ARTICLE 29 DATA PROTECTION WORKING PARTY

4.2 Application of the European Essential Guarantees to access by law enforcement
authorities to data held by corporations
4.2.1 Access by law enforcement authorities to personal data should be in accordance with
the law and based on clear, precise and accessible rules
Annex VII to the Privacy Shield contains a letter from the U.S. Department of Justice,
“providing a brief overview of the primary investigative tools used to obtain commercial data
and other record information from corporations in the United States for criminal law
enforcement or public interest (civil and regulatory) purposes, including the access limitations
set forth in those authorities”.
All procedures mentioned in Annex VII stem either from the U.S. Constitution directly (the
Fourth Amendment), from statutory and procedural law or from Guidelines and Policies of
the Department of Justice. However, Annex VII does not refer specifically to all the statutes
that provide for these procedures, but instead focuses on describing in short the procedures
themselves. Annex VII also mentions that “there are other legal bases for companies to
challenge data requests from administrative agencies based on their specific industries and the
types of data they possess”, by giving several non-exhaustive examples such as the Bank
Secrecy Act, the Fair Credit Reporting Act, the Right to Financial Privacy Act.
The WP29 notes that the framework of statutes, procedures and policies is fragmented and
that the applicable legal basis to a given request for access will depend on the nature of the
data sought, the nature of the company, the nature of the legal procedures (criminal,
administrative, related to other public interest) and the nature of the entity requesting access.
Since all applicable rules to limit access by law enforcement authorities to data transferred
under the Privacy Shield are based on the Constitution, on statutory law and on transparent
policies of the Department of Justice, a presumption of accessibility of these rules is taken
into account by the WP29. However, the clarity and precision of the rules can only be
assessed in each individual type of procedure and request for access. The WP29 therefore
regrets to note that, based on the available details in Annex VII to the Privacy Shield and the
findings in the draft decision, such an assessment cannot be done at this moment.
4.2.2 Necessity and proportionality with regard to the legitimate objectives pursued need to
be demonstrated
The WP29 duly notes that requesting access to data for law enforcement purposes can be
considered to pursue a legitimate objective. For instance, Article 8(2) ECHR accepts
interferences to the right to the protection for private life by a public authority “in the interests
of (…) public safety, (…) for the prevention of disorder or crime”. However, such
interferences are only acceptable when they are necessary and proportionate 83 .
83 See the Working Document on the European Essential Guarantees, p. 7-9. For a general assessment of the concepts of
necessity and proportionality, see WP29 “Opinion 01/2014 on the application of necessity and proportionality concepts and
data protection within the law enforcement sector”, 27 February 2014.
53