ARTICLE 29 DATA PROTECTION WORKING PARTY

1.1 General comments
1.1.1 Scope of the WP29’s assessment
The WP29 first of all took into account the applicable data protection framework in the
Member States of the European Union, including Article 8 of the European Convention on
Human Rights (hereinafter: ECHR) protecting the right to private and family life as well as
Articles 7, 8 and 47 of the Charter of Fundamental rights of the European Union (hereinafter:
the Charter) respectively protecting the right to private and family life, the right to protection
of personal data and the right to an effective remedy and fair trial. It also took into
consideration the relevant jurisprudence, as well as the requirements of the Directive.
The requirement for a third country to ensure an adequate level of data protection was further
defined by the CJEU in Schrems. The Court did not only explain that the provisions of the
Directive must be interpreted “in the light of the fundamental rights guaranteed by the
Charter” 3 and in particular Articles 7 and 8. It also indicated that the wording ‘adequate level
of protection’ must be understood as “requiring the third country in fact to ensure, by reason
of its domestic law or its international commitments, a level of protection of fundamental
rights and freedoms that is essentially equivalent to that guaranteed within the European
Union by virtue of the Directive read in the light of the Charter” 4 . For the former Safe
Harbour decision, such an assessment has never been made with a sufficient level of detail.
The WP29 therefore assessed the draft adequacy decision in light of the requirement to
provide an analysis of the level of protection of fundamental rights and freedoms being
essentially equivalent to that guaranteed within the EU. The WP29 stresses this opinion
contains its principal concerns, but that given the limited time that has passed since the draft
adequacy decision was published further issues may be discovered at a later date.
The WP29 acknowledges that by defining the word ‘adequate’ in Article 25(6) of the
Directive as ‘essentially equivalent’, the CJEU further detailed adequacy in the Schrems case.
The Court has underlined that the term ‘adequate level of protection’, although not requiring
the third country to ensure a level of protection identical to that guaranteed in the EU legal
order, must be understood as requiring the third country in fact to ensure, by reason of its
domestic law or its international commitments, a level of protection of fundamental rights and
freedoms that is essentially equivalent to that guaranteed within the European Union by virtue
of the Directive read in the light of the Charter.
1.1.2 The assessment of the commercial part of the draft adequacy decision
The WP29 has already explained the way it applied the core EU data protection principles to
transfers of personal data to third countries in its Working Document 12 ‘Transfers of
personal data to third countries: Applying Articles 25 and 26 of the EU data protection
directive’ 5 . The WP29 tried to find the equivalent safeguards which ensure a level of
3 Schrems, §38
4 Schrems, §73
5 Adopted by the WP29 on 24 July 1998, see in particular page 6
10