Author: Peter Schantz

 

Any judgment of a court or tribunal and any decision of an administrative authority of a third country requiring a controller or processor to transfer or disclose personal data may only be recognised or enforceable in any manner if based on an international agreement, such as a mutual legal assistance treaty, in force between the requesting third country and the Union or a Member State, without prejudice to other grounds for transfer pursuant to this Chapter.

I. Purpose

Art. 48 does not stipulate a ground for transfer to a third country. The provision only clarifies that a decision of a court or an authority of a third country as such does not constitute a sufficient basis for a transfer to a third country, except in case of an international agreement.[1] Since Art. 48 does not exclude the other legal bases of Chapter V, the meaning of the provision is primarily symbolic.[2] However, it can be used to interpret Art. 49, as Art. 48 underlines that the EU legal order does not recede if a controller or a processor is exposed to conflicting obligations. This does not preclude considering this dilemma when sanctions are imposed.[3]

At the same time, the provisions aim to strengthen instruments of international cooperation (such as mutual legal assistance treaties (MLAT), the Hague Evidence Convention or the Council of Europe Convention on Cybercrime) by blocking unilateral requests for disclosure.[4] In contrast to unilateral requests for the disclosure of exterritorialy stored data, these legal instruments generally provide for safeguards to ensure the rights and interests of the data subject (such as examination by a domestic court or authority).[5] However, many states try to bypass the MLAT procedure, which they consider too slow and lengthy, by directly requesting service providers to disclose personal data processed in another country. The US CLOUD Act as well as the EU draft Regulation on Production and Preservation Orders (E-Evidence Regulation)[6] follow this avenue.

II. Legislative history

Internal drafts of the Commission for the GDPR provided for a provision similar to Art. 48.[7] However, the Commission did not include it in the final draft after massive US pressure.[8] The EP took up the idea reacting to Edward Snowden’s revelations about the surveillance practices of US intelligence agencies. In this context, the provision is often, and in some respects misleadingly, referred to as the “anti-FISA clause”.[9] Art. 43a of EP’s draft provided for additional guarantees, such as approval by the SAs and an obligation to inform the data subject. In the trialogue, the EP was able to insist successfully on the inclusion of Art. 48 against the majority of the Council; however, these additional safeguards were not incorporated.

 

III.        Material scope

Request for the disclosure of transfer of data

Art. 48 is intended to regulate all situations in which a controller or a processor is obliged to transfer personal data to a third country based on a sovereign order from a third country. According to this purpose and as indicated by its wording (“any decision”), the provision has to be interpreted broadly, also extending to production orders.[10] Pre-trial discovery procedures only fall under Art. 48 if the disclosure is explicitly ordered by a court.[11] Beyond the scope of Art. 48 are orders and awards issued by private arbitral institutions.[12]

The purpose of the request for disclosure is irrelevant.[13] Art. 48 is also applicable if the foreign authority pursues purposes that do not fall within the scope of EU law, e.g. purposes of national security according to Art. 4 para. 2 sentence 3 TEU; the provision only serves to protect the domain réservé of the Member States, but not of third countries. Even if the foreign authority serves to prevent and prosecute criminal offenses, the GDPR continues to apply, unless the transfer was made by a competent authority of a Member State (Art. 2 para. 2 lit. d).

 

 

 

 

[…]

 

 

 

 

[1]EDPB, Guidelines on the derogation of Article 49 under Regulation 2016/679, adopted on 25.5.2018, 5; Metz/Spittka, ZD 2017, 361 (365); but see Klug in Gola, Art. 48 para. 2 (Art. 48 as additional ground for transfer).

[2]Kuner, ‘Art. 48’, in Kuner/Bygrave/Docksey, 831; Schröder in Kühling/Buchner, DSGVO/BDSG, Art. 48 para. 2; Metz/Spittka, ZD 2017, 361 (365); Jungkind in BeckOK DatenschutzR, Art. 48 para. 3 et seq.eng_fn

[3]See for Germany Werkmeister/Mirza-Khanian, CCZ 2016, 98 (99 et seq.).

[4]Cf. Kuner, ‘Art. 48’, in Kuner/Bygrave/Docksey, 827 (considering Art. 48 to be a blocking statute with the purpose to increase political leverage on the government of the third country).

[5]Brief of the European Commission on Behalf of the European Union as Amicus Curiae in the Case Microsoft v. U.S. before the U.S. Supreme Court, 14 (MLATs preferred option for transfer); Brief of Amici Curiae Jan Philipp Albrecht, Sophie In’t Veld, Viviane Reding, Birgit Sippel, and Axel Voss, Members of the European Parliament in the Case Microsoft Inc. v. U.S. before the U.S. Supreme Court, 16–18.

[6]COM(2018) 225 final.

[7]http://www.statewatch.org/news/2011/dec/eu-com-draft-dp-reg-inter-service-consultation.pdf, see Art. 42 of the draft.

[8]Albrecht, CR 2016, 88 (94–95); Hornung, ZD 2012, 99 (99); see on the lobbying activities of the US Reding, ZD 2012, 195 (196).

[9]Pauly in Paal/Pauly, Art. 48 para. 2.

[10]Kuner, ‘Art. 48’, in Kuner/Bygrave/Docksey, 832; Pauly in Paal/Pauly, DSGVO/BDSG, Art. 48 para. 5.

[11]Pauly in Paal/Pauly, Art. 48 para. 6; Schröder in Kühling/Buchner, Art. 48 para. 13.

[12]Kuner, ‘Art. 48’, in Kuner/Bygrave/Docksey, 832.

[13]Zerdick in Ehmann/Selmayr, Art. 48 para. 6.