Non-discriminatory and even-handed implementation of Articles 25 and 26 of the Directive and decisions taken on the basis of these provisions

The Committee is mindful of the interest which third countries are showing in the implementation of Articles 25 and 26 of the Directive and in particular in the effects of findings of "adequacy" under Article 25(6). It recognises that some third countries have raised concerns that enforcement actions in the EU may be more severe vis-à-vis third country entities than they are vis-à-vis EU data controllers and that there may also be discrimination between the entities from different third countries.

The Committee is confident that these concerns will prove to be unfounded. It recalls the standard text in the recitals of the Commission's decisions under Article 25(6)⁽¹⁾ and the views of the Article 29 working party on this issue, as expressed at the wp's meeting on 3 February.

For its part, the Committee regards it as necessary to be even-handed in implementing the provisions of the Directive that deal with third countries. The Committee express its commitment to the principle of non-discrimination and recall that the general principle of equality, of which the prohibition of discrimination on grounds of nationality is a specific enunciation, is one of the fundamental principles of Community law. This principle requires that similar situations shall not be treated differently unless differentiation is objectively justified⁽²⁾. The Committee also recalls obligations emanating from other international instruments, in particular the European Convention of Human Rights. Article 14 of the ECHR requires that the rights and freedoms set forth in the Convention (which include the right to respect for privacy - Article 8) be secured without discrimination on any ground, including inter alia national origin.

The Committee also regards it as important to be able to judge different situations on their merits and not to regard the equal treatment principle as imposing a single model on third countries. Such an interpretation of the principle would fly in the face of the deliberately flexible wording of Article 25 (which requires "adequate" protection in third countries and which allows circumstances to be judged on a case by case basis) and of the need to take into account different countries' varied approaches to achieving effective data protection. This approach means that adequacy findings may sometimes be made despite certain weaknesses in a particular system, provided of course that such a system can be assessed as adequate overall, for example because of compensating strengths in other areas. The principle of equal treatment does not mean that allowances made to take account of the particular traditions of one country, as described above, are automatically applicable to or acceptable in the cases of other third countries. It does mean that assessments of adequacy should be made broadly by reference to the same standard.

The Committee will respect the principle of equality of treatment in any opinions it may be called upon to issue involving data transfers to third countries which are the subject of Commission draft measures for adequacy findings under Article 25(6) or which are already the subject of Article 25(6) decisions (notably under Article 2 paragraph 5 of such decisions) and welcomes the Commission's intention to be particularly vigilant in this regard (see Article 3 of the draft Article 25(6) decision). The Committee wishes to be informed of any instances of allegedly arbitrary and/or unjustified discriminatory actions and to have the opportunity to discuss and contribute to resolving them, including consideration of the views of the third country concerned.

As befits an instrument aiming to protect fundamental rights, the Directive's enforcement should, in the Committee's view, be impartial both as between different third countries and as between third countries' and EU entities. The Committee notes in this context that complaints handling is a major part of the enforcement of data protection rules, including the Directive. Member States as well as the third countries which benefit from an Article 25.6 decision are subject to an obligation to respond to complaints in an appropriate manner and in respect of the applicable law or rules. Fulfilling this obligation cannot be held to be incompatible with an undertaking to enforce Articles 25 and 26 in an even-handed manner. It is also useful to recall in this regard that under Community law non-compliance with the law by one entity cannot be accepted as legitimate defence for non-compliance by another entity⁽³⁾.
 

¹ " Given the different approaches to data protection in third countries, the adequacy assessment has to be carried out^, and any decision based on Article 25 paragraph 6 has to be enforced^, in a way that does not arbitrarily or unjustifiably discriminate against or between third countries where like conditions prevail nor constitute a disguised barrier to trade taking into account the Community's present international commitments"
² ECJ judgement of 8 October 1980 in case 810/79, Peter Überschär v Bundesversicherungsanstalt für Angestellte
³ Cases 52/75, 78/76, 232/78, 325/82 and 38/89