The Minister of Justice has indicated in the Senate that the trade interests in the exchange of personal data with the US are so great that it is not appropriate to test the transfer of personal data to the US a priori against the fundamental right to privacy.
Questions following the Schrems judgment
The Schrems judgment continues to create consternation. On 27 January 2016, the Senate held a written consultation. Subsequently, further questions were put to the Minister by letter dated 7 March 2016. These questions were answered by the Minister on 1 April 2016.
Minister: trade interests weigh heavily
It is noticeable that the Minister repeatedly states that trade interests weigh heavily. So heavily that there is no reason to carry out a (further) test against the (fundamental) right to privacy. This is even more striking now that the Court of Justice in the Schrems judgment approaches privacy law from a constitutional rights perspective.
See the following remarks for example:
It does not follow from the case that the transfer of personal data to the US which rests on different grounds than the Safe Harbour arrangement is unlawful. For the time being it must therefore be maintained that such remain lawful grounds for the transfer of personal data. I attach great importance to this from a legal certainty point of view.
The invalidation of the Safe Harbour arrangement only has legal effect for the transfer of personal data using this arrangement. All other legal bases included in the directive and the Dutch Personal Data Protection Act for the transfer of personal data remain valid. The fact that there are attempts in Germany to try and subject these legal bases to a legal review does not detract from this. Business traffic requires legal certainty for transfers which must be carried out. What the members of the Socialist Party would possibly like to see is that the full flow of trans-Atlantic transfers of personal data is suspended until the Court gives a final judgment on the compatibility of each legal basis for transfer with the Charter of Fundamental Rights. These members are of course free to have this opinion. I consider this an irresponsible approach from the view of legal certainty and the continuity of business transactions.
As long as the directive applies and as long as the Dutch Data Protection Act is in force, it is my intention to continue to give permits for the transfer of personal data to third countries when the Dutch Data Protection Agency has responded positively to an application. As far as I understand, neither the government nor the supervisory bodies are anticipating the directive in Germany. Several supervisory bodies at German federal state level are of the view however, that the standard contract conditions and the binding corporate rules must be tested against article 7 and 8 of the Charter of Fundamental Rights. Whether these supervisory bodies have actually taken steps to carry out this test and are putting the results before the court I do not know. The legal certainty and the continuity of business transactions are for me reasons not to anticipate this.
The approach of the Minister will in any event be welcomed by the Dutch business community. The question remains however whether the supervisory bodies are going to like this pragmatic and less dogmatic approach. This will become clear both during permit applications (for data export) and during enforcement. Watch this space therefore.
By Mark Jansen