Privacy and personal data protection [European Parliament impact 2014-2019]

Personal data is processed – often automatically – for many purposes to the benefit of society and individuals; at the same time, its use (or the risk of its misuse) raises concerns for individual’s rights, including privacy and data protection, which are enshrined in both primary and secondary EU law. The data protection field is a meaningful example to use to illustrate the various ways in which the European Parliament can exercise its different powers. Besides its legislative power, particularly relevant in the adoption of the data protection reform package, as well as the power to give consent to EU legal acts (for example, the EU-US Umbrella agreement and the Protocol to the CoE Convention 108), the Parliament has exercised its varied power of political control over the Commission on several occasions in the area of privacy and data protection. Moreover, it has used its powers of enquiry to question and launch investigations on specific issues related to the lawfulness of data processing and other subjects. In light of the Snowden revelations about the US National Security Agency’s data collection programme and about the risk that US law and practice did not offer adequate protection to EU citizens’ data transferred to the US, the Parliament repeatedly called for the suspension of the EU-US Safe Harbour data transfer agreement. As part of the Parliament’s inquiry into mass surveillance of EU citizens, MEPs looked into alleged spying activities by the US and some EU countries, adopting ad hoc resolutions and providing recommendations on preventing further breaches and on redress mechanisms. Having called for the annulment of the Safe Harbour agreement (later withdrawn, following the CJEU’s ruling), the Parliament continued to scrutinise the Commission’s activities leading to the new Privacy Shield data-transfers framework in 2016. Although recognising the improvements of the new arrangement, the Parliament has repeatedly voiced its concerns, especially in its resolutions on transatlantic data flow (2016) and on the adequacy of the ‘Shield’ (2018). Although the Parliament is not formally involved in the related negotiations, it assesses (and may request to amend or withdraw) the Commission’s adequacy decisions on third countries’ level of data protection. Also to this end, ad hoc delegations of the Committee on Civil Liberties (LIBE) have visited the US, Canada, Japan and recently South Korea. The instrument of parliamentary questions for oral or written answers addressed to the European Commission has been used several time on specific issues of data protection and privacy. As part of its scrutiny powers, the Parliament requested, for the first time in November 2018 and according to Article 218(11) TFEU, the opinion of the Court of Justice of the EU (CJEU) on the EU-Canada PNR transfer agreement on its compatibility with privacy and data protection rights. European advisory bodies on data protection (the European Data Protection Supervisor and European Data Protection Board) have to regularly report to Parliament on their activities. Moreover, the Parliament has been active in questioning and investigating the Facebook/Cambridge Analytica scandal (companies certified under the Privacy Shield and accused of misuse of data, including that of European citizens). During the April 2018 plenary session, MEPs called for a strong European position and insisted that Facebook’s CEO, Mark Zuckerberg, appear in the European Parliament to give clarifications. Several hearings were organised on the issue by the LIBE Committee, and a resolution was adopted by the Parliament to wind up the debate on the use of Facebook users’ data by Cambridge Analytica and the impact on data protection in October 2018. Unusually, this was explicitly addressed, not only to the Council, the Commission and the governments and parliaments of the Member States, but also to the US, the Council of Europe and the CEO of Facebook. Finally, the Parliament has provided a forum for public debate on privacy and data protection matters, not just within its formal meeting rooms, but also by organising several conferences, which contributed to triggering the debate on critical issues such as new technologies vs rights protection, and to increasing awareness that the underlying values of data protection legislation are essential for democracy. Read the complete study on ‘The power of the European Parliament: Examples of EP impact during the 2014-19 legislative term‘ in the Think Tank pages of the European Parliament.