CENTRUM FÖR RÄTTVISA v. SWEDEN JUDGMENT
the level of protection afforded by the United States respected the essence of
the rights guaranteed by Article 47 of the Charter.
121. In a judgment of 16 July 2020 the CJEU held that the General Data
Protection Regulation (“GDPR”) applied to the transfer of personal data for
commercial purposes by an economic operator established in a Member
State to another economic operator established in a third country,
irrespective of whether, at the time of that transfer or thereafter, those data
were liable to be processed by the authorities of the third country in
question for the purposes of public security, defence and State security.
Moreover, the appropriate safeguards, enforceable rights and effective legal
remedies required by the GDPR had to ensure that data subjects whose
personal data were transferred to a third country pursuant to standard data
protection clauses were afforded a level of protection essentially equivalent
to that guaranteed within the European Union. To that end, the assessment
of the level of protection afforded in the context of such a transfer had to
take into consideration both the contractual clauses agreed between the
controller or processor established in the European Union and the recipient
of the transfer established in the third country concerned and, as regards any
access by the public authorities of that third country to the personal data
transferred, the relevant aspects of the legal system of that third country.
122. Furthermore, unless there was a valid Commission adequacy
decision, the competent supervisory authority was required to suspend or
prohibit a transfer of data to a third country if, in the view of that
supervisory authority and in the light of all the circumstances of that
transfer, the standard data protection clauses adopted by the Commission
were not or could not be complied with in that third country and the
protection of the data transferred (as required by European Union law)
could not be ensured by other means.
123. In order for the Commission to adopt an adequacy decision, it had to
find, duly stating reasons, that the third country concerned ensured, by
reason of its domestic law or its international commitments, a level of
protection of fundamental rights essentially equivalent to that guaranteed in
the European Union legal order. In the CJEU’s view, the Safe Harbour
decision was invalid. Section 702 of the Foreign Intelligence Security Act
(“FISA”) did not indicate any limitations on the power it conferred to
implement surveillance programmes for the purposes of foreign intelligence
or the existence of guarantees for non-US persons potentially targeted by
those programmes. In those circumstances, it could not ensure a level of
protection essentially equivalent to that guaranteed by the Charter.
Furthermore, as regards the monitoring programmes based on Executive
Order 12333, it was clear that that order also did not confer rights which
were enforceable against the United States’ authorities in the courts.
35