for the purpose of examination of that decisions validity. The Data Protection Directive provides that the transfer of personal data to a third country may, in principle, take place only if that third country ensures an adequate level of protection of the data. The directive also provides that the Commission may find that a third country ensures an adequate level of protection by reason of its domestic law or its international commitments. Finally, the directive provides that each Member State is to designate one or more public authorities responsible for monitoring the application within its territory of the national provisions adopted on the basis of the directive. Maximillian Schrems, an Australian citizen, has been a Facebook member user since 2008. As in the case with other subscribers residing in the EU, some or all the data provided by Mr. Schrems to Facebook is transferred from Facebooks Irish subsidiary to servers located in the United States, where it is processed. Mr. Schrems lodged a complaint with the Irish supervisory authority taking the view that, in the light of the revelations made in 2013 by Edward Snowden concerning the activities o the United States intelligence services ( in particular the National Security Agency), the law and practice of the United States do not offer sufficient protection against surveillance by the public authorities of the data transferred to that country. The Irish authority rejected the complaint, on the ground, in particular, that in a decision of 26 July 2000 the Commission considered that, under the ˜safe harbour scheme, the United States ensures an adequate level of protection of the personal data transferred. The High Court of Ireland, before which the case has been brought, wishes to ascertain whether that Commission decision has the effect of preventing a national supervisory authority from investigating a complaint alleging that the third country does not ensure an adequate level of protection and, where appropriate, from suspending the contested transfer of data. National security, public interest and law enforcement requirements of the United States prevail over the safe harbour scheme, so that United States undertakings are bound to disregard, without limitation, the protective rules laid down by that scheme where they conflict with such requirements. The United States safe harbour scheme thus enables interference, by united States public authorities, with the fundamental rights of persons, and the Commission decision does not refer either to the existence, in the United States, of rules intended to limit any such interference or to the existence of effective legal protection against the interference. As regards a level of protection essentially equivalent to the fundamental rights and freedoms guaranteed within the EU, the Court finds that, under EU law, legislation is not limited to what is strictly necessary where is authorities, on a generalized basis , storage of all the personal data of all the persons whose data is transferred from the EU to the United States without any differentiation, limitation or exception being made in the light of the objective pursued and without an objective criterion being laid down for determining the limits of the access of the public authorities to the data and of its subsequent use. The Court adds the legislation permitting the public authorities to have access on a generalized basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life. Likewise, the Court observes the legislation not providing for any possibility for an individual to pursue legal remedies in order to have access to personal data relating to him, or to obtain the rectification or erasure of such data, compromises the essence of the fundamental right to effective judicial protection, the existence of such a possibility being inherent in the existence of the rule of law. Finally, the Courts finds that the Safe Harbour decision denies the national supervisory authorities their powers where a person calls into question whether the decision is compatible with the protection of the privacy and the fundamental rights and freedoms of individuals. The Court holds that the Commission did not have the competence to restrict the national supervisory authoritys powers in that way. For all those reasons, the Court declares the Safe Harbour Decision invalid. This judgment has the consequence that the Irish supervisory authority is required to examine Mr. Schrems complaint with all due diligence and, at the conclusion of its investigation, is to decide whether, pursuant to the directive, transfer of the data of Facebooks European subscribers to the United States should be suspended on the ground that the country does not afford an adequate level of protection of personal data.

Tag the Court of Justice

EUCJ declares that the Commissions US Safe Harbour Decision is invalid

CJEU: The Romanian State cannot exempt from the tax vehicles already registered and in respect of which a tax previously in force but found to be incompatible with EU law has been paid

According to the ECJ, national courts can rule on the unfairness of interest and commission risk of credit agreements