Shortcomings in EU Data Protection in the Third and the Second Pillars. Can the Lisbon Treaty be Expected to help?

Abstract

This article discusses the role of data protection in the area of police and judicial cooperation (“Third Pillar”), as well as that of the Common Foreign and Security Policy (“Second Pillar”). In other words, data protection in areas of activities of the State where there is significant increase in the importance of storage and exchange of information, and access to this information, as instruments for ensuring security. The article demonstrates that the present arrangements for data protection are not fully satisfactory. It focuses in particular on the shortcomings of the framework for data protection related to the pillar structure of the EU Treaty. In the Third Pillar, there are a number of legislative instruments applying to different situations. Framework Decision 2008/977 is not more than a first step towards a general framework for data protection. In the Second Pillar, there is no general legal framework and there are no specific rules. Furthermore, the pillar structure itself leads to unsatisfactory solutions which the case law of the Court did not fully compensate. The article then analyses to what extent the Lisbon Treaty provides instruments to address these shortcomings. The Lisbon Treaty offers the necessary means to ensure an effective system of data protection applicable to all areas of EU activity. Much will depend on the content and on the timing of the legislation that will eventually be adopted on the basis of the new Treaty, in particular under Article 16 TFEU.

The European Union’s external competence in the data protection field: Is mixity the only way out?

“…Therefore, speculating on a possible AETR/ERTA effect stemming from the DPD would be quite daring on our part 59 . The internal legislation was minimally and partially harmonising the field at issue and, as a consequence, Member States fully kept their treaty-making power in the external layer (Article 29 DPWP, 2007a;2009. In the specific case of the international data transfer regime, the analysis is even easier, as Article 25 DPD clarified (1998a) that both the European Commission and its Member States 60 -specifically, data protection authorities and data controllerscould conduct an "adequate evaluation" (Article 29 DPWP, 2005), but, in the end, they had to cooperate with each other 61 .…”

“…only the Council of Europe's Convention 108, but also over some of the Member States' constitutional legal orders. In these terms, the Charter of Fundamental Rights of the EU (CFREU) was deemed to be founding a new fundamental right on the protection of personal data "in the light of changes in society, social progress and scientific and technological developments" (González Fuster, 2014: 198;Hijmans, 2016: 185-226;Hijmans andScirocco, 2009: 1487).…”

Informational privacy post GDPR – end of the road or the start of a long journey?

“…(paras. [15][16][17]. Bavarian Lager lodged a complaint with the Commission in regard to the restriction on imports.…”

The Issue of Data Protection and Data Security in the (Pre-Lisbon) EU Third Pillar

“…Article 16 TFEU does become subject to Article 6a of UK and Ireland's post-Lisbon Schengen Protocol, 52 which, quite logically provides that any data protection provisions adopted with regard to judicial cooperation and police cooperation which forms part of the Schengen acquis, which either country has not subsequently opted into, will not apply to them. A similar "even more complicated" 53 Schengen relevant derogation has also been provided for Denmark in its post-Lisbon Schengen protocol. 54 The drafting of updates to the EU data protection provisions, therefore, needs to be clear on whether it is to form part of the core EU provisions, or to be subject to the various continuing Schengen opt-out provisions.…”