- Transfers of personal data require a clear legal basis and predictability of the conditions under which intelligence services gain access to data.
- Independent supervision and effective legal remedies must be guaranteed, as well as checks on the necessity and suitability of monitoring measures.
On April 13, 2016, the Article 29 Working Party published a working paper regarding the justification of fundamental rights interference by surveillance measures in the context of transfers of personal data (Working Document 01/2016 on the justification of interferences with the fundamental rights to privacy and data protection through surveillance measures when transferring personal data (European Essential Guarantees)).
According to the working group, four essential guarantees (European Essential Guarantees) would have to be observed in the transfer of personal data in order to protect the fundamental rights of data subjects against surveillance measures by intelligence services:
- Data processing should be based on clear, specific and accessible rules. Accordingly, interventions in fundamental rights require a legal basis. Data subjects should be able to predict the conditions under which intelligence services can gain access to their personal data, the circumstances that may give rise to surveillance measures and the type of surveillance measures that may be carried out.
- The actions of the intelligence services and the implementation of surveillance measures must be necessary and appropriate. It is therefore necessary to weigh the interests of the intelligence services in data access and data collection against the interest of the data subject in the protection of his or her personal data and private and family life.
- An independent supervisory mechanism is needed. Supervision would not necessarily have to be subordinated to a court, but could also be taken over by an independent administrative authority or a parliamentary body. However, the supervisory body must be equally independent and competent in order to be able to actually exercise the necessary supervision.
- Effective legal remedies need to be established. Every data subject must have an effective legal remedy against the access and processing of his or her personal data in connection with surveillance measures by intelligence services.
The Working Party emphasizes that the essential safeguards must also be observed in the transfer of personal data to third countries, since a transfer may only take place to third countries that guarantee an adequate level of data protection from a European perspective.