BIG BROTHER WATCH AND OTHERS v. THE UNITED KINGDOM JUDGMENT
233. Furthermore, unless there was a valid Commission adequacy
decision, the competent supervisory authority was required to suspend or
prohibit a transfer of data to a third country if, in the view of that
supervisory authority and in the light of all the circumstances of that
transfer, the standard data protection clauses adopted by the Commission
were not or could not be complied with in that third country and the
protection of the data transferred (as required by European Union law)
could not be ensured by other means.
234. In order for the Commission to adopt an adequacy decision, it had
to find, duly stating reasons, that the third country concerned ensured, by
reason of its domestic law or its international commitments, a level of
protection of fundamental rights essentially equivalent to that guaranteed in
the European Union legal order. In the CJEU’s view, the Safe Harbour
decision was invalid. Section 702 of the Foreign Intelligence Security Act
(“FISA”) did not indicate any limitations on the power it conferred to
implement surveillance programmes for the purposes of foreign intelligence
or the existence of guarantees for non-US persons potentially targeted by
those programmes. In those circumstances, it could not ensure a level of
protection essentially equivalent to that guaranteed by the Charter.
Furthermore, as regards the monitoring programmes based on
Executive Order 12333, it was clear that that order also did not confer rights
which were enforceable against the United States’ authorities in the courts.
6. Privacy International v. Secretary of State for Foreign and
Commonwealth
Affairs
and
Others
(Case
C-623/17;
ECLI:EU:C:2020:790) and La Quadrature du Net and Others,
French Data Network and Others and Ordre des barreaux
francophones et germanophone and Others (Cases C-511/18,
C-512/18 and C-520/18; ECLI:EU:C:2020:791)
235. On 8 September 2017, the IPT gave judgment in the case of
Privacy International, which concerned the acquisition by the intelligence
services of bulk communications data under section 94 of the
Telecommunications Act 1984 and bulk personal data. The IPT found that,
following their avowal, the regimes were compliant with Article 8 of the
Convention. However, it identified the following four requirements which
appeared to flow from the CJEU judgment in Watson and Others and which
seemed to go beyond the requirements of Article 8 of the Convention: a
restriction on non-targeted access to bulk data; a need for prior authorisation
(save in cases of validly established emergency) before data could be
accessed; provision for subsequent notification of those affected; and the
retention of all data within the European Union.
236. On 30 October 2017, the IPT made a request to the CJEU for a
preliminary ruling clarifying the extent to which the Watson requirements
could apply where the bulk acquisition and automated processing
75