EuGH i.S. Schrems II (C‑311/18): Stan­dard­klau­seln laut AG wirk­sam

Der Gene­ral­an­walt des EuGH (Attor­ney Gene­ral, AG; Hen­rik Saug­man­ds­gaard Øe) hält die von der EU-Kom­mis­si­on für die Daten­über­mitt­lung in Dritt­staa­ten beschlos­se­nen Stan­dard­ver­trags­klau­seln für wirk­sam. Sei­ne Emp­feh­lung ist hier auf eng­lisch abruf­bar.

Schrems hat­te vor dem vor­le­gen­den Gericht, dem iri­schen High Court, wie folgt argu­men­tiert:

In his refor­mu­la­ted com­p­laint, Mr Schrems claims, first, that the clau­ses in that agree­ment [Grund­la­ge der Daten­über­mitt­lung inner­halb der Face­book-Grup­pe in die USA] are not con­si­stent with the stan­dard con­trac­tu­al clau­ses set out in Deci­si­on 2010/87 and, second­ly, that tho­se stan­dard con­trac­tu­al clau­ses could not in any event justi­fy the trans­fer of the per­so­nal data rela­ting to him to the United Sta­tes. Mr Schrems claims that the­re is no reme­dy that would allow the per­sons con­cer­ned to invo­ke, in the United Sta­tes, their rights to respect for pri­va­te life and to pro­tec­tion of per­so­nal data.

Der AG hält mit Bezug auf die Wirk­sam­keit bzw. Gül­tig­keit der Stan­dard­ver­trags­klau­seln zwar zunächst fest, dass die Stan­dard­ver­trags­klau­seln als Ver­ein­ba­rung inter par­tes die Behör­den des Emp­fän­ger­staats nicht bin­den und des­sen Recht Pflich­ten vor­se­hen kann, die den Anfor­de­run­gen der Stan­dard­ver­trags­klau­seln zuwi­der­lau­fen:

125. In that regard, as, in essence, the DPC, Mr Schrems, the BSA, Ire­land, the Austri­an, French, Polish and Por­tu­gue­se Governments and the Com­mis­si­on have sub­mit­ted, the safe­guards in the stan­dard con­trac­tu­al clau­ses may be redu­ced, or inde­ed eli­mi­na­ted, when the law of the third coun­try of desti­na­ti­on impo­ses obli­ga­ti­ons that are con­tra­ry to the requi­re­ments of tho­se clau­ses on the importer. Thus, the pre­vai­ling legal con­text in the third coun­try of desti­na­ti­on may, depen­ding on the actu­al cir­cum­stan­ces of the trans­fer, (48) make the obli­ga­ti­ons set out in tho­se clau­ses impos­si­ble to imple­ment.

Dies füh­re aber nicht zur Unwirk­sam­keit der Stan­dard­ver­trags­klau­seln. Denn die­se ver­lan­gen vom Daten­ex­por­teur, die Über­mitt­lung ein­zu­stel­len, wenn der Emp­fän­ger sei­ne Pflich­ten Ver­letzt oder nicht ein­hal­ten kann:

132. To my mind, and as Mr Schrems and the Com­mis­si­on have main­tai­ned, Clau­se 5(a) can­not be inter­pre­ted as mea­ning that sus­pen­si­on of the trans­fer or ter­mi­na­ti­on of the con­tract is merely optio­nal whe­re the importer can­not com­ply with the stan­dard clau­ses. Alt­hough that clau­se refers only to a right in that sen­se for the bene­fit of the exporter, that wor­d­ing must be under­s­tood by refe­rence to the con­trac­tu­al frame­work of which it forms part. The fact that the exporter is given a right, in its bila­te­ral rela­ti­ons with the importer, to sus­pend the trans­fer or ter­mi­na­te the con­tract whe­re the importer is unab­le to honour the stan­dard clau­ses is without pre­ju­di­ce to the obli­ga­ti­on pla­ced on the exporter to do so in the light of the requi­re­ments to pro­tect the rights of the per­sons con­cer­ned ari­sing under the GDPR. Any other inter­pre­ta­ti­on would ren­der Deci­si­on 2010/87 inva­lid in that the stan­dard con­trac­tu­al clau­ses which it sets out would not per­mit the trans­fer to be accom­pa­nied by ‘appro­pria­te safe­guards’ as requi­red by Arti­cle 46(1) of the GDPR, read in the light of the pro­vi­si­ons of the Char­ter. (50)

133. In addi­ti­on, accord­ing to Clau­se 5(b) the importer is to cer­ti­fy that it has no rea­son to belie­ve that the legis­la­ti­on app­li­ca­ble to it pre­vents it from ful­fil­ling the inst­ruc­tions recei­ved from the exporter and its obli­ga­ti­ons under the con­tract. In the event of a chan­ge in that legis­la­ti­on that is likely to have a sub­stan­ti­al adver­se effect on the war­ran­ties and obli­ga­ti­ons pro­vi­ded by the stan­dard clau­ses, the importer will prompt­ly noti­fy that chan­ge to the exporter, in which case the exporter is enti­t­led to sus­pend the trans­fer of data and/or ter­mi­na­te the con­tract. In accordance with Clau­se 4(g), the exporter must for­ward the noti­fi­ca­ti­on recei­ved from the importer to the com­pe­tent super­vi­so­ry aut­ho­ri­ty if it deci­des to con­ti­nue the trans­fer.

Über­dies sei­en die Auf­sichts­be­hör­den ver­pflich­tet – und nicht nur berech­tigt –, die Unter­las­sung oder Ein­stel­lung der Über­mitt­lung anzu­ord­nen, wenn der Expor­teur sei­ner dies­be­züg­li­chen Pflicht nicht nach­kommt:

146. Thus, a super­vi­so­ry aut­ho­ri­ty must exami­ne with all due dili­gence the com­p­laint lod­ged by a per­son who­se data are alle­ged to be trans­fer­red to a third coun­try in bre­ach of the stan­dard con­trac­tu­al clau­ses app­li­ca­ble to the trans­fer. (56) Arti­cle 58(1) of the GDPR con­fers on the super­vi­so­ry aut­ho­ri­ties, for that pur­po­se, signi­fi­cant inve­sti­ga­ti­ve powers.
147. The com­pe­tent super­vi­so­ry aut­ho­ri­ty is also requi­red to react appro­pria­te­ly to any infrin­ge­ments of the rights of the data sub­ject which it has estab­lished fol­lo­wing its inve­sti­ga­ti­on. In that regard, each super­vi­so­ry aut­ho­ri­ty has, under Arti­cle 58(2) of the GDPR, a wide ran­ge of means — the various powers to adopt cor­rec­ti­ve mea­su­res listed in that pro­vi­si­on — of car­ry­ing out the task ent­ru­sted to it. […] 148. Alt­hough the choice of the most effec­ti­ve means is a mat­ter for the dis­cre­ti­on of the com­pe­tent super­vi­so­ry aut­ho­ri­ty having regard to all the cir­cum­stan­ces of the trans­fer at issue, that aut­ho­ri­ty is requi­red to car­ry out in full the super­vi­so­ry task ent­ru­sted to it. Whe­re appro­pria­te, it must sus­pend the trans­fer if it con­clu­des that the stan­dard con­trac­tu­al clau­ses are not being com­plied with and that appro­pria­te pro­tec­tion of the data trans­fer­red can­not be ensu­red by other means, whe­re the exporter has not its­elf put an end to the trans­fer.

Der EuGH ist an die Mei­nung des AG aller­dings nicht gebun­den.