Exchanging and protecting personal data in a globalised world (communication)

Keypoints:

• The opinion stresses that the EU has a responsibility to become a global actor in promoting respect for fundamental rights and adequate protection of private life and personal data and encourages the European Commission to be pro-active at bilateral and multilateral level in promoting the highest standard of personal data protection.
• In this sense, the EESC finds well-balanced and reasonable the four key criteria outlined in the Communication to be taken into account by the Commission when assessing the countries with which a dialogue on adequacy should be pursued. However, it finds important to interpret these criteria in the light of a real commitment on the part of the governments, parliaments, and courts in these countries to reach an equivalent and functional level of personal data protection and calls for more transparency and civil society participation in the process of granting adequacy decisions.
• It also recalls the importance of the proposals put forward in the European Parliament Resolution of 6 April 2017 on the adequacy of the protection afforded by the EU-US Privacy Shield which raises serious concerns, many of them indicating that the agreement and the current US legislative framework do not in practice protect the rights of EU citizens.
• The opinion highlights that, given the rapid technological advances and continuous expansion of ITC infrastructure, there is a need for close governmental oversight and monitoring. In this sense, it recommends a permanent contact between the Commission, data protection authorities (DPAs) and third country governmental authorities to identify new challenges in what is a very dynamic technological and economic environment.
• Regarding multilateral efforts, the EESC considers that promoting data protection standards through multilateral instruments should be a priority for the European Commission and that this commitment should be backed by resources, so that a real protection of human rights can be achieved a priori and, a posteriori, an effective legal remedy for prejudices; the only binding multilateral instrument in the area of data protection is the Council of Europe Convention No 108 of 1981, with its additional Protocol of 1999 and it should be further developed and more third countries should be encouraged to join; multilateral efforts within the OECD, the G20 and APEC (Asia-Pacific Economic Cooperation) should be further developed with a view to building a truly global multilateral system of data protection. Cooperation with the UN Special Rapporteur on the right to privacy should be solid and functional.
• Finally, concerning personal data exchanges as part of the prevention, investigation, and prosecution of criminal offences, the opinion strongly supports the creation of robust data protection safeguards and is also open to the introduction of adequacy findings in the criminal law enforcement sector.