ARTICLE 29 DATA PROTECTION WORKING PARTY

efers to an ‘EU individual’ without further defining who that is. The Working Party regrets
this uncertainty and suggests to provide for clarification in the sense that all persons subject to
EU law have the right to have her or his request to the Ombudsperson processed according to
the conditions of the Memorandum. Additionally, the Commission and the U.S. should
address the question to what extent the Privacy Shield will also apply to citizens / residents of
the countries of the EEA and Switzerland, which in the past did enjoy coverage by the Safe
Harbour scheme.
Furthermore, the WP29 notes some uncertainty as to the scope of application of the
Ombudsperson mechanism. Whereas the Memorandum provides that the Ombudsperson is
charged with processing requests relating to national security to data transmitted from the EU
to the U.S. pursuant to all transfer tools available under EU law, it is equally made clear in the
Memorandum that it sets forth a mechanism “regarding signal intelligence”. The latter term
suggests that only such data transfers are covered where the data was collected by means of
signal intelligence, which leads to the question whether data collected under FISA, e.g., is
considered ‘signals intelligence’. That appears to be the case as regards Section 702, as
explained in the representation by the ODNI, p. 10. 73 However, the WP29 regrets that the use
of the term ‘signal intelligence’ creates unnecessary uncertainty in this context.
As another consequence, it is the understanding of the Working Party that the Ombudsperson
mechanism does not cover requests related to access by law enforcement agencies. 74 If so, it
would remain unclear whether requests from some agencies, notably the CIA, would be
covered by the mechanism.
3.5.3.5 ‘Standing’ and the procedure of the request
To bring legal proceedings against surveillance measures by the U.S. Government before
ordinary courts in the United States is very difficult. The Working Party is aware that the
Supreme Court has denied standing in intelligence cases, where the applicant was not able to
show individual “concrete, particularised, and actual or imminent or injury”. 75 In this regard
the establishment of the Ombudsperson is an important step, as it adds an avenue to some
form of legal redress which would otherwise not be existing. The Working Party therefore
welcomes the clarification in section 3(c). Based on this section, a demonstration that the
requestor’s data has in fact been accessed through signal intelligence activities is not needed
in order to file a request under the new mechanism.
The Working Party largely endorses the procedure for identification of the complainant under
the Ombudsperson mechanism. It makes perfect sense to have the identification take place on
EU territory, as is also the case for the access mechanism under the EU-U.S. TFTP2
Agreement. However, the Working Party fails to understand why the verification in the EU
should be carried out by the “Member States bodies competent for the oversight of national
security services”. In the first place, it seems unlikely that following article 4(2) Treaty on the
73 Privacy Shield Annex VI, p. 10
74 Memorandum on the establishment of an Ombudsperson, p.1
75 Clapper v. Amnesty International USA, 568 U.S. ___ (2013) II. p.10
48