The Achilles heel of EU data protection in a law enforcement context: international transfer under appropriate safeguards in the law enforcemend directive

• Laura Drechsler ^[1]
  1. [1] FWO, Brussels Privacy Hub
• Localización: Cybercrime: new threats, new responses: Actas del XVº Congreso Internacional Internet, Derecho y Política. Universitat Oberta de Catalunya, Barcelona, 1-2 de julio de 2020, 2020, ISBN 978-84-17580-15-5, págs. 47-65
• Idioma: inglés
• Texto completo no disponible (Saber más ...)
• Resumen

  • In May 2018, EU data protection rules were not only reformed by the General DataProtection Regulation (GDPR) but also by the Law Enforcement Directive (LED). While the LEDis often overshadowed by the GDPR, it nevertheless did introduce a number of crucial reforms todata protection in a law enforcement context in the EU including harmonised rules on how personaldata in a law enforcement context can be transferred to other law enforcement authorities in thirdcountries. Formally the LED rules on international transfers of personal data to third countries aimat guaranteeing that the level of protection for personal data in a law enforcement context withinthe EU is not undermined as soon as personal data leaves EU territory. Taking a closer look howeverreveals major issues with the rules foreseen for transfers in the LED as they often come down to lawenforcement authorities self-assessing whether a third country would offer adequate protection withinthe meaning of the standard of essential equivalence as established by the Court of Justice of the European Union (CJEU) in Schrems.In this paper, I show, by relying on EU fundamental rights law and the case law of the CJEU, howdue to the absence of LED adequacy decisions, personal data transfers to law enforcement authoritiesin third countries often occur without the appropriate scrutiny and safeguards due to system the LEDestablishes. Using the recent reference to the CJEU by a German Court regarding information exchanges with Interpol, I demonstrate how the created legal uncertainty can affect both the work of lawenforcement authorities and the fundamental rights of individuals. I conclude that the current systemfor international personal data transfers within the LED is deeply flawed and potentially underminingEU personal data protection in a law enforcement context.