67
As regards those standard data protection clauses, that court asks whether the SCC Decision may be
considered to be valid, despite the fact that, according to that court, those clauses are not binding on the
State authorities of the third country concerned and, therefore, are not capable of remedying a possible
lack of an adequate level of protection in that country. In that regard, it considers that the possibility,
afforded to the competent authorities in the Member States by Article 4(1)(a) of Decision 2010/87, in
its version prior to the entry into force of Implementing Decision 2016/2297, of prohibiting transfers of
personal data to a third country that imposes requirements on the importer that are incompatible with
the guarantees contained in those clauses, demonstrates that the state of the law in the third country can
justify prohibiting the transfer of data, even when carried out pursuant to the standard data protection
clauses in the annex to the SCC Decision, and therefore makes clear that those requirements may be
insufficient in ensuring an adequate level of protection. Nonetheless, the referring court harbours
doubts as to the extent of the Commissioner’s power to prohibit a transfer of data based on those
clauses, despite taking the view that discretion cannot be sufficient to ensure adequate protection.
68
In those circumstances, the High Court decided to stay the proceedings and to refer the following
questions to the Court of Justice for a preliminary ruling:
(1)
In circumstances in which personal data is transferred by a private company from a European
Union (EU) Member State to a private company in a third country for a commercial purpose
pursuant to [the SCC Decision] and may be further processed in the third country by its
authorities for purposes of national security but also for purposes of law enforcement and the
conduct of the foreign affairs of the third country, does EU law (including the Charter) apply to
the transfer of the data notwithstanding the provisions of Article 4(2) TEU in relation to national
security and the provisions of the first indent of Article 3(2) of Directive [95/46] in relation to
public security, defence and State security?
(2) (a)
In determining whether there is a violation of the rights of an individual through the transfer of
data from the [European Union] to a third country under the [SCC Decision] where it may be further
processed for national security purposes, is the relevant comparator for the purposes of [Directive 95/46]:
(i)
(ii)
(b)
(3)
the Charter, the EU Treaty, the FEU Treaty, [Directive 95/46], the [European
Convention for the Protection of Human Rights and Fundamental Freedoms, signed
at Rome on 4 November 1950] (or any other provision of EU law); or
the national laws of one or more Member States?
If the relevant comparator is (ii), are the practices in the context of national security in one
or more Member States also to be included in the comparator?
When assessing whether a third country ensures the level of protection required by EU law to
personal data transferred to that country for the purposes of Article 26 of [Directive 95/46], ought
the level of protection in the third country be assessed by reference to:
(a)
the applicable rules in the third country resulting from its domestic law or international
commitments, and the practice designed to ensure compliance with those rules, to include
the professional rules and security measures which are complied with in the third country;
or
(b)
the rules referred to in (a) together with such administrative, regulatory and compliance
practices and policy safeguards, procedures, protocols, oversight mechanisms and nonjudicial remedies as are in place in the third country?
(4)
Given the facts found by the High Court in relation to US law, if personal data is transferred
from the European Union to the United States under [the SCC Decision] does this violate the
rights of individuals under Articles 7 and/or 8 of the Charter?
(5)
Given the facts found by the High Court in relation to US law, if personal data is transferred
from the European Union to the United States under [the SCC Decision]: