On The Evolution And Implication Of The EU Adequacy Decision Regarding U.S. Data Protection

On 6 October 2015,the Court of Justice of the European Union ruled on the case of Maximillian Schrems v.Data Protection Commissioner,and found that the Safe Harbor scheme could not provide "adequate level of protection" anymore for the EU citizens as required by the Directive 95/46/EC.Accordingly,the Commission Decision 2000/520 on the adequacy of the protection provided by the safe harbor privacy principles and related frequently asked questions issued by the U.S.Department of Commerce is invalid.This case brought the "adequacy decision" to public notice.Under the motivational policies,China’s e-commerce is now experiencing a prosperous growth,exploiting the European and U.S.market.Intimate co-operation with foreign ISPs is around the corner,which inevitably leads to frequent trans-border flows of data.This decision not only sheds some light on EU’s understanding to the "adequacy" but also can be referential to polishing China’s data protection mechanism.The first three chapters of this article are arranged in time sequence.The first chapter concerns with an introduction to the EU’s "adequacy decision".In order to protect the right to data protection required by EU legal instruments,the adequacy decision is one of the forms provided in the European Data Protection Directive 95/46/EC.The EU Commission is entitled to issue "adequacy decision" to a third country whose legal resources on data protection are recognized as being able to provide adequate protection.Such decision is welcomed as it satisfies massive transfer of data between the EU and U.S.The second and third chapters extract the elements for evaluating adequate protection and detect their evolution as time passes.When the Safe Harbor Adequacy Decision was issued as the first EU adequacy decision for the U.S.,the evaluation of adequate data protection was broadly understood as implementation and enforcement of the Principles.Whereas it was then confronted by various practical problems,such as,lack of transparent supervision,lack of independence in the recourse mechanism,excessive intervention by public agents and so on.This led to the annulment of the Safe Harbor Adequacy Decision.For the sake of restoring trust on both sides,the scope of "adequacy decision" has been renewed by endeavor from both the U.S.and EU.They put new emphasis on enhancing the mandatory effect and transparency of the provisions,periodical review and pro-active investigations conducted by the authorities,access to judicial relief,and restriction on the public intervention.Accordingly,the second adequacy decision,the Privacy Shield Decision emerged shortly after the annulment of the first one.The fourth chapter starts with reviewing the Chinese legal resources on data protection,based on the aforementioned elements adopted by EU.The evolution of the "adequacy decision" between EU and the U.S.has significance to China on two levels.For the domestic protection,EU’s assessment to the U.S.domestic regulations plays as a reference for improving our protection for both Chinese and foreign users.As for the trans-border dimension,two references can be made:first,EU’s response to the emerging challenges in data protection,gives a hint on how to effectively shield Chinese citizens from massive collection of data by foreign companies;second,the domestic reform on the US privacy laws sheds lights on how to exert protection to foreign data by improving domestic rules.Presently China’s domestic instruments are scattered,and less attention has been given to the issue of trans-border data flow.With the goal of promoting the provisions regarding data transfer,efforts can be made on the ground of existing legal regime from both domestic and international dimensions.As for the domestic level,on the basis of existing transparent supervision,China should attach importance to the completion of rights to data protection,the systematical allocation of duty to one or more authorities,the provision of pluralistic recourse mechanisms other than that in administrative laws,and the establishment of periodical review mechanism as well.As regards the international level,domestic legal resources can be applied mutatis mutandis to the protection of foreign data,and explore the extraterritorial effect of the right to data protection under the domestic laws.