b. The Claimant submits that this is only a requirement for the data itself
to remain in the European Union and not the product of the data. If
that is so, it is less of a restriction, but the reference in paragraph 123
to a potential claim by a person “seeking the protection of their data”
would not seem to support this.
66.
If there is an absolute bar, it would obviously have a serious impact on the
sovereignty of the Member States, and upon their Treaty obligations for the
sharing of intelligence information, which might be of considerable
importance in the event of a threat to the territorial integrity (Article 4(2)
TEU) of a Member State.
Further, as discussed in paragraph 46 above,
whereas it might be applicable in relation to a case concerning retention of
data, it is far from clear that it would apply to a case such as this, where the
data had already been supplied to the Member State’s SIAs, and it then is to be
applied to their subsequent conduct in the exercise of their duty to protect
national security.
67.
This Requirement would appear to be in clear conflict with Parliament v
Council, as approved in Ireland v Parliament, and with the Opinion of
Mengozzi AG, relating as it does to the draft agreement between Canada and
the European Union on the transfer and processing of passenger name record
data. It would also appear to be in conflict with Article 25 of the DPD
“Transfer of Personal Data to Third Countries”, which of course applies to
the EPD by virtue of Article 1(2) of the EPD.
68.
This whole question of transfer of data to third parties, including friendly
foreign agencies, and whether the present arrangements of the SIAs are
Page 55