Live vom EuGH: „Europe vs. Facebook“

Heute findet die Anhörung vor dem EuGH in der Sache „Europe vs. Facebook“ in Luxemburg statt. Max Schrems twittert live aus dem Gerichtssaal. Der Jurist und Aktivist hatte im vergangenen Jahr beim Handelsgericht Wien eine Zivilklage gegen die irische Tochter des US-Konzerns Facebook eingereicht, die ihren Weg bis nach Luxemburg gemacht hat. Mit seiner freundlichen Genehmigung spiegeln wir seine Tweets.

#CJEU Hearing on #SafeHarbour / #PRISM just starting. #EUdataP — 09:37

#USembassy at the #CJEU hearing.. apparently the the #US has calles up all the member states yesterday… #SafeHarbor #PRISM #EUDataP — 9:40

Noel Travers for Mr Schrems (me) up now. #CJEU #SafeHarbour #EUdataP #PRISM — 9:41

We mainly rely on @DRIalerts case law. If data retention was illegal, #PRISM has to be an even worse violation of Article 8. #CJEU — 9:43

Data Retention: Only meta data, PRISM includes content data. #CJEU — 09:43

Validity of #SafeHarbor contested. #CJEU has explicitly asked this in written questions before the hearing. #EUDataP — 9:47

#SafeHarbour are invalid on two levels: #Material protection in Art 25(2) #Formal requirements (law, agreement) in Art 25(6) #CJEU #EUDataP – 9:48

We say Article 3(1)(b) of the #SafeHarbour does not apply, as the „Principles“ are not broken, because #FISA is excempt from it. #CJEU — 9:50

.@EU_Commission argues there is only #Privacy if there is „grave (secondary) harm“ as foreseen in Article 3(1)(b). #CJEU #SafeHarbor — 9:51

Article 25(6) requires „international comittment“ or „domestic law“. #SafeHarbor is nothing like that, but merely a test on a webpage. #CJEU — 9:52

.@EU_Commission has found for 15 years that #SafeHarbor is needs fixing. At the same time the COM has done nothing. #EUDataP #CJEU #PRISM — 9:56

Finally: #SafeHarbour is a privilege for US companies, not the end of EU-US data transfers, but puts US companies. #EUDataP #CJEU — 9:57

Irish #DPC is now up. Main „theme“: Limits of the DPC. #CJEU #EUdataP #SafeHarbor — 9:58

#DPC cannot strike down a law, EU decision. Is limited by evidence. — 9:58

#DPC: Facts not argued, used of Mr Schrems data by the NSA not argued. — 10:00

Court did not ask validity. #SafeHarbor is not on the table. #DPC asks the #CJEU to respect limits of the case. — 10:01

Irish #DPC argues for #SafeHarbor and the #USA. #SafeHarbor is a compromise. #CJEU — 10:01

DPC: EU-COM must negotiate or adapt it. This is political and best dealt with by the COM. #EUDataP #CJEU — 10:03

#DPC brings up wrong facts and facts that were not found the Irish court. #CJEU #SafeHarbor — 10:03

#DPC argues mainly on #evidence. Procedurally this is already determined by the Irish court. #CJEU #SafeHarbor — 10:05

#DPC’s argument fully for the #US, #SafeHarbor and the @EU_Commission. I thought they are a data protection authority.. ;) #CJEU — 10:06

@DRIalerts now up at the #CJEU on #SafeHarbor. — 10:06

Article 3(1)(b) of #SafeHarbor would not be a solution. #CJEU —  10:11

#DRI: On Courts written Question: #EDPS may conduct inquiries. #SafeHarbor — 10:12

#CJEU: Three questions, with three subquestions were send to the parties before the hearing. #EUdataP #SafeHarbor — 10:12

#DRI: @EU_Commission has said many times that #SafeHarbor is not adequate in reviews. #CJEU — 10:14

No effective protection under #SafeHarbor as @TRUSTe and alike are not an independent review body. #CJEU — 10:16

#DRI: Formal requirements of Article 25(6) not fulfilled, only an ad-hoc certification. #CJEU — 10:17

#DRI: Written question by the Court: Did the COM have to suspend #SafeHarbor. #CJEU —  10:19

#DRI: EDPS could help collaborating with national #DPAs to not make sure coherence. #CJEU — 10:21

#DRI: EDPS could help collaborating with national #DPAs to not make sure coherence. #CJEU — 10:21

Ireland: #Validity not brought up by the Irish court. — 10:22

#Ireland: #SafeHarbor is binding for the member states. #CJEU — 10:22

Ireland: s 11 of the #DPA is consequently an implementation of EU law. #CJEU — 10:23

It is for the COM to make decision on the „adequacy“ under Article 25. #DPC must act within the limits of the law. #CJEU — 10:24

For everyone that argues validity was never argued: http://t.co/OxEExTztcp [the original complaint] #CJEU #SafeHarbor — 10:25

#END of the tweets for now. #CJEU. #SafeHarbor It is impossible to tweet everything effectively. Sorry.. ;( — 10:26

Highlights will stll be shared. #CJEU #SafeHarbor — 10:26

#Belgium up now.. #CJEU — 10:36

Chapter of Directive 95/46: Rules on transfers are not overriding the rules on the independent #DPAs. #CJEU— 10:37

#Belgium: COM decisions are binding. Idea of #SafeHarbor is to have a EU-wide rule. #CJEU—10:38

Belgium: Circumstances changed for #SafeHarbor. No explicit duty to review SH, but general obligation. #CJEU— 10:39

Belgium: If there is a fundamental violation of fundamental rights, the COM decision cannot preclude the #DPA to take action. #CJEU— 10:40

Belgium: #PRISM is a manifest violation of fundamental rights. If #DPAs is are deprived of action this is not implemented.—10:41

BE: Article 3 of #SafeHarbor allows to suspend data flows. #CJEU—10:42

BE: Article 3 – Grave harm is satisfied if Article 8 CFR is violated. Article 3 if asked for „secondary harm“ is against Art 8. #CJEU—10:44

BE: If #DPC is unable to take action, this would be a violation of Art 8 #CFR. #CJEU— 10:45

#Austria up next. #CJEU— 10:45

AT: #SafeHarbor not direclty enforceable in the MS. Art 25: take „measures“, not blindly follow it. #CJEU—10:46

Positive adequacy decision can be transformed in different ways by the MS. (copy into nat, law, or reference) #CJEU #SafeHarbor— 10:47

AT: There is no duty by the COM to evaluate #SafeHarbor, but there is such a duty under general EU laws. #CJEU— 10:48

AT: COM has a duty to evaluate, but has not done the job properly. #CJEU #SafeHarbor—10:49

AT: Compared to Ireland, AT thinks that there has to be way to suspend flows. #CJEU— 10:50

AT: „We expressly contest the view of Ireland“ – Article 3 is an „emergency exit“, any may be used. #CJEU—10:50

AT: Article 3 „emergency exit“ too narrow, given the four requirements. Article 3 allows basically no independent review. #CJEU—10:51

Again: Happy to pay my taxes in #Austria right now.. ;) #CJEU #SafeHarbor— 10:52

AT: Again: vs. Ireland: This is not about expanding EU laws to the US, but providing basic rights. #CJEU— 10:53

AT: Judicial review key point (again vs. Ireland), cannot just be lower… #CJEU #SafeHarbor— 10:54

AT: the #SafeHarbor has a very complicated structure, even for experts. AT refers to the our expert paper by Prof. Boehm. #CJEU—10:55

AT: #SafeHarbor is a „negative decision“. „Safe Harbor is just a safe harbor for data pirates“. #LOL #CJEU—10:56

AT: #SafeHarbor was never legal. The decision has to be invalidated, maybe with a grace period. #CJEU—10:57

POLAND up next. #CJEU— 10:58

PL: #SafeHarbor has to be interpreted under the Directive – as far as possible. #CJEU—10:59

PL: National #DPAs cannot be prevented from taking action. #CJEU #SafeHarbor—11:00

PL: If the #SafeHarbor is not in line with the Directive, it cannot be applied. Things can be interpreted accordingly.,#CJEU— 11:01

PL: A commission decision is not incontestable. There has to be a security mechanism. #CJEU #SafeHarbor— 11:02

PL: The list of cases when data flows can be suspended can be defined as in Art 3 of the #SafeHarbor, but not in such a way. #CJEU— 11:03

PL: National #DPA has to have an option to suspend data flows. #CJEU #SafeHarbor—11:04

PL: The will of the EU legislature Art 25(2): Overall concept. So judicial review in the US is necessary, ref. to Art29WP #CJEU #SafeHarbor— 11:05

PL: Suspension of flows under #SafeHarbor must be possible, when fundamental rights are infringed. #CJEU— 11:08

#CJEU: Hearing adjured for a couple minutes. #SafeHarbor— 11:09

#CJEU hearing resumes. #SafeHarbor / #PRISM / #Facebook Slovenia next.—11:26

SI: Member States must refrain from any action that undermines #SafeHarbor. But this does not mean that the #DPC is prevented to take action — 11:28

SI: #SafeHarbor is an implementing act of Dir 95/46. This means that DPAs are governed by higher ranking Directive rules. #CJEU—11:29

SI: Art 25 „adequacy“ is not just laws, but overall thing. Judaical review on EU standards are relevant #CJEU— 11:30

SI: #SafeHarbor was initially compliant in 2000, because MS have not sued the COM overit [sic]. #CJEU— 11:31

SI: On Art 3 in SH: No overly great burden on citizens to proof surveillance. #CJEU—11:32

SI: EDPS cannot interevene here (written court question). #CJEU —11:33

UK next… *hurray* ;) #CJEU #SafeHarbor— 11:33

UK on Q1.1: „Adequacy Decisions“ have to be legally implemented by MS. (rather uncontested matter) #CJEU #SafeHarbor— 11:34

UK: It’s the COM job to do adequacy findings. International data flows and trade important. #SafeHarbor #CJEU— 11:36

UK: Q1.2: #DPAs are fully bound with adequacy decisions. #CJEU #SafeHarbor—11:37

UK: Binding nature of #SafeHarbor does not mean DPA cannot suspension under Article 3(1)(b) – see Article 2 of SH as well. #CJEU #EUdataP—11:39/a>

UK: Adequacy in a country up for the COM. Sicking to the #SafeHarbor is subject to DPAs – not „absolute“. #CJEU— 11:40

Q by the #CJEU: Can the #EPDS take action? No. EDPS only for internal processing by the Union, not political decisions. #SafeHarbor— 11:42

UK: There must be effective redress this is done under the #SafeHarbor. Review in the EU ist also available on the „transfert“ itself. #CJEU— 11:44

UK: #SafeHarbor fully „adequate“. COM communications on „inadequacy“, but no need to take action. #CJEU— 11:45

UK: #CJEU is not in place to understand the facts. Striking down #SafeHarbor would have adverse effects on trade.— 11:47

UK: Fragmentation is a problem. #CJEU— 11:48

Next the @Europarl_EN . #CJEU #SafeHarbor— 11:48

EP: #SafeHarbor limited by the Directive and the #CFR. #CJEU— 11:49

EP: Binary decision (on/off) if there is adequate protection under Article 25. Off is the standard. #CJEU—11:50

EP: #SafeHarbor is only an assumption of adequacy. It must be rebuttalable, and given the massively lower protection – it must. #CJEU— 11:51

EP: COM cannot limit #DPAs, under the Directive 95/46. Argument: Complete Independence. #CJEU— 11:51

EP: Limitations of the Commission. COM cannot restrict the powers of #DPAs. #SafeHarbor #CJEU—11:52

EP: @EU_EDPS has the powers to „speak“ with the COM. #CJEU #SafeHarbor— 11:54

EP: Effective Judicial Protection necessary to be „adequate“. #CJEU #SafeHabor— 11:55

EP: The COM has not taken any action on #SafeHarbor even when doubts were expressed in 2000 by the EP. #CJEU— 11:55

EP:COM has found that there is mass surivllance „THE US DOES NOT provide adequate protection.“ „Sytematic inefficenties“ „cannot be avoided“— 11:57

EP: COM has no power to maintain #SafeHarbor given the facts. It has a duty to suspend it. EP has made a resolution, not action. #CJEU— 11:57/a>

EP: „Limitation“ of #SafeHarbor not an option. #CJEU—11:58

EP: Everyone is bound to act under primary and secondary law. 1. Limited legal effects – rebuttable presumption. #CJEU—11:58

EP: 2.When adopting a decision must take into account judicial protection in the US. 3.It is impossible to conclude an „adequate protection“— 11:59

COM up next. In the hot seat.. ;) #CJEU #SafeHarbor— 12:00

COM: Adequacy Decisions must be applied by #DPAs. In principle not empowered to suspend, however not prevented from taking actions. #CJEU—12:02

COM: #SafeHarbor allows „back door“ in Article 3. Limitations of Art 3 necessary. #CJEU— 12:03

COM: Suspension of data flows under Art 3 SH only when there is a certain threshold of privacy violations (#PRISM?) [sic] #CJEU—12:04

COM: @EU_EDPS only has a power to look into processing. #CJEU— 12:04

COM: #SafeHarbor redress before the @FTC, @TRUSTe or US courts… (all not an option in the PRISM case) #CJEU—12:06

COM: #SafeHarbor overall great.… #CJEU—12:07

COM: Question by the Court: You’re not gonna talk about the validity back in 2000? #CJEU— 12:08

COM: #SafeHarbor is subject to 13 points plan. #CJEU—12:09

»» !!! COM: the Commission cannot confirm an adequate protection right now (!!!) #CJEU #SafeHarbor— 12:09

COM: Has to look at all interest: External relations, business, fundamental rights.. COM needs discretion for the kind and timing. #CJEU— 12:10

COM: The #CJEU should not prejudice the talks with the US. #CJEU—12:11

EPDS now on #SafeHarbor. #CJEU — 12:12

EDPS: There have long been doubts on the level of adequacy by #DPAs. Consistent criticism. Independent from #PRISM. Criticism not resolved.—12:13

EDPS: Mass surveillance inconceivable in 2000 but now there is 9/11 and #Snowden. Art29WP has said this is unacceptable #CFR also new. #CJEU— 12:14

EDPS: Article 7 & 8 the #essence is violated, if one looks at data retention case law. #CJEU #SafeHarbor.— 12:15

EPDS: Difference between content and meta data – under Data Retention Ruling. #CJEU— 12:16

EDPS: Also mainly relying on Data Retention Directive Case Law. Absence of Article 8(2) and (3) protections in #SafeHarbor. #CJEU — 12:17

EDPS: #SafeHarbor cannot overrun the independence by #DPAs. Art 3(1)(b) allows suspension, and is not a limitation. #CJEU — 12:19

EDPS: Balancing between privacy and disruption between internal market. Serious concerns expressed by the #DPAs. #CJEU — 12:21

EDPS: In a nutshell, „improvements with US needs to be sufficient“ #SafeHarbor should be suspended if this does not work. Until then Art 3. — 12:22

EDPS: Transatlantic dialog is important, but… ..failure of the essence of the right to privacy. #CJEU — 12:22

Advocate General: COM – take the SH and the Directive – I got questions. #CJEU — 12:23

COM: Question: Can the EDPS take action? #CJEU — 12:25

If the #CJEU takes the view the COM was inactive… what would be your position on the EPDS… #CJEU — 12:25

Danwitz: VERY explicit questions for the COM. Recital 5 of the #SafeHarbor- „should“ be attained. „are considert to ensure“ – What is this? — 12:27

COM: #SafeHarbor not the best drafting.. #CJEU: COM – IS it, or SHOULD it ensure protection? COM talks internally… — 12:29

COM: It is not a presumption, but a decision. #SafeHarbor #CJEU —22:29

Court at COM: Article 25 – ENSURES protection. Right? #CJEU — 12:31

Court at COM: What is required if Art 25 the DIR says „ensures“? COM: Overall look. Court: Ensures is more like guarantee,right? #SafeHarbor — 12:32

Court: Isn’t there an #obligation by the third country? COM: No positive obligation. But not how would the country then „ensure?“ — 12:33

Court: Annex I of the SH – „limitations“ in #SafeHarbor on Para 4, b) #CJEU — 12:35

I want to marry thej udge.. ;) #CJEU —12:35

Court: Isn’t US law always overriding the #SafeHarbor? How can you then plead that his ensures protection? COM counsults… #CJEU — 12:37

COM: Limitation for US law in #SafeHarbor subject to „proportionality“. But how can you then „ensure“? #CJEU —12:39

Court got EXACTLY the problem of #SafeHarbor in this case. — 12:41

COM: Article 3(1)(b) of the #SafeHarbor are the „safety valve“. Court: But how does this work with the limitations in Art 3? #CJEU —12:43

Court: Where do you take the power to limit the #DPAs in Art 3 SH?
#CJEU — 12:45

Court: Directive requires COM to PROHIBIT transfers (Recital 57). Do you still have this discretion? #CJEU — 12:46

COM: Legal certainty and EU-US data flows, diplomacy are factors to take into account to not suspend data flows.. #CJEU — 12:49

Court: Are you saying #SafeHarbor is not subject to Article 8(3) #CFR? Yes or No? COM talking internally… #CJEU —12:51

COM on Art 8(3): It is not the job of the DPA or EDPS . Court fires COM vs. GERMANY back at the COM. #SafeHarbor #CJEU —12:53

#CJEU resumes with Questions for the COM. #SafeHarbor — 15:03

Bot: What does the COM understand as „ensured“ in Article 25.
#CJEU #SafeHarbor — 15:05

COM: #SafeHarbor commitment through letters by the FTC.
#CJEU #EUDataP — 15:07

Bot: Absolute power by the COM to find adequacy?
#SafeHarbor #CJEU — 15:09

COM: Duty to protect. COM has taken action that is proportionate.
#CJEU #SafeHarbor — 15:10

Bot: What did the COM do, if I’d be a Facebook user?
COM: We talked on them
Bot: Until then?
COM: Until then they should use Article 3 #CJEU —15:14

President: So you plan to keep the #SafeHarbor and try to convince the US?
COM: Right.
Pres: How long does it take? #CJEU —15:18

COM: If you don’t want your data to go to the US, close your Facebook.
#CJEU #SafeHarbor — 15:18

Court at #DPC: Is the reason of your restraint that Ireland is benefiting from US authorities?
IE + DPC: Ireland is fine. #CJEU — 15:22

Court at COM: How about the change over time on „adequacy“? Bound by 2000?
#CJEU #SafeHarbor — 15:33

Court at Schrems: How do you see any use of data?
Answer: Not necessary, only a question of „transfer“ to a third country.
#CJEU —15:35

Final Pleadings: Schrems first.
COM says there is no adequate protection.
No binding agreement.
#CJEU— 15:36

Schrems: #SafeHarbor is overriden by US law at any time.
No discretion for COM.
SH principles not good enough.
#CJEU —15:37

Schrems: No possibility for judicial review in the #PRISM case.
All solutions proposed lead to a positive answer on the Question.
#CJEU —15:41

Independent from the options before the court:
1. DPC cannot be „bound“ by the #SafeHarbor
2. There must be a duty to protect
#CJEU — 15:44

#DPC keep the Safe Harbor!
DPC should not take actions.
#CJEU — 15:44

Ireland: We would welcome guidance.
#CJEU — 15:44

COM: #DPC is bound by the law – even if they are independent.
COM is best placed to make EU wide rules.
#CJEU — 15:44

Advocate General: Opinion 24th of June! ;)
Good bye!
#CJEU #EUdataP #SafeHarbor #EuGH — 15:49