Late in 2009, the Article 29 Working Party published two Opinions in relation to the adequacy of data protection in Israel and Andorra. In particular, the Opinions determined the ability of these countries to comply with Directive 95/46/EC on the protection of individuals with regard to the processing of personal data.
In July 2007 the Israeli Mission to the European Union requested that the Commission launch proceedings to declare that Israel ensures an adequate level of protection for the purposes of Article 25(6) of the Directive –i.e. that the Commission make a finding of adequacy in relation to Israel. In May 2008 the Ambassador of Andorra to the European Union requested the same in relation to Andorra.
The Centre de Recherches Informatique et Droit analysed whether the regulatory systems in either of these countries fulfilled the requirements for substantive legislation and the implementation of mechanisms applicable to the personal data protection regulations established in the Working Document "Transfers of personal data to third countries: Applying Articles 25 and 26 of the EU data protection directive", adopted by the Working Party (WP12).
The reports subsequently produced by the Centre were discussed by the Safe Harbor Subgroup, which advised the Working Party to send to the Israeli and Andorran authorities a letter which, while positively assessing the existing data protective regime in each respective country, also outlined the issues that would require further clarification. Both countries responded to the Working Party with extensive reports addressing the matters that had been raised. These reports was analysed by the Safe Harbor Subgroup and any outstanding queries were discussed directly with the Israeli and Andorran authorities. Once it was duly satisfied, the Safe Harbor Subgroup proposed the adoption of Opinion 6/2009 in respect of Israel and 7/2009 in respect of Andorra.
Opinion 6/2009 – Israel
The Working Party's assessment on the adequacy of the law on data protection in Israel focuses on the Privacy Protection Act. The provisions of this Act, as well as local case law relating to the protection of personal data, have been compared with the main provisions of the Directive, taking into account the Working Party's Opinion WP12. This Opinion lists a number of principles which constitute a 'core' of data protection, 'content' principles and 'procedural/enforcement' requirements, compliance with which could be seen as a minimum requirement for any data protection regime to be considered adequate.
The Working Party concluded that Israel guarantees an adequate level of protection for individuals with regard to the processing of personal data and on the free movement of such data, in relation to automated international data transfers or, where transfers are not automated, the data are subject to further automated processing in the Israeli territory.
However, the Working Party encouraged the Israeli authorities to envisage the following when developing future legislation relating to data protection:
- the application of Israeli legislation to manual databases;
- the express application of the proportionality principle in relation to the totality of personal data processing carried out by the private sector; and
- an interpretation of the exemptions to international data transfers online, envisaged in Article 26(1) of the Directive.
Opinion 7/2009 – Andorra
In Andorra the protection of personal data is currently regulated by the Qualified Law 15/2003. Similar to the Israeli procedure, in assessing the adequacy of the Andorran data protection legislation the Working Party compared the Qualified Law to the main provision of the Directive, again taking into account the Working Party's Opinion WP12.
During the Working Party's investigations, it became apparent that the Andorran authorities intended to approve more general data protection regulations that complement but also clarify the current provisions of Qualified Law 15/2003. This change was scheduled for late 2009 or early 2010.
The Working Party concluded that the Principality of Andorra ensures an adequate level of protection within the meaning of Article 25(6) of Directive 95/46/EC. However, the Working Party requested that, when implementing the proposed regulations of the Qualified Law, the Andorran authorities take into account certain clarifications, particularly those regarding the regulation of automated individual decisions.
Procedure for a finding of adequacy
On the basis of Article 25(6), the European Commission has the power to determine whether a third country ensures an adequate level of protection by reason of its domestic law or of the international commitments it has entered into. The process of the Commission's finding of adequacy being adopted under Article 25(6) involves:
- a proposal from the Commission;
- an Opinion of the Article 29 Working Party;
- an Opinion of the Article 31 Management Committee delivered by a qualified majority of Member States;
- a 30 day right of scrutiny for the European Parliament. The European Parliament may, if it considers it appropriate, issue a recommendation; and
- the adoption of the decision by the College of Commissioners.
In relation to Andorra and Israel, the next step towards a finding of adequacy will be an Opinion of the Article 31 Management Committee.
The effect of such a finding is that personal data may then flow between EEA member countries and that third country without any further data protection safeguards being necessary. To date, the Commission has made findings of adequacy in relation to Argentina, Canada, Switzerland, Guernsey, the Isle of Man and Jersey.
The Working Party has confirmed that, in its opinion, the legal systems in both Israel and Andorra comply with Directive 95/46/EC. It should be noted, however, that although the Working Party has come to this conclusion, legal recognition of the Israeli and Andorran data protection regimes in the guise of a finding of adequacy ultimately rests with the European Commission.