ARTICLE 29 DATA PROTECTION WORKING PARTY

The WP29 welcomes the findings in the PCLOB report that “in practice, ‘non-U.S. persons’
also benefit from the access and retention restrictions required by the different agencies’
minimisation and/or targeting procedures due to the cost and difficulty of identifying and
removing U.S person information for a large body of data means that typically the entire data
set is handled in compliance with the higher U.S data standards”.
The WP29 further notes that according to the PCLOB findings, “the programme does not
operate by collecting communications in bulk”. The 2014 Statistical Transparency Report
issued by the ODNI confirms this finding. Additionally, according to PCLOB report, “tasked
selectors”, such as an e-mail address or a telephone number, are used to target the
surveillance. 48
The corresponding available public rules relating to targeting do however not provide for such
targeted rules and only aim to avoid the targeting of U.S. persons or U.S.-based persons.
Moreover, the benefits that according to the PCLOB apply to non-U.S. persons in practice are
not legally binding or statutorily established, since the available legislation relating to
targeting do not provide for such targeted rules and only aims to avoid targeting U.S. persons
or U.S.-based persons.
The WP29 furthermore recalls that for Section 702 purposes, persons are not only individuals,
but also groups, entities, associations, corporations, or foreign powers. Moreover, the fact that
collection is justified by “a significant purpose of the acquisition is to obtain foreign
intelligence information” leaves some uncertainty regarding its purpose and necessity.
However, WP29 welcomes the information provided in Annex VI that the total number of
individuals targeted under Section 702 in 2014 were approximately 90.000 individuals 49 . The
first review of the Privacy Shield will provide an opportunity for further evidence of the
targeting rules to be demonstrated.
So far, there is no conclusive jurisprudence on the legality of massive and indiscriminate data
collection and subsequent use of personal data for the purpose of combating crime, including
the question under what circumstances such collection and use of personal data could take
place. The CJEU is expected to address this question at least to some extent in the course of
2016, both in the joined cases Tele2 Sverige AB v. Post- och telestyrelsen and Secretary of
State for the Home Department v. Davis and others 50 and in the advice to be given on the
validity of the PNR Canada agreement. 51 In the meantime the WP29 recalls that it has
consistently considered that massive and indiscriminate collection of data in any case cannot
be regarded as proportionate. 52
48 PCLOB Report on the Surveillance program operated pursuant of Section 702 FISA, p. 32
49 Annex VI, p. 11
50 CJEU, Joined Cases C-203/15 and C-698/15
51 CJEU, Case A-1/15
52 WP215 http://ec.europa.eu/justice/data-protection/article-29/documentation/opinionrecommendation/files/2014/wp215_en.pdf
39