EUROPEAN COMMISSION

Brussels, 15.1.2024

SWD(2024) 3 final

COMMISSION STAFF WORKING DOCUMENT

Country reports on the functioning of the adequacy decisions adopted under Directive 95/46/EC

Accompanying the document

Report from the Commission to the European Parliament and the Council

on the first review of the functioning of the adequacy decisions adopted pursuant to Article 25(6) of Directive 95/46/EC

{COM(2024) 7 final}

TABLE OF CONTENTS

I. ANDORRA    

II. REPUBLIC OF ARGENTINA    

III. CANADA    

IV. FAROE ISLANDS    

V. BAILIWICK OF GUERNSEY    

VI. ISLE OF MAN    

VII. STATE OF ISRAEL    

VIII. JERSEY    

IX. NEW ZEALAND    

X. SWITZERLAND    

XI. EASTERN REPUBLIC OF URUGUAY    

I. ANDORRA

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of Andorra

The Commission adopted the adequacy decision for Andorra on 19 October 2010 1 , after having received the opinion of the Article 29 Working Party on 1 December 2009 2 . The decision found that, for the purposes of Article 25(2) of Directive 95/46/EC (Data Protection Directive) 3 , Andorra provided an adequate level of protection for personal data transferred from the EU.

At the time of the adoption of the adequacy decision, the legislative framework for the protection of personal data in Andorra consisted of the Qualified Law 15/2003 of 18 December 2003 on the protection of personal data 4 (LQPDP), as further implemented through two Decrees of 1 July 2004 5 . The LQPDP and its implementing regulations were largely based on the standards of the former Data Protection Directive of the EU.

In November 2020, Andorra initiated a process to modernise the LQPDP, which led to the adoption of the new Qualified Law 29/2021 on the protection of personal data (Data Protection Act) 6 that entered into force in May 2022 7 . As explained in more detail below, the Data Protection Act is closely aligned with Regulation (EU) 2016/679 (GDPR) 8 in its structure and main components, and significantly strengthens the Andorran data protection framework. 

As regards the scope of application, the LQPDP already followed the same approach as the Data Protection Directive, while the new Data Protection Act brings the Andorran data protection framework even closer to the GDPR. It not only defines the key notions of ‘personal data’ 9 , ‘data subject’ 10 and ‘processing’ 11 in the same way as the GDPR, but also introduces definitions for the notions of ‘profiling’ 12 and ‘pseudonymization’ 13 that are identical to the ones used in the GDPR. The Data Protection Act also provides for a more comprehensive protection of personal data by no longer allowing certain specific data protection regulations to prevail over its general rules in case of conflict 14 and by removing certain partial exclusions that existed under the LQPDP 15 .

At the time of the adoption of the Commission adequacy decision, the Andorran data protection framework already contained all the basic data protection principles (i.e., the principles of purpose limitation, data quality and proportionality, transparency, fairness, data minimisation, accuracy, storage limitation, and integrity and confidentiality). Building on that foundation, the Data Protection Act reinforces some of the existing principles, better aligning them with the GDPR.

In particular, as regards the principle of lawfulness, the Data Protection Act specifies and strengthens the notion of consent by adding a definition of this term in its Article 4(2) that is identical to the one used in the GDPR, i.e., requiring that, in addition to being freely given, specific and informed, consent must be unambiguous and expressed by a clear affirmative action 16 . Moreover, the Data Protection Act fully aligns the grounds that are available for processing with those listed in Article 6(1) GDPR 17 . Similarly, the Data Protection Act reinforces the existing transparency requirements by requiring the information of the data subject also in situations where data is not collected directly from the data subject 18 .

The principle of data security has been strengthened in the Data Protection Act with respect to the handling of data breaches. Under the LQPD and its implementing regulations, there was no obligation to notify data breaches affecting personal data. The Data Protection Act establishes a duty for data controllers to notify the supervisory authority (l’Agencia Andorrana de Protecció de Dades, APDA) without undue delay and, if possible, within a maximum period of 72 hours, after becoming aware of a data breach, unless it is unlikely that the data breach constitutes a risk to the rights and freedoms of individuals 19 .

Finally, the Data Protection Act includes several provisions that give effect to the principle of accountability. Under the LQPDP, the APDA had already introduced some aspects of this principle through a guideline, including the need to carry out impact assessments, keep records of processing activities and appoint a data protection officer in certain cases 20 . Chapter IV of the Data Protection Act anchors these and other accountability requirements more firmly into legislation, in particular by imposing an obligation to implement appropriate technical and organisational measures to ensure and to be able to demonstrate that processing is performed in accordance with the law 21 , to implement the principles of data protection by design and default 22 , to carry out data protection impact assessments 23 , to keep records of processing and make them available to the APDA upon request 24 , and to appoint a data protection officer in certain situations 25 .

Importantly, special categories of personal data (or sensitive data) benefit from enhanced protection under the Data Protection Act. The Act expands the current notion of sensitive data to cover all the categories of personal data that are considered ‘sensitive’ under the GDPR 26 . In particular, the categories of genetic and biometric data, data revealing racial origin or philosophical beliefs and data concerning sexual life have been added to the list of special categories 27 . Moreover, the Data Protection Act imposes a general prohibition to process sensitive data and the processing of sensitive data is only allowed in a limited number of situations, corresponding to the situations in which the processing of sensitive data is allowed under the GDPR 28 .

The Data Protection Act also modernises and strengthens the existing provisions on data protection rights. In particular, the provisions on the right to rectification 29 , the right to erasure 30 and the right to object 31 have been fully aligned with the GDPR. For example, the right to erasure now includes an obligation for the controller to take reasonable steps to inform other controllers that are processing the relevant information that the data subject has requested the erasure of his data 32 . The right to object is no longer limited to personal data not collected directly from the data subject, and a specific right to object to direct marketing has been introduced 33 . Moreover, the right of access not only requires the controller to confirm, upon request of an individual, whether or not personal data concerning him/her is being processed, and, where that is the case, give access to that data (as was already the case under the LQPDP), but also requires the controller to provide further information, e.g., the purpose of processing, the categories of personal data that is being processed, the source of personal data, information on the retention period, the right to lodge a complaint with the APDA, the existence of other rights, the fact that the controller intends to transfer the data to third countries, and the existence of automated decision-making 34 .

In addition to the strengthening of existing rights, new rights have been introduced in the Data Protection Act, again mirroring the corresponding rights under the GDPR. In particular, the Data Protection Act provides for specific safeguards and rights for individuals in the context of automated decision-making. First, it requires controllers to provide individuals with information on the existence of automated decision-making when collecting their personal data 35 . Second, when responding to an individual’s exercise of the right of access, controllers are required to provide information on the existence of automated decision-making, as well as meaningful information about the logic involved and the envisaged consequences of such processing for the data subject 36 . Third, the Data Protection Act introduces the right not to be subject to a decision based solely on automated processing. Automated decision-making may only take place under certain conditions, e.g., only where authorised by law or based on the data subject’s explicit consent, and subject to specific safeguards, e.g., informing the individual about the processing, the logic involved and the envisaged consequences 37 . In case of data processing intended for profiling, the controller must implement suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express his or her point of view and to contest the decision. The Data Protection Act also introduces a right to the restriction of processing 38 and a right to data portability 39 , which each correspond to the relevant right in the GDPR.

In terms of restrictions to the exercise of data subject rights, the Data Protection Act clarifies, in identical terms as the GDPR, the conditions for the application of such restrictions by introducing a provision which explicitly sets out that restrictions to data subject rights are only allowed when they respect the essence of the fundamental rights and freedoms and are a necessary and proportionate measure in a democratic society to safeguard certain important objectives of general public interest such as national security, public security and the prevention, investigation, detection or prosecution of criminal offences 40 .

As regards the international transfer of personal data, the Data Protection Act introduces several changes to the existing transfer regime, putting in place a system that is very similar to the rules on international transfers set out in Chapter V of the GDPR in terms of structure and requirements.

As a general principle, international transfers may not be carried out when the third country does not establish, in its current regulations, a level of protection for personal data at least equivalent to that established under the Data Protection Act 41 . Furthermore, when transferring data to a third country, it must be ensured that the level of protection of natural persons established by the Act is not diminished 42 . The Data Protection Act stipulates that whether a third country offers an equivalent level of protection will be determined on the basis of three (alternative) criteria: whether the third country benefits from an adequacy decision from the European Commission, whether the third country has effectively submitted itself to the provisions of the modernised Convention 108 (Convention 108+) and whether the third country is an EU Member State 43 .

International transfers to third countries that do not offer an equivalent level of protection are allowed where the controller or processor has provided appropriate safeguards, and on the condition that enforceable data subject rights and effective legal remedies are available to the data subject 44 . The existence of such appropriate safeguards, enforceable rights and effective remedies will be evaluated by the APDA taking into account a set of factors that are identical to the factors listed in Article 45(2) GDPR. The instruments that can be used to provide for appropriate safeguards are legally binding arrangements, binding corporate rules, standard contractual clauses, whether adopted by the European Commission or the APDA, codes of conduct and certification mechanisms in conformity with EU data protection rules 45 .

Finally, the Data Protection Act reduces and clarifies the derogations for specific situations, i.e., the situations in which transfers can take place to non-adequate third countries and without the existence of appropriate safeguards. The new derogations are laid down in Article 45 of the Data Protection Act and closely resemble the derogations listed in Article 49 GDPR 46 . The Data Protection Act stipulates that they must be interpreted restrictively 47 .

Finally, the Andorran transfer regime has also been amended so that the above-mentioned requirements cover not only transfers of personal data to third countries, but also to international organisations 48 .

1.2.Oversight, enforcement and redress

The independent authority that is charged with oversight and enforcement under the Data Protection Act is the APDA 49 . The Agency oversees compliance with the Data Protection Act by both private entities and by Andorran public authorities 50 . It has the power to carry out inspections and impose sanctions for infringements of the Act 51 . In addition, it carries out a number of additional tasks, such as answering questions from public authorities and private individuals or entities about the application of the data protection legislation, giving its opinion on current and future data protection legislation, raising public awareness about data protection, dealing with complaints it receives, and preparing annual reports on its activities 52 . In carrying out its investigations, the Agency has access to any relevant information, as well as to the premises where processing operations are carried out, including computer systems or other resources used in data processing 53 . It may also compel the production of evidence 54 .

The Data Protection Act integrates in its Chapter VII the provisions of the DPD concerning the APDA without significantly changing the composition, tasks and powers of the agency and the statutory safeguards for its independence 55 . It clarifies some aspects, including the regime on incompatible activities applicable to the Head of the Agency and the inspectors as well as on international cooperation. Furthermore, the Data Protection Act establishes a specific sanctioning regime for public authorities, including reprimands and disciplinary procedures to deal with staff liability 56 . In addition, the decisions concerning public authorities and bodies are made public through publication on the APDA’s website 57 .

As regards possibilities for individuals to obtain redress, the Andorran system continues to offer various avenues, including the possibility to lodge a complaint with the APDA 58 , obtain judicial redress directly against controllers and processors (both private operators and public controllers) 59 and obtain compensation for damages 60 .

Despite its relatively small office, the APDA plays an active role, both when it comes to its engagement with stakeholders and exercising its oversight role.

Since the adoption of the adequacy decision, the APDA has issued several general and specific guidance documents, which cover topics such as the application of the GDPR in Andorra, data processing in the context of COVID-19, the processing of biometric data, international transfers after Brexit, the principle of proportionality, transparency obligations, cookies and obligations of the processor 61 . Furthermore, the APDA has published several guidance documents that aim to inform the general public about data protection, covering topics such as teleworking, smart devices, data subject rights, collection of COVID-19 data in restaurants and instant messaging apps 62 . In addition, the APDA has created several templates and standard forms to support compliance with data protection rules and the exercise of individual rights, including a consent form, templates for the exercise of data subject rights, a model complaint form and an international data transfer form 63 .

Its annual reports show that the APDA handles a number of individual complaints every year. For example, in 2020 it received nineteen complaints for alleged infringements of the LQPDP, in 2019 it received thirteen such complaints, while in 2018 it received sixteen such complaints. These complaints have on various occasions led to enforcement actions. For example, during the period 2019-2020, in thirteen cases the APDA’s inspection service decided to carry out an inspection to establish whether a violation of the rights enshrined in the LQPDP and the DPD had taken place. In all of these thirteen cases a violation was detected and based on the severity of the violation and the number of affected data subjects, the APDA issued binding orders to remedy that violation. According to information received, in one case, a fine was imposed, due to the seriousness of the detected violation and the fact that the violation was a repeated offence 64 .

Finally, the APDA fulfils an important consultative function. Every year it responds to numerous queries made by natural or legal persons, as well as public authorities, with regard to issues that have arisen in the context of their processing activities. For example, in 2020 a total of 2116 of queries were submitted to the ADPA, in 2019 it received 1763 queries, while in 2018 it received 1747 queries. The APDA also actively engages with the general public and stakeholders. For example, in 2020, the APDA engaged in outreach activities to disseminate information about the processing of personal data in the context of the COVID-19 pandemic, aimed both at citizens and those responsible for such processing activities 65 . In the same year, the APDA participated in four television and three radio broadcasts 66 . The APDA also regularly provides training in data protection to professionals. In 2019, for instance, the APDA provided data protection training to the Andorran fiscal intelligence unit (UIFAND) and the Federation of people with disabilities (FAAD) 67 . In 2020, the APDA also analysed a privacy impact assessment concerning the development of a COVID-19 contact tracing app, focusing on the proportionality with respect to the purpose pursued 68 .

2.ACCESS TO AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN ANDORRA

In Andorra, the personal data of EU individuals transferred under the adequacy decision can only be accessed by Andorran public authorities for purposes of criminal law enforcement. In connection with the size of its territory (~464km2) and population (which does not exceed 80 000 inhabitants), there is no specific authority in Andorra engaged in the collection of personal data for national security purposes, nor is there any specific legislation that allows access to personal data for national security purposes 69 . While the Andorran Police may be entrusted with certain tasks in the area of national security 70 , any data collection in that context only takes place to prevent, investigate, detect or prosecute offences under the Criminal Code and under the conditions and limitations set out in the Code of Criminal Procedure 71 .

2.1General legal framework

When collecting and (further) processing personal data for criminal law enforcement purposes in Andorra, public authorities are subject to clear, precise and accessible rules governing the scope and application of a measure and imposing minimum safeguards. These limitations and safeguards follow from the overarching constitutional framework and specific laws that regulate activities in the areas of criminal law enforcement.

First, as an exercise of power by a public authority, government access in Andorra must be carried out in full respect of the law 72 . In particular, fundamental rights and freedoms recognised by the Constitution – which include the right to privacy, honour and reputation 73 and the inviolability of the home and the confidentiality of communications 74 – may only be restricted by means of a so-called qualified law (a law that can only be enacted by qualified majority of the Parliament) 75 . With respect to the inviolability of the home and the confidentiality of communications specifically, the Constitution provides that interferences with these rights are only allowed when a reasoned judicial warrant is issued 76 .

Second, the right to the protection of personal data is also guaranteed through Andorra’s adherence to the European Convention on Human Rights and the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108). In addition, in October 2022, Andorra ratified the amending Protocol creating the modernised Convention 108+ 77 . 

The European Convention on Human Rights protects the right to respect for private and family life (and the right to the protection of personal data as part of it). In particular, pursuant to Article 8 of that Convention, a public authority may only interfere with the right to privacy in accordance with the law, in the interests of one of the aims set out in Article 8(2), and if proportionate in light of that aim. Article 8 also requires that the interference is foreseeable, i.e., has a clear, accessible basis in law, and that the law contains appropriate safeguards to prevent abuse.

In addition, in its case law, the European Court of Human Rights has specified that any interference with the right to privacy and data protection should be subject to an effective, independent and impartial oversight system that must be provided for either by a judge or by another independent body (e.g., an administrative authority or a parliamentary body) 78 . Moreover, individuals must be provided with an effective remedy, and the European Court of Human Rights has clarified that the remedy must be offered by an independent and impartial body which has adopted its own rules of procedure, consisting of members that must hold or have held high judicial office or be experienced lawyers, and that there must be no evidential burden to be overcome in order to lodge an application with it. In undertaking its examination of complaints by individuals, the independent and impartial body should have access to all relevant information, including closed materials. Finally, it should have the powers to remedy non-compliance 79 .

Convention 108 protects the individual’s right to privacy with regard to automatic processing of personal data relating to him (data protection) 80 . Article 9 of Convention 108 provides that derogations from the general data protection principles (Article 5 Quality of data), the rules governing special categories of data (Article 6 Special categories of data) and data subject rights (Article 8 Additional safeguards to the data subject) are only permissible when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences, or for protecting the data subject or the rights and freedoms of others.

Therefore, through adherence to the European Convention on Human Rights and Convention 108, as well as its submission to the jurisdiction of the European Court of Human Rights, Andorra is subject to a number of obligations, enshrined in international law, that frame its system of government access on the basis of principles, safeguards and individual rights similar to those guaranteed under EU law and applicable to the Member States.

These international obligations are anchored in the Andorran legal framework through the Constitution, which provides that international agreements such as the European Convention on Human Rights and Convention 108, from the moment of their publication in the official state gazette, form part of Andorran law and may not be amended or overridden by domestic laws 81 . They are thus of direct application in Andorra and can be directly invoked before the Andorran courts 82 .

Third, the processing of personal data by Andorran public authorities for law enforcement purposes is subject to specific data protection rules under the new Data Protection Act. These specific rules are set out in the Data Protection Act’s third final provision and essentially replicate the core elements of the Law Enforcement Directive. The material scope of these rules is identical to the one of the Law Enforcement Directive. They apply to the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security 83 . Furthermore, the data protection principles of lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation and security are formulated using almost the exact same terms as Article 4(1) Law Enforcement Directive. In addition, these rules impose transparency obligations and, like the Law Enforcement Directive, establish the data subject rights of access, correction and deletion 84 . For the same purposes as those recognised in the Law Enforcement Directive  85 controllers are allowed to deny, in whole or in part, requests to exercise the rights of access, correction and deletion. Controllers may only restrict those rights having due regard to the fundamental rights and interest of the concerned individual 86 . Finally, the Andorran Data Protection Authority (ADPA) is charged with monitoring and enforcing these specific rules 87 .

The specific rules set out in the Data Protection’s Act third final provision anticipate on planned future legislation in this area. In particular, the third final provision instructs the Andorran government to present in Parliament, within two years from the entry into force of the Act (thus in May 2024 at the latest), a bill that regulates in more detail and following the model set out in the Law Enforcement Directive the processing of personal data by competent authorities for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security. The specific rules contained in the third final provision apply until the entry into force of this future legislation. A draft Bill on the processing of personal data by public authorities for law enforcement purposes is currently being prepared.

The Commission services welcome the Andorran legislator’s intention to replace the specific rules by a more permanent and detailed regime that is even further aligned with the rules that apply in the EU. They will closely monitor future developments in this area.

The general limitations and safeguards mentioned above can be invoked by individuals before independent oversight bodies (e.g., the APDA, see section 2.2.3) and courts (see section 2.2.4) to obtain redress.

2.2.Access and use by Andorran public authorities for criminal law enforcement purposes

In Andorra, criminal law enforcement functions are carried out by the police force, officially called the Police Force of the Principality of Andorra (Cos de Policia del Principat d’Andorra), which is headed by the Director. In the specific case of financial crime, the responsible authority is the Andorran financial intelligence unit (UIFAND) 88 . Andorran law imposes a number of limitations on the access to and use of personal data for criminal law enforcement purposes, and it provides oversight and redress mechanisms in this area. The conditions under which access to personal data can take place and the safeguards applicable to the use of these powers are assessed in the following sections.

2.2.1.Legal bases and applicable limitations/safeguards

Personal data transferred under the adequacy decision and processed by organisations in Andorra may be obtained by Andorran law enforcement authorities by means of investigative measures or interception measures under the Code of Criminal Procedure. The Code of Criminal Procedure lays down clear and precise rules on the scope and application of these measures, thereby ensuring that the interference with the rights of individuals will be limited to what is necessary for a specific criminal investigation and proportionate to the pursued purpose 89 . Moreover, to exercise any of these powers, prior judicial authorisation is in principle required 90 . The police only have warrantless powers in exceptional cases, which are specifically listed in the Code of Criminal Procedure 91 . 

To gather evidence, the police may conduct searches of homes or other premises where an offence presumably has taken place. Unless the affected person has given prior and written consent, subject to prior notice that (s)he has the right to refuse, searches may only take place based on a court-issued search warrant 92 . The search warrant must specify the address where the search is to be carried out, the grounds on which it is based and the reasons for conducting it 93 . Moreover, according to established case law of the Constitutional Court interpreting these requirements, the judge issuing the warrant must give a reasoned decision explaining the necessity and proportionality of the measure 94 .

As regards the execution of the search warrant, the Code of Criminal Procedure provides that the search warrant must be presented to any person occupying the home or other premise. In case of the absence of the occupant, the search must be carried out in the presence of a court clerk who must draw up a detailed record 95 .

When conducting a search, the police may seize all assets relating to the offense 96 . Any kind of object may be seized, including computer discs or other data storage devices. The seize power cannot be used, however, to gain access to the content of such devices. If the data stored on the seized device is not accessible without the consent of the owner/holder, a prior judicial authorisation specifically issued to have access to this content is required 97 . According to information received, such authorisation may only be granted under the stricter conditions for the accessing of communications, set out in the Code of Criminal Procedure 98 (see below).

Illegal searches and seizures are subject to criminal sanctions 99 and any evidence that is obtained directly or indirectly through a violation of the fundamental rights and freedoms of individuals is considered inadmissible 100 .

The police may furthermore collect evidentiary material through the interception of communications. The Code of Criminal Procedure recognises three types of communications (telephone, telegraphic and postal) and stipulates that such communications may only be intercepted in the context of a criminal investigation involving a major offence (e.g., drug trafficking) or a minor offence in the area of corruption or influence peddling 101 . In addition, the measure must be necessary for the purpose of seeking the truth 102 .

Interceptions may only take place based on a prior court authorisation 103 . The court order must specify the (major) offence in question, the suspects, the reasons why it is necessary to use this procedure, and all the identifying elements of the communication to be intercepted 104 . Furthermore, it must state the period within which the measure may be carried out. This period may not exceed two months and may be extended twice, by reasoned court order, under the same conditions 105 . In addition, the Code of Criminal Procedure provides that the court must give a reasoned decision explaining the necessity and proportionality of the measure and mentioning the evidence obtained, the seriousness of the offence under investigation and the impact on the fundamental right at stake, which must always be guaranteed in its essence 106 .

As regards the execution of the court order, the Code of Criminal Procedure stipulates that the interception shall be carried out by a person or department designated by the judge, who is bound by professional secrecy and must keep records, under the supervision of the investigating judge 107 . After the interception has been concluded, the individual whose communication has been intercepted must be notified by the court in case the measure did not produce evidence of a crime or in case the court has decreed the total or partial secrecy of the measure 108 , if the confidentiality of the measure is lifted 109 .

Illegal wiretapping and related conduct are subject to criminal sanctions 110 and any evidence that is obtained directly or indirectly through a violation of the fundamental rights and freedoms of individuals is considered inadmissible 111 .

Finally, the UIFAND may obtain personal data through disclosure by private individuals, business organisations or public authorities.

Law 14/2017 112 on the prevention and fight against money laundering and terrorist financing imposes an obligation on persons and undertakings subject to the law, such as financial institutions (so-called ‘parties under obligation’), 113 to report to the UIFAND, on their own initiative, any transaction or attempted transaction related to funds where the party is aware of, knows, suspects or has reasonable grounds to suspect that are the proceeds of criminal activity or are related to terrorist financing, and to promptly respond to requests made by the UIFAND for additional information in such cases 114 . A similar reporting duty applies to Andorran public authorities, including judicial authorities, who discover facts that could constitute indicia or proof of money laundering or terrorist financing. In those cases, they shall inform the UIFAND in writing and make available to it the information that the UIFAND requests in the exercise of its duties 115 .

Prior to notifying the UIFAND, parties under obligation are required by the Act to investigate certain suspicious transactions (e.g., complex or unusually large transactions whose economic or lawful purpose is not apparent) and store, for a period of five years (extendable by UIFAND once for five years) all documents, data and information obtained under the application of the Act, receipts and registers of operations and transactions, account files and business correspondence, and the results of any analysis undertaken, including, where available, information obtained through electronic identification means as set out in the Law on electronic trust services 116 . Any such processing operations performed under the Act by the parties under obligation may only be performed for the purposes of the Act and the concerned data may not be processed in a way that is incompatible with those purposes. Processing of personal data based on the Act for any other purposes, such as commercial purposes, is prohibited 117 .

2.2.2.Further use of the information collected

The further use of data collected by Andorran criminal law enforcement authorities on one of the grounds referred to in Section 2.2.1, as well as the sharing of such data with a different authority for purposes other than the ones for which it was originally collected is subject to safeguards and limitations.

First, the processing of personal data by law enforcement authorities in Andorra is governed by the specific rules set out in the Data Protection Act as described in section 2.1 118 . With respect to onward sharing, it follows from the Data Protection Act that personal data collected for law enforcement purposes may be further processed (whether by the original controller or by another controller) for any other law enforcement purpose, provided that the controller is authorised by law to process data for the other purpose 119 . In this case, all the safeguards provided by the Data Protection Act and, where applicable, the specific rules referred to in section 2.1 apply to the processing carried out by the receiving authority.

Second, the different laws that allow for data collection by criminal law enforcement authorities in Andorra impose specific limitations and safeguards as to the use and further dissemination of the information obtained in exercising the powers they grant.

As regards the powers of search and seizure, the Code of Criminal Procedure provides that a detailed record must be made of all the assets seized 120 . The seized objects must be sealed and added to the investigation file, together with the inventory 121 . The seal on all the seized goods can only be lifted by the trial judge (batlle) or the court 122 . Importantly, the trial judge must adopt the resolutions it deems appropriate to guarantee the restitution of the seized objects if they are not of interest to the case 123 .

With respect to the interception of communications, Article 87 of the Code of Criminal Procedure sets out the safeguards that need to be applied to the intercepted material. Notably, recorded tapes, or the (computer) medium on which the communications are stored, must be fully sealed, and attached to the investigation file. The trial judge chooses the texts or documents to be used in the case. Unused recordings are to be kept as an annex to the file and must be destroyed, along with the used recordings, under the supervision of the judicial authority as soon as the case is closed.

In terms of investigative measures carried out in the context of the fight against money laundering and terrorism financing, Law 14/2017 requires the UIFAND to submit to the Public Prosecutor’s Office the cases in which there is reasonable suspicion of the commission of a criminal offence 124 . It furthermore requires the UIFAND to share with other public authorities in Andorra (e.g., the Police Force, the Customs Service) any information that is essential for the exercise of their functions 125 . The UIFAND may only respond to requests for information from other competent authorities in Andorra when these requests are motivated by concerns relating to money laundering, associated predicate offences or terrorist financing 126 . In exceptional circumstances, where disclosure of the requested information would be clearly disproportionate to the legitimate interests of a natural or legal person or irrelevant with regard to the purposes for which it has been requested, the UIFAND is under no obligation to comply with the request for information 127 .

In addition, the UIFAND is required to share, spontaneously or upon request, any information that may be relevant for the processing or analysis of information by other (foreign) financial intelligence units or equivalent bodies related to money laundering, its predicate offences, or terrorist financing and the natural or legal person involved 128 . The exchange of information requires prior approval from the head of the UIFAND. The party receiving the information must furthermore prove, prior to receiving the information, that certain conditions are met, including that the receiving state shall not use the information for any other purpose than that sought by the Act and that the foreign services receiving the information are bound, under threat of criminal sanction, by a duty of professional secrecy 129 . The UIFAND must use secure channels to exchange information with other financial intelligence units 130 .

Law 32/2021 provides the rules on mutual legal assistance in criminal matters. It stipulates that request for legal assistance that refer to bank accounts or the interception of communications, are executed by the trial judge or the competent court, after hearing the Prosecutor’s Office and after having verified compliance of the request with Andorran law 131 . The request must contain sufficient elements to allow the legality of the requested measure to be assessed in accordance with Andorran law and must be accompanied by the decision of the judicial authority of the requesting state 132 . In view of the subject-matter and reason of the request, and before communicating the recordings or transcripts to the requesting state, the court must destroy the parts of the recordings or transcripts that are not of interest to the criminal procedure for which the measures have been requested 133 . No information obtained from the Andorran authorities through judicial assistance can be used in the requesting state for purposes other than those specified and, more specifically, for other offenses or facts punishable than those that have been indicated there and of which the Andorran judge has been able to assess of the compatibility with Andorran law 134 .

Finally, Andorra has concluded separate international agreements with France and Spain 135 which provide specific safeguards with regard to the sharing of personal data collected for law enforcement purposes. In particular, disclosure can only take place with the express written authorisation of the competent authority of the transferring party, data may only be used for the purposes defined and under the conditions set by the transferring party, and there is a requirement to keep a record of the transferred data 136 .

2.2.3.Oversight

In Andorra, the activities of criminal law enforcement authorities are supervised by different bodies.

First, the APDA is competent to oversee whether the Andorran police complies with the specific data protection rules set out in the Data Protection Act’s third final provision (see section 2.1) 137 . The APDA has the power to carry out inspections and impose sanctions for infringements of the Act 138 . In carrying out its investigations, the Agency has access to any relevant information, as well as to the premises where processing operations are carried out, including computer systems or other resources used in data processing 139 . It may also compel the production of evidence 140 .

Second, an independent Ombudsman (Raonador del ciutadá) is elected by the Andorran Parliament to defend and oversee the fulfillment and application of constitutional rights and liberties and to ensure that the public sector adheres to constitutional principles 141 . It is competent to investigate complaints from individuals who believe their rights have been infringed by the public administration, including the Andorran police 142 . It can also prepare, at its own initiative, reports or recommendations on matters of interest to citizens or society at large, or on matters relating to any of the functions entrusted to him 143 . The independence of the Ombudsman is guaranteed by law 144 . In carrying out its investigations, the Ombudsman has access to all relevant information 145 . Based on the findings of his investigation, the Ombudsman may issue warnings, make recommendations, and otherwise state his views of a case 146 . An annual report is laid before parliament with recommendations based on the Ombudsman’s operations throughout the year 147 . In this report he can also recommend the introduction of changes or modifications in the existing legislation in case he observes a possible violation of human rights 148 .

2.2.4.Redress

The Andorran system offers different (judicial) avenues to obtain redress, including compensation for damages.

First, the Data Protection Act provides the rights of access, rectification, deletion and restriction with respect to personal data processed for criminal law purposes 149 . In the event a controller refuses or restricts the exercise of these rights, the concerned person may lodge a complaint with the APDA 150 . Decisions of the APDA can be appealed in court, after having exhausted the prior internal administrative review procedure 151 . The subsequent judicial process entails a review of the facts and the decision adopted by the APDA, with the judge being able to revoke or rectify the decision if it violates the appellant’s right. The appellant can also claim compensation for damages suffered 152 .

Second, individuals may obtain compensation for damages before Andorran courts. This first of all includes the possibility to claim compensation for violations of the Data Protection Act committed by criminal law enforcement authorities 153 . More generally, individuals may apply for compensation of damages caused by an unlawful interference with the right to privacy, honour and reputation, based on Qualified law 30/2014 on the protection of the civil rights to privacy, honour and reputation 154 .

Third, it follows from Article 41 of the Andorran Constitution that the protection of fundamental rights and public freedoms of individuals, including data protection and privacy rights, is ensured in ordinary courts through an urgent and preferential procedure established by law which, in all cases, shall include two courts. Any action that has violated an individual right can be challenged through these proceedings, including court orders. Applicants must file a lawsuit in writing, signed by a lawyer duly registered to exercise in Andorra, outlining their request and the alleged damage. The case can be brought before the judge at any time, without mandatory deadlines or other requirements. Possible remedies can be a cessation of the offending action, the annulation of the effects that have occurred, the issuance of a rectification order and/or the fixation of an indemnity.

In addition, sentences and orders that violate constitutional rights, including the right to privacy, honor and reputation and the inviolability of the home and the confidentiality of communication, can be challenged before the Constitutional Court through the exceptional judicial remedy of ‘empara’ 155 . An appeal for empara can be filed against rulings dismissing claims brought under the urgent and preferential procedure 156 . The empara appeal must be filed within thirteen business days following the day on which the contested ruling is delivered. Through it, the appellant requests the annulment of the ruling, and, if necessary, the suspension of its effects. If the appeal is upheld, the Constitutional Court will annul the contested ruling and all its effects, declare an infringement of a constitutional right, reinstate the appellant in the fulness of his right and adopt the necessary measures to this end, if necessary. If the violation is materially irreparable 157 , the Constitutional Court determines the type of liability incurred by the public authority who violated the appellant’s right so that compensation can be claimed before the ordinary courts.

Finally, any individual may obtain judicial redress before the European Court of Human Rights against the unlawful collection of his/her data by Andorran criminal law enforcement authorities, provided that all available domestic remedies have been exhausted.

II. REPUBLIC OF ARGENTINA

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of Argentina

The Commission adopted the adequacy decision for Argentina on 30 June 2003 158 , after having received the opinion of the Article 29 Working Party on 3 October 2002 159 . The decision finds that, for the purposes of Article 25(2) of Directive 95/46/EC (Data Protection Directive) 160 , Argentina provides an adequate level of protection for personal data transferred from the EU.

In Argentina, core data protection rights are recognised by the so-called ‘habeas data action’ that was incorporated into the Argentinian Federal Constitution in 1994 161 and that is also part of thirteen provincial constitutions 162 . The recognition of these rights created the basis for the protection of the right to privacy 163 , and served as a foundation for Law 25.326 on Personal Data Protection of 4 October 2000 (Ley de Protección de Datos Personales, LPDP) and Regulation of Law 25.326 approved by Decree No. 1558/2001 (LPDP Regulation).

The LPDP sets out the general data protection principles, the rights of data subjects, the obligations of data controllers and data users, the set-up, tasks and powers of the supervisory authority, sanctions, and rules of procedure in seeking ‘habeas data’ as a judicial remedy. The LPDP Regulation introduces implementing provisions and further clarifies specific aspects of the LPDP.

Both the LPDP and the LPDP Regulation were already in place when the adequacy decision was adopted and continue to apply 164 . However, as will be explained in more detail below, several elements of the Argentinian data protection system have been modernised and further reinforced since the adoption of the adequacy decision.

In particular, in a reform that has significantly strengthened the independence of the Argentinian data protection supervisory authority, the Agencia de Acceso a la Información Pública (AAIP) has been entrusted with overseeing compliance with the LPDP. Moreover, the AAIP has issued a number of binding regulations and opinions which clarify how the data protection framework is to be interpreted and applied in practice, thus helping to keep the LPDP up to date. Through these regulations/opinions, the AAIP (1) clarified the LPDP’s material scope of application by setting out requirements for ‘data dissociation’ (i.e., anonymisation), (2) expanded the notion of sensitive data, (3) strengthened data protection principles (limited data retention, data security, accountability), rights (right to erasure, right to withdraw data or block data processing) and obligations (additional safeguards required for automated decision-making, restrictions on international transfers). Furthermore, new case law of the Supreme Court has clarified the territorial scope of application of the LPDP.

Since the adoption of the adequacy decision, Argentina also strengthened its international commitments in the field of data protection. In 2019, it joined the Council of Europe Convention for the protection of individuals with regard to the automatic processing of personal data and its additional Protocol (Convention 108) 165 . In 2023, Argentina also ratified the amending Protocol creating the modernised Convention 108+ 166 .

While the abovementioned developments in terms of guidance, interpretation and case law contribute to an increased level of data protection in Argentina, codifying these developments in legislation would be important to enhance legal certainty and solidify the protection for personal data. The ongoing debate on a reform of the LPDP – in which the AAIP recently concluded a public consultation on a draft Data Protection Bill that is now slated to be submitted to Congress 167 – seems to offer such an opportunity.

As regards the LPDP, it has a broad personal and material scope of application, applying to both private operators and public authorities 168 . While the definitions of ‘personal data’ 169 , ’controller’ and ‘processor’ 170 , ‘data owner’ (data subject) and ‘data treatment’ (processing) 171 in the LPDP have not changed since the adoption of the adequacy decision, the AAIP has, through guidance, further clarified the notion of ‘data dissociation’ in Article 2 LPDP. This notion is akin to the concept of anonymisation used in Regulation (EU) 2016/679 (GDPR) 172  and refers to the processing of personal data in such a way that the information can no longer be associated with a particular person. The AAIP clarified in its Resolution No. 4/2019 that the data is dissociated from the data subject when the process necessary to re-identify the individual would require disproportionate or unviable means. Moreover, the process should be difficult to perform not only for the data controller, but also for third parties 173 . The AAIP thus relies on factors that are similar to those taken into account under the GDPR to assess whether information can be considered anonymous 174 .

In addition, the scope of application of the LPDP has been clarified with respect to journalistic information sources and databases 175 . The Argentinian Supreme Court 176 and the AAIP 177 established a distinction between investigative activities and other processing activities of media and journalists. On the one hand, to protect the freedom of the press and the secrecy of sources, personal data used to ensure the truthfulness of investigative information does not fall under the LPDP. On the other hand, when media and journalists act as data controllers, for example when displaying advertising on a website, the LPDP does apply to these specific processing activities.

As regards its territorial scope of application, the LPDP distinguishes between provisions that are of general application across the country and those that are not 178 . In accordance with Article 44, the provisions of the LPDP included in Chapters I (General Provisions), II (General data protection principles), III (Data subjects rights), IV (Data controllers and processors of files, registers and databanks) and in Article 32 (Criminal sanctions) are of public order and of general application whenever personal data is processed in the territory of Argentina. Furthermore, Articles 36 and 44 LPDP provide that “registers, data files, databases or data banks which are interconnected through networks at inter-jurisdictional (meaning ‘interprovincial’), national or international level” fall within federal jurisdiction and are thus subject to the provisions of the law, including those set out in Chapter V, VI and VII on the supervisory authority, the sanctions which may be imposed by the supervisory authority and the specific habeas data procedure that applies to such registers, data files, databases or data banks 179 .

Since the adoption of the adequacy decision, several Argentinian courts as well as the Supreme Court have further clarified the interpretation of the notion of “interconnected networks” and thus the scope of application of Chapters V to VII of the LPDP. The judgments clarified in particular that data which is transmitted via the Internet or by any other technical means and can (theoretically) be accessed from all over the country or all over the world is captured by that notion and therefore subject to the provisions of Chapters V to VII of the LPDP, including the competence of the AAIP and the federal judges 180 . On the basis of the case law, data transferred from the EU to Argentina is thus captured by the scope of the entire LPDP, including the provisions regarding the supervisory authority, the applicable sanctions and the habeas data action, as such data is typically transmitted in electronic format via the internet or by other technical means and held in databases that can be accessed via interconnected networks.

The main data protection principles and obligations that were already provided by the LPDP at the time of the adoption of the adequacy decision have remained in place without substantial changes. This is the case for the principles of lawfulness and fairness 181 , purpose limitation 182 , data accuracy 183 , data minimisation 184 and transparency 185 . At the same time, a number of principles and obligations have been further strengthened, in particular through guidance issued by the AAIP. This concerns notably the principles of limited data retention, data security, additional safeguards required for certain types of processing (processing of sensitive data, automated decision-making) and the principle of accountability.

More specifically, the AAIP has further clarified the notion of “suppression” which is relevant in the context of the principle of limited data retention. This principle is enshrined in Article 4(7) of the LPDP, which states that “data shall be destroyed once it has ceased to be necessary or relevant to the purposes for which it has been collected.” This provision is supplemented by Article 4 of the LPDP Regulation, stating that if the data is not required anymore for the purposes for which it was obtained or collected, it has to be supressed without a need for the data subject to request such a suppression. According to the AAIP’s Resolution No. 47/2018 on Recommended Security Measures, to suppress data means to “eliminate or destroy personal data in a definitive way” 186 .

Through the same resolution, the AAIP has also strengthened the principle of data security. First, similarly to the GDPR, the AAIP has reinforced the principles of proactive responsibility and accountability. In particular, it now recommends that organisations are able to demonstrate the appropriateness and effectiveness of the technical and organisational measures used to guarantee the security and confidentiality of the personal data they process. Moreover, the AAIP has issued guidance on how to handle security incidents, recommending that controllers (1) establish internal procedures for dealing with security incidents (2) document security incidents (e.g., the category/ies of affected personal data, the affected users and the measures taken to mitigate the incident and avoid future incidents) and (3) notify the AAIP upon a security incident 187 .

The AAIP has not only introduced the concept of accountability, but it has also issued concrete recommendations to operationalise that principle. In Disposition No. 18/2015 it provides privacy best practices for the development of applications, recommending taking into consideration principles like privacy by design and privacy by default 188 . Second, in Resolution No. 40/2018 it approved a model data protection policy for public bodies that recommends the designation of a permanent data protection officer 189 . Finally, Resolution No. 47/2018 recommends security measures for the processing and storage of personal data that include the implementation of review processes to identify, assess and correct possible vulnerabilities in information systems processing personal data 190 .

In addition to the strengthening of data protection principles and obligations, the protections for special categories of data have been reinforced since the adoption of the adequacy decision. The LPDP defines special categories of personal data as “revealing racial or ethnic origin, political opinions, religious, philosophical or moral beliefs, labour union membership and information concerning health conditions or sexual habits or behaviours” 191 .

Recognising that more modern data protection legislation includes biometric and genetic data in the definition of sensitive data in order to reflect new forms of processing that have emerged in the context of technological transformations, the AAIP has issued guidance on the interpretation of the notion of sensitive data with respect to those categories 192 .

In Resolution 4/2019, the AAIP provides guidance on the notion of sensitive data with regard to biometric data 193 . Biometric data is defined by the AAIP in the same way as in the GDPR 194 . Moreover, the AAIP clarifies that it considers biometric data as sensitive data where it can reveal information the use of which could be potentially discriminatory for the data subject (e.g., data revealing ethnic origin or health-related information) 195 .

With respect to genetic data, which is again defined in the same way as in the GDPR 196 , the AAIP clarifies that genetic data is considered sensitive data when it uniquely identifies a natural person and where it reveals information or information may be deduced from it which is related to the health or physiology of the data subject and the use of which may be potentially discriminatory for the data subject 197 .

It is also worth noting that Argentina has ratified Convention 108+ that requires to treat genetic and biometric data uniquely identifying a person as special categories of data 198 . Therefore, the same categories of sensitive data that are considered sensitive under the GDPR benefit from additional protections in Argentina 199 .

Furthermore, developments in case law, in combination with guidance from the AAIP, have led to a reinforcement and clarification of data subject rights under the LPDP. Importantly, in the case Rodriguez, Maria Belén c/ Google of 2014 the Argentinian Supreme Court created a right to erasure (‘right to be forgotten’) that is similar to the one provided by the GDPR 200 . The Supreme Court required a search engine provider to de-index certain results, further to a careful balancing of the public interest in the information and the right to data protection in the concrete circumstances of the case. The AAIP recently clarified through guidance how this balancing of rights should be performed 201 . Moreover, in its decision Google Inc. c/ Disposición DNODO No. 3/2011 s/Proceso de Conocimiento, of 2011 202 , the AAIP confirmed that not only courts, but also the AAIP itself has the power to enforce the right to be forgotten. Basing itself on the Argentinian Supreme Court’s Rodríguez, María Belén c/ Google judgment and taking into consideration the CJEU’s judgement in Google Spain (C-131/12), the AAIP ordered the de-indexation of certain search results.

In addition, while the LPDP does not explicitly contain a right to object, the AAIP interpreted Article 27 LPDP – which provides for a “right to withdraw [data] or block [data processing]” – to contain a right to object in relation to data processing for marketing purposes. More specifically, in Disposition No. 4/2009, the AAIP required that all direct marketing messages must contain express information on the possibility of withdrawal and blocking, as well as a mechanism to exercise those rights 203 .

Finally, even though the LPDP does not contain a right not to be subjected to automated decision-making for the private sector 204 , the AAIP’s interpretation of the provisions on access to data has created one in practice 205 . Taking into account the current reality that most data processing is carried out in automated forms, the AAIP considered that on the basis of the transparency principle, which requires controllers to provide clear information about the processing, the controller has to provide an explanation about the logic and specific reasons underlying decisions made exclusively on the basis of automated processing 206 . Furthermore, it is worth noting that Argentina has ratified Convention 108+, which explicitly includes the right not to be subject to decisions based solely on automated processing.

As regards restrictions on international transfers 207 , the rules in Argentina have evolved since the adoption of the adequacy decision, increasing the level of protection in case of onward transfers of data originally transferred from the EU. In particular, the AAIP has adopted an approach to international transfers that is similar to the one of the EU.

First, as regards adequacy, the LPDP grants the AAIP the power to adopt adequacy decisions 208 . It currently considers as adequate only countries that have been recognised as providing an adequate level of protection by the European Commission 209 , as well as all EU/EEA Member States 210 . Second, in recent years the AAIP has developed several compliance instruments for international transfers to non-adequate countries and organisations. These are essentially the same mechanisms that are recognised by the GDPR: Binding Corporate Rules 211 , Standard Contractual Clauses 212 and ad hoc clauses/contracts 213 . Finally, the AAIP has clarified the scope of the exceptions to the general prohibition of transfers to countries or international organisations which do not provide adequate levels of protection, set out in Article 12(2) LPDP 214 . The AAIP now explicitly considers that exceptions to the abovementioned requirements must be interpreted restrictively, and that falling within one of these exceptions is not sufficient to provide a legal basis for transfers; all the data protection principles, obligations and rights of the LPDP must be complied with at all times 215 .

1.2.Oversight, enforcement and redress

Since the adoption of the adequacy decision, core elements of the Argentinian system for the monitoring and enforcing of the data protection rules have been strengthened. First, in a reform that has significantly strengthened the independence of the supervisory authority, the AAIP has been charged with monitoring and enforcing the LPDP 216 . Second, the AAIP has adopted two new resolutions that substantially increase the maximum level of fines the Agency may impose. These changes are described in more detail below.

The LPDP provides that ‘the controlling Agency’ shall ensure compliance with its provisions. At the time of the adoption of the adequacy decision, the Dirección Nacional de Protección de Datos Personales (DNPDP) of the Ministry of Human Rights was designated as such. With a view to strengthening the independence of the controlling Agency, the AAIP in 2017 replaced the DNPDP as the supervisory authority for the LPDP. The AAIP was originally created in 2016 as the independent supervisory authority for Law No. 27.275 on Access to Public Information 217 . In 2017, Decree No. 746/2017 expanded its oversight mandate by granting the AAIP additional responsibilities for overseeing compliance with the LPDP 218 and with Law No. 26.951 on the creation of the Do-Not-Call-Register (Registro Nacional No Llame) 219 .

Other than the former DNPDP, the AAIP benefits from a number of institutional and procedural safeguards for its independence 220 . First, Law No. 27.275 on Access to Public information expressly stipulates that the AAIP is set up as an independent entity with functional autonomy within the President’s Chief of Staff Office 221 . Second, as a result of the reform, the system for the designation of the head of the supervisory authority has been reinforced 222 . While the Director of the AAIP is appointed by the Executive (the President of Argentina) for a five-year term that is renewable once 223 , (s)he must be selected through an open and transparent public selection process with a public hearing 224 . This new process has led to increased scrutiny of candidates for the function of Director of the AAIP, as illustrated by the procedure that has recently been followed for the selection of a new Director 225 . The law furthermore requires that the Director may not have any interest in, or links to, matters under his or her own right under the conditions laid down in Law No. 25.188 on Ethics in the Exercise of the Civil Service, and (s)he may not have held an elected or advocate position in the last five years prior to the appointment 226 . In addition, the position of Director is deemed incompatible with any other public or private activity other than part-time teaching 227 . Third, the Director may only be removed by the Executive in agreement with Congress, and only for specific reasons that are listed exhaustively in the law, notably misconduct, criminal offences in the performance of their duties or for common crimes 228 . Finally, the AAIP has its own budget granted under the National Budget Law.

In terms of powers, the LPDP continues to provide that the AAIP may impose sanctions consisting of warnings, suspensions, fines ranging between one thousand pesos ($1 000) and one hundred thousand pesos ($100 000), or the closure or cancellation of the file, register or data base 229 . The use of these powers is regulated by resolutions of the AAIP as the controlling Agency that “shall determine the conditions and procedures for the application of the abovementioned sanctions, which shall be graded in proportion to the seriousness and extent of the violation and the damages arising from such violations, guaranteeing the due process of law principle” 230 .

Importantly, the AAIP in 2022 adopted two new sanctioning resolutions to ensure that the sanctions provided for in the LPDP maintain an adequate deterrent effect and to further strengthen the effectiveness of the sanctioning regime as a whole 231 . These resolutions, which replace two earlier resolutions adopted by the AAIP’s predecessor in 2015/16, increase the level of individual fines that can be imposed for specific categories of infringements and raise the maximum level of fines that the Agency may apply in case of cumulative sanctions.

More specifically, Resolution 240/2022 adjusts the system for the classification and graduation of fines 232 . Like its predecessor, it divides infringements into those of a ‘minor’, ‘serious’ and ‘very serious nature and provides a non-exhaustive list of examples of each. It furthermore determines the maximum fine to be applied to infringements falling within each category. Compared to the previous resolution, the maximum fines for ‘minor’ and ‘serious’ infringements have been raised 233 . The resolution also lists the different factors that the AAIP should take into account when determining the level of the fine to be applied, which are similar to the factors taken account under the GDPR 234 . Resolution 244/2022 then establishes the maximum level of fines to be applied in case of cumulative fines 235 .

With respect to the possibilities for individuals to obtain redress, the Argentinian system continues to offer various avenues, including the possibility to lodge a complaint with the AAIP 236 , to make use of the special judicial remedy for the protection of personal data known as ‘habeas data’, to obtain judicial redress directly against controllers and processors (both private operators and public authorities) 237 and to obtain compensation for damages 238 .

The AAIP plays an active role, both when it comes to its engagement with stakeholders and exercising its oversight role.

In particular, the AAIP each year handles a number of files pertaining to the LDPD, including complaints, consultations and ex officio investigations. For example, according to its annual report, in 2021 the AAIP received 386 complaints concerning possible violations of the LDPD and conducted eight ex officio investigations 239 . In 2020 the AAIP received 239 complaints, dealt with nine written questions and conducted ten ex officio investigations 240 . In 2019, the AAIP handled 214 files, including seven ex officio investigations 241 .

These supervisory activities have led to enforcement action in multiple cases. In 2021, the AAIP imposed eleven fines 242 . For example, on 31 March 2021 the AAIP fined Rappi Arg S.A.S, an on-demand delivery mobile app for not responding in due time to a request for the suppression of the user’s personal data 243 . In 2020, according to its annual report, the AAIP imposed thirteen fines 244 . For instance, on 20 April 2020 the AAIP fined Google Argentina SRL for denying a data subject access to her personal data after her e-mail account was illegally accessed 245 . In 2019, according to its annual report, the Agency imposed eleven fines 246 . For example, on 6 June 2019, Yahoo Argentina SRL was fined in response to a security incident 247 .

Besides fines, the AAIP also applies other sanctions to enforce the LPDP (e.g., warnings, suspension, closure or cancellation of the file, register or database). For example, on 5 February 2020 the Agency issued a warning against the Federal Police in connection with a data breach, a failure to comply with security protocols and a breach of the duty of confidentiality 248 . When investigating private sector controllers, such non-monetary sanctions can also be imposed by the AAIP as a prelude to the imposition of a fine. The AAIP has developed a practice whereby, at the stage of the proceedings where it produces a report on the violations it has found, it simultaneously requires the controller to implement a compliance plan. The extent to which the controller implements this plan is subsequently taken into account when determining the amount of the fine. This approach was for instance followed in a case where a delivery company was found to have breached the security and confidentiality obligations of the LPDP 249 .

In addition to the administrative sanctions that can be imposed for violations of the LPDP, the Criminal Code criminalises certain actions involving data processing. Article 117bis of the Criminal Code makes “knowingly providing false information contained in a personal data file to a third party” punishable by a prison sentence of six months up to six years. Article 157bis makes certain forms of ‘hacking’ (unduly accessing of a database, revealing or supplying confidential information recorded in a file, illegitimately inserting data in a file or database) punishable by a prison sentence of one month up to two years. These crimes are regularly prosecuted. For example, in 2004 an individual was sentenced based on Article 117bis, 156 and 157bis of the Criminal Code for publishing the user database of an internet company on his/her website 250 . In 2007 a public official was prosecuted for unlawfully handing over, transferring, copying, or having intervened in the databases of an agency which contained a list of affiliates of social projects and of unemployed persons 251

Finally, the AAIP has issued a number of binding resolutions and opinions over the years which have helped to keep the LPDP up to date 252 . These opinions and binding resolutions cover topics ranging from the right of access to personal data collected through closed-circuit television cameras, automated processing of data, dissociation of data, biometric data, and consent, including consent of minors (Resolution No. 4/2019) 253 , to the processing of personal data for electoral purposes (Resolution No. 86/2019) 254 and the processing of personal data in the context of the COVID-19 pandemic (Resolution No. 70/2020) 255 .

2.ACCESS TO AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN ARGENTINA

2.1.General legal framework

When collecting and (further) processing personal data for criminal law enforcement purposes in Argentina, public authorities are subject to precise and accessible rules governing the scope and application of a measure and imposing minimum safeguards. These limitations and safeguards follow from the overarching constitutional framework and specific laws that regulate the activities of public authorities in the areas of criminal law enforcement and national security.

First, several provisions of the Argentinian Constitution guarantee the rights to privacy and the protection of personal data. Article 18 of the Constitution stipulates that “the domicile may not be violated, as well as the written correspondence and private papers; and a law shall determine in which cases and for what reasons their search and occupation shall be allowed”. Importantly, the Supreme Court has ruled that these protections extend to communications via the internet 256 . Article 19 declares that “the private actions of men which in no way offend public order or morality, nor injure a third party, are only reserved to God and are exempted from the authority of judges”. The Supreme Court has interpreted this provision as protecting “a sphere of individual autonomy including feelings, practices and customs, family relations, financial situation, religious beliefs, mental and physical health, and, in sum, any actions, events, or information which, considering the lifestyles accepted by the community, are reserved for the individual” 257 . In addition, Article 43 of the Constitution guarantees the right to ‘habeas data’, a special remedy which any data subject can use to “obtain information on the data about himself and their purpose, registered in public records or data bases, or in private ones intended to supply information” and to achieve “the suppression, rectification, confidentiality or updating of said data” in case of “false data or discrimination”.

All laws at both the federal and the provincial levels must conform to the Argentinian Constitution 258 . As described in more detail in sections 2.2.1 and 2.3.1, the general principles following from the Argentinian Constitution are reflected in the specific laws that regulate the powers of law enforcement and national security authorities.

Second, the right to privacy and important aspects of the right to the protection of personal data are also guaranteed through Argentina’s adherence to international conventions.

This includes Argentina’s adherence to the American Convention on Human Rights and its submission to the jurisdiction of the Inter-American Court of Human Rights 259 . Pursuant to Article 11 of the Convention, everyone has the right to the protection of the law against arbitrary or abusive interference with his private life, his family, his home, or his correspondence. In accordance with Article 30 of the Convention, a public authority may only interfere with the right to privacy in accordance with laws enacted for reasons of general interest and in accordance with the purpose for which such restrictions have been established. These protections apply to all persons falling under the jurisdiction of the state parties to the Convention, irrespective of their nationality 260 .

While the Inter-American Court of Human Rights has not yet explicitly recognised the right to the protection of personal data as part of the right to privacy, it has ruled that the protections offered by this right extend to telephone conversations 261 . In addition, the Court has specified that, to determine if an interference with the right to privacy is arbitrary or abusive, three factors must be considered: (1) it must be established by law (2) it must have a legitimate purpose, and (3) it must be appropriate, necessary and proportionate 262 . Regarding the first factor, the Court has clarified that the law on which the interference is based must be clear and precise with detailed rules to establish the boundaries of the restriction. This includes the specific circumstances in which the restriction applies, who can request, order and carry out the restriction, and procedurally how to implement it 263 .

Article 75(22) of the Argentinian Constitution stipulates that the American Convention on Human Rights and other human rights treaties specifically mentioned in that provision (e.g., the International Covenant on Civil and Political Rights) enjoy “constitutional rank”. As such they have a higher hierarchy than laws and may only be terminated with the approval of two-thirds of all the members of each House of Congress 264 .

In 2019, Argentina acceded to the Council of Europe Convention 108 for the protection of individuals with regard to the automatic processing of personal data and its Additional Protocol, regarding supervisory authorities and transnational data flows (Convention 108) 265 . On 17 April 2023 Argentina also ratified the amending Protocol creating the modernised Convention 108 (Convention 108+) 266 . Article 9 of Convention 108 provides that derogations from the general data protection principles (Article 5 Quality of data), the rules governing special categories of data (Article 6 Special categories of data) and data subject rights (Article 8 Additional safeguards to the data subject) are only permissible when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences, or for protecting the data subject or the rights and freedoms of others. The guarantees set out in Convention 108 are extended to every individual regardless of nationality or residence 267 .

Therefore, through adherence to the American Convention of Human Rights and Convention 108, as well as its submission to the jurisdiction of the Inter-American Court of Human Rights, Argentina is subject to a number of obligations, enshrined in international law, that frame its system of government access on the basis of principles, safeguards and individual rights similar to those guaranteed under EU law and applicable to the Member States.

Third, the processing of personal data by Argentinian public authorities, including for law enforcement and national security purposes, is subject to the LPDP 268 .

The LPDP limits the processing of personal data by law enforcement and national security authorities to what is “necessary for the strict compliance with the duties legally assigned to such bodies for (….) public security or the punishment of crimes” 269 . It contains the principles of lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation and security 270 . Furthermore, the LPDP imposes specific transparency obligations 271 and recognises the data subject rights of access, rectification and erasure (‘suppression’) 272 . Controllers are allowed to deny, in whole or in part, requests to exercise the rights of access, correction and deletion (‘suppression’), but only for specific purposes listed exhaustively in the law and similar to the purposes that allow for a restriction of data subject rights in the EU data protection framework 273 . These exemptions are not absolute but require the relevant authority to decide on a case-by-case basis whether and to what extent to apply them, after balancing the relevant interests at stake, including the privacy interests of the concerned individual 274 .

The LPDP and LPDP regulation also contain specific provisions on international transfers to a third country or international organisation 275 . As explained previously (section 1.1), these provisions follow an approach similar to the one of the EU data protection framework. Essentially, international transfers are prohibited, unless (1) the AAIP has found that the third country or international organisation provides “adequate levels of protection”, (2) such adequate protection is ensured through contractual arrangements between the data exporter and importer or a “self-regulation system”, or (3) an exception for a specific situation applies 276 .

Finally, the AAIP is charged with monitoring and enforcing these specific rules at the federal level 277 . As regards oversight and enforcement at the provincial level, the LPDP fully applies – including its provisions on supervision by the AAIP – to personal data that is stored in a database that can (theoretically) be accessed from all over the country or all over the world 278 .

These abovementioned limitations and safeguards can be invoked by individuals before independent administrative bodies (e.g., the AAIP) and courts to obtain redress, in particular through the habeas data action (see sections 2.2.2, 2.2.3, 2.3.2 and 2.3.3).

2.2.Access and use by Argentinian public authorities for criminal law enforcement purposes

In Argentina, criminal law enforcement functions are carried out by different authorities. At federal level, these include the federal police force, as well as other bodies with specific competences, such as the Gendarmerie and the Prefecture and Airport Police. In the specific case of financial crime, the responsible authority is the Financial Information Unit (UIF) 279 . At the provincial level, criminal law enforcement functions are carried out by the provincial police forces. Argentinian law imposes a number of limitations on the access and use of personal data for criminal law enforcement purposes by each of these authorities and provides oversight and redress mechanisms. The conditions under which such access can take place and the safeguards applicable to the use of those powers are described in the following sections.

2.2.1.Legal bases and applicable limitations/safeguards

Personal data transferred from the EU on the basis of the adequacy decision and subsequently processed by Argentinian controllers/processors may be obtained by Argentinian authorities for criminal law enforcement purposes by means of investigative measures under, at federal level, the Federal Code of Criminal Procedure (Código Procesal Penal Federal, CPPF) 280 . At the provincial level, access by Argentinian public authorities to personal data transferred under the adequacy decision is governed by the provincial codes of criminal procedure, which provide for conditions, limitations, and safeguards for the access to personal data that are similar to the ones provided by the laws at federal level 281 .

The CPPF provides Argentinian criminal law enforcement authorities with a legal basis to access personal data held by controllers/processors through searches and seizures, data seizures, the use of production orders, or the interception of communications. It lays down clear and precise rules on the scope and application of these measures, thereby ensuring that the interference with the rights of individuals will be limited to what is necessary for a specific criminal investigation and proportionate to the purpose pursued. Moreover, to exercise any of these powers, prior judicial authorisation is in principle required 282 .

More specifically, searches or seizures may only be carried out if there is a reasonable belief that evidence related to an investigation, or a suspect related to a crime may be found in a home or other place 283 . In terms of procedural safeguards, a search or seizure may only take place on the basis of a court-issued warrant 284 . Warrantless searches or seizures are allowed only in a limited number of exceptional circumstances set out in the CPPF 285 . The person subject to the search is always notified of the search and is in principle present when it is carried out. Where this is not the case, this must be recorded in the minutes of the search 286 . Searches and seizures must be carried out with as little interference as possible with the right to privacy 287 . Moreover, certain communications between the defendant and individuals who must abstain from being a witness (spouse, partner, family member, lawyers, etc.) and objects may not be seized (notes that these individuals might have taken about confidential communications with the defendant or any other circumstances to which the right or duty to abstain from witnessing is extended) 288 . Finally, illegal searches are subject to criminal sanctions 289 and any evidence that is obtained directly or indirectly through a violation of the fundamental rights and freedoms of individuals is considered inadmissible 290 .

Specific limitations and safeguards apply to data seizures, defined in the CPPF as the seizure of an entire or partial computer system or data stored on a storage disk or hard drive, with the purpose of seizing the elements of the system, copying the system, or preserving data or information of interest for the investigation 291 . The rules that apply to searches and searches, described above, apply mutatis mutandis to data seizures (e.g., data seizures can in principle only take place based on a judicial warrant). Illegal accessing of computer data is subject to criminal sanctions 292 and any evidence that is obtained directly or indirectly through a violation of the fundamental rights and freedoms of individuals is considered inadmissible 293 .

Argentinian law enforcement authorities may furthermore obtain personal data through the interception of communications 294 . This power may only be used in the context of a criminal investigation and on the basis of a judicial warrant 295 . An interception of communications may be authorised whenever this is “useful for the investigation of a crime” 296 . Importantly, the Supreme Court, in its capacity as head of the Argentinian judiciary, has introduced additional conditions for the interception of communications by issuing guidelines, addressed to all judicial bodies, which clarify that the interception of communications is “an exceptional measure that may only be authorised with a restrictive approach” 297 . Moreover, based on settled case-law of the Supreme Court and the Inter-American Court of Human Rights, any interference with the inviolability of communications must be provided for by law, pursue a legitimate aim and comply with the requirements of suitability, necessity and proportionality 298 .

Procedurally, interception requests must be submitted to federal judges 299 , who must approve interception warrants before the interception is conducted by or at the request of the Legal Assistance Directorate for Complex and Organised Crime, a subsidiary body of the Supreme Court 300 . An interception warrant is only valid for a maximum period of 30 days and may be renewed by the court once for the same period, if there are reasons that justify the prolongation of this term given the nature and circumstances of the crime under investigation 301 . The interception must be stopped if the reasons used to authorise the measure disappear, or once the interception warrant has expired or its aim has been achieved 302 . According to explanations received from the AAIP, the defendant will be notified during the criminal proceedings of any interference with his/her privacy, when this no longer endangers the investigation, to enable him/her to contest the legality of that measure and exercise his/her constitutional right of defence in court 303 .

Illegal wiretapping and related conduct are subject to criminal sanctions 304 and evidence that is obtained directly or indirectly through a violation of the fundamental rights and freedoms of individuals is considered inadmissible 305 .

Under the CPPF, criminal law enforcement authorities may also obtain a production order from a court, ordering a person to hand over objects or documents under his/her power that can serve as evidence 306 . When the production order is not being complied with, the sought-after objects or documents may be seized.

Finally, the UIF may obtain personal data through disclosure by private individuals, business organisations or public authorities.

Law 25.246 imposes an obligation on persons and undertakings subject to the law, such as financial institutions (so-called “parties under obligation”) 307 , to report to the UIF, on their own initiative, any suspicious fact or transaction, regardless of the amount involved 308 . A suspicious transaction is defined as “those transactions which, in accordance with the customs and practises of the activity in question, as well as the experience and suitability of the persons obliged to report, are unusual, without economic or legal justification or of unusual or unjustified complexity, whether carried out on an isolated or repeated basis” 309 . Prior to notifying the UIF, parties under obligation are required to identify their clients, determine the origin and legality of their funds and to store, in physical or digital form, the information collected on their clients for a minimum period of five years. This information must allow for the reconstruction of transactions carried out, whether domestical or international, and be available for the UIF or the competent authorities when required by them 310 .

2.2.2.Further use of the information collected

The further use of data collected by Argentinian criminal law enforcement authorities on one of the grounds referred to in Section 2.2.1, as well as the sharing of such data with a different authority for purposes other than the ones for which it was originally collected (so-called ‘onward sharing’), is subject to safeguards and limitations.

First, the processing of personal data by law enforcement authorities in Argentina is governed by the LPDP as described in section 2.1. With respect to onward sharing, it follows from the LPDP that personal data collected for law enforcement purposes may be shared with other public authorities for purposes directly related to the legitimate interests of the original controller and the recipient 311 . In this case, the recipient shall be subject to the same regulatory and legal obligations as the controller disclosing the data and the latter shall respond jointly and severally for the observance of such obligations before the AAIP and the data subject 312 . Even though the further processing does not require the consent of the data subject in this case 313 , the Argentinian authorities have confirmed that, in accordance with the LPDP 314 , the data subject must nevertheless be informed about the purpose of the processing and the identity of the recipient, or other elements that enable the data subject to identify the recipient. Moreover, these requirements are without prejudice to the principles, obligations and rights provided for in the LPDP (e.g., the purpose of the onward sharing has to be compatible with the original purpose of collection). The LPDP and LPDP regulation furthermore contain specific provisions on international transfers to a third country or international organisation. As explained previously (see section 2.1), these provisions follow an approach similar to the one of the EU data protection framework.

Second, the different laws that allow for data collection by criminal law enforcement authorities in Argentina impose specific limitations and safeguards as to the use and further dissemination of the information obtained in exercising the powers they grant.

As regards the powers of search and seizure, the CPPF provides that seized objects must be described, inventoried and placed in safe custody to prevent their modification or substitution 315 . Seized objects that are not subject to confiscation, restitution or embargo must be returned immediately to their owners, after carrying out the procedures for which they were obtained 316 . Regarding data seizures, the CPPF notably provides that any elements that are seized, but are unrelated to the investigation, must be returned to their rightful owner and that any copies that have been made must be destroyed. The data subject may turn to the judge to ensure that the elements are returned and that any copies are destroyed 317 .

With respect to the interception of communications, the CPPF sets out the safeguards that need to be applied to the intercepted material. The officials in charge with the execution of the interception warrant and/or those who are responsible for the evidence are bound to a duty of confidentiality with respect to the information obtained. Those who fail to comply with this duty can be held criminally liable 318 . Once the correspondence or intercepted elements have been obtained, a representative from the Public Prosecutor’s Office must open them, examine the elements and read the contents of the correspondence. The representative must subsequently explain to a judge, in a one-party hearing, how and why the seized objects are related and necessary to the investigation. The judge must keep any remaining content confidential and order its return to the defendant, his or her representatives, or close relatives 319 . At the end of the proceedings, the sound records of the communications and transcripts that have been made must be protected from public access. They may not be accessed for any purpose, except by court order, and for justified reasons 320 .

In terms of investigative measures carried out in the context of the fight against money laundering and terrorism financing, Law 25.246 requires the UIF to submit to the Public Prosecutor’s Office the cases in which there is reasonable suspicion of the commission of a criminal offence 321 .

Finally, Law No. 24.767 provides the rules on mutual legal assistance in criminal matters 322 . This law only applies when there is no mutual legal assistance treaty in place between Argentina and the requesting State 323 . In such cases, the law provides that Argentina shall render to any State that so requires the widest assistance in the investigation, prosecution and punishment of offences falling within its jurisdiction 324 . Under this ‘principle of broad and prompt cooperation’ the granting of assistance (e.g., the provision of evidence, the execution of a search warrant or the interception of communications) is in principle an obligation for the Argentine authorities 325 . However, the request for assistance must be admissible 326 and the obligation to grant assistance does not apply if the assistance sought involves the seizure of property, search of premises, surveillance of persons, postal interception, or phone tapping 327 .

2.2.3Oversight

The activities of Argentinian criminal law enforcement authorities are supervised by different bodies.

First, the AAIP is competent to oversee the processing of personal data by Argentinian criminal law enforcement authorities 328 . The AAIP can, at its own initiative or acting on a complaint by an individual, investigate potential violations of the provisions of the LPDP or its complementary rules 329 . In carrying out its oversight activities, the AAIP has access to all relevant information. In particular, it may request information from public authorities, which are required to provide background, documents, software or any other elements relating to personal data that such entities may be required to process 330 . In addition, it may request a judicial authorisation to access data processing premises, equipment, or software to verify violations of the LPDP 331 .

If the AAIP finds a violation of the LPDP, it provides the relevant public authority with a decision stating that the facts investigated constitute an infraction, who is responsible for that infraction, and the sanction to be applied 332 . For example, in 2019 the Agency carried out an ex officio investigation into the Argentinian Federal Police over the leaking of information from its databases 333 . This investigation established that the police had not taken the necessary measures to ensure the security and confidentiality of the personal data processed. As a consequence, the AAIP issued three warnings to the Federal Police, two for having breached the duties of data security and confidentiality and one for not having fully cooperated with the AAIP’s investigation.

Second, the Argentine Constitution provides for an independent Ombudsman (Defensor del Pueblo) to be elected by the Argentine Parliament whose mission is “the defense and protection of human rights and other rights, guarantees and interests protected in this Constitution and the laws, against facts, acts or omissions of the Administration; and control of the exercise of public administrative functions” 334 . It may investigate, ex officio or at the request of an individual, any act or omission of the public administration or its agents that involves the illegitimate, defective, irregular, abusive, arbitrary, discriminatory, negligent, seriously inconvenient or inappropriate exercise of their functions, including those capable of affecting diffuse or collective interests 335 . The independence of the Ombudsperson is guaranteed by law 336 , and in carrying out its investigations the Ombudsman has access to all relevant information 337 .

Based on the findings of his investigation, the Ombudsman may issue warnings and recommendations, reminders of the public authority’s legal and functional duties, and proposals for the adoption of new measures 338 . If the Ombudsman through his work becomes aware of potential crimes committed by public authorities, he must immediately notify the Attorney-General 339 . The Ombudsman is required to lay an annual report before Parliament with an account of the number and types of complaints submitted, those that have been rejected and the reason for their rejection, as well as those that have been investigated and their outcome 340 . According to the last figures available, the Ombudsman in 2022 initiated 234 ex officio investigations and received 12.210 complaints from citizens 341 .

Finally, different specialised bodies play a role in ensuring law enforcement authorities’ compliance with data protection law, for example the General National Syndicate (SIGEN) and the General National Auditor (AGN) 342 . The SIGEN responds to the President of Argentina and has investigative powers to undertake or coordinate independent audits into, inter alia, the legality of public authorities’ actions, which could include data protection law 343 . The AGN reports to the National Congress and enjoys similar powers 344 .

2.2.4Redress

The Argentinian system offers different (judicial) avenues to obtain redress, including compensation for damages.

First, individuals have a right to obtain access to and rectification or deletion (‘suppression’) of their data held by public authorities.

The LPDP provides that data subjects have the right to request and obtain information on their personal data included in, inter alia, public data registers or databanks 345 . In addition, every person has the right to rectify, update, and when applicable, suppress or keep confidential his or her personal data included in a data bank 346 . Both the right of access and the right to rectification and deletion may be exercised free of charge 347 . The relevant public authority may only refuse requests based on the right of access and the right to rectification and deletion in the interest of safeguarding certain important public interest (i.e., public order, the investigation of crimes and the verification of administrative violations) or to protect the rights and interests of others 348 . These exemptions are not absolute but require the relevant authority to decide on a case-by-case basis whether to invoke them, after balancing the relevant interests at stake, including the privacy interests of the individual concerned 349 . As will be explained in more detail below, individuals whose requests have been denied have the possibility to pursue the special judicial remedy of ‘habeas data’ to gain access to their data or to have that data rectified or deleted 350 .

Second, any individual may lodge a complaint with the AAIP in respect of any matter relating to the handling of personal information by a criminal law enforcement authority 351 . As described in section 2.2.3, if the AAIP finds a violation of the LPDP, it provides the relevant public authority with a decision stating that the facts investigated constitute an infraction, who is responsible for the infraction and what is the administrative sanction to be applied 352 . Decisions of the AAIP may be challenged before the courts in accordance with Title 4 of the Law on Administrative Procedure 353 . The court may declare the decision void 354 . Decisions that are declared void must be revoked or replaced by the AAIP 355 .

Third, judicial redress is available to all data subjects via the constitutional right to a habeas data action. The LPDP provides the conditions for a habeas data action before courts against actions by public authorities 356 . Once the deadline for the controller to either provide the information requested by the data subject, or to correct, delete or update the information, has expired and the controller has not complied with the request, or if the data subject considers the response insufficient, s/he may initiate a judicial habeas data procedure 357 . Importantly, the Supreme Court has ruled that the standing requirement for a habeas data action against a public authority must be interpreted extensively in order to facilitate the exercise of the fundamental right to privacy as enshrined in Article 43 of the Constitution 358 .

Judicial redress is also available via the general civil and administrative law actions available against public authorities, including law enforcement authorities.

First, data subjects may pursue a claim for the compensation of damages 359 in court, subject to the four basic requirements for any damages claim under Argentinian law: illegality of the damaging action; real and actual damage; cause-effect relationship between the action and the damage; and negligence, wrongful misconduct and fault. Second, a preventative action 360 would allow a data subject to request a judge to impose preventive restrictions and obligations on a data controller before there is specific damage, if the data subject is in a position to prove that the damage has a qualified probability to occur. Third, via a generic action 361 a data subject may request a judge to make a controller comply with any of the mandatory principles of the LPDP, even if he has not filed a complaint with the AAIP. This type of remedy is available when the habeas data action is not possible, i.e., when the action does not concern the exercise of a right of access, rectification or deletion of personal data. In practice, this type of action is most often combined with a claim for damages. Fourth, through an action for annulment 362 an individual who has been the object of a criminal investigation may challenge the court orders affecting him. This type of action can only be brought after the facts affecting his or her privacy have occurred. In case the challenge is rejected, the individual can request a review by the superior court. Moreover, under certain circumstances, the individual can become a plaintiff in the criminal proceeding. Finally, Article 52 of the Civil and Commercial Code establishes that any individual harmed in his or her personal or family privacy, honour or reputation, image or identity, or who in any way has his or her personal dignity undermined, may claim prevention and reparation of the damage suffered.

Finally, when all national redress avenues are exhausted, data subjects may lodge a case before the Inter-American Court of Human Rights for any violation of their fundamental right of privacy enshrined in the American Convention on Human Rights.

2.3Access and use by Argentinian public authorities for national security purposes

In Argentina, two agencies may access personal data transferred from the EU to Argentina for national security purposes: the Federal Intelligence Agency (AFI) and the National Criminal Intelligence Directorate (DINICRI). The AFI is the highest-ranking intelligence agency in Argentina and the director of the so-called National Intelligence System, which consists of the AFI, the DNICRI and the National Military Intelligence Directorate (DINIEM) 363 . The AFI was established in 2015 by Law 27.126 on the creation of the Federal Intelligence Agency and Presidential Decree No. 1311/2015 approving the “New National Intelligence Doctrine”, as part of a major overhaul of Argentina’s intelligence services 364 . In accordance with Article 2(5) of Law 25.520 (National Intelligence Act) and Decree No. 1311/2015, the basic task of these intelligence agencies is to generate knowledge for the purpose of contributing to decision-making in relation to matters relevant to national defence and internal security 365 . More specifically, the AFI is tasked with producing (1) national intelligence and (2) criminal intelligence related to complex federal crimes 366 . The DINICRI is tasked with producing criminal intelligence unless it is related to complex federal crimes 367 . The relevant powers of these agencies, as regulated by the National Intelligence Act and its regulatory decree are described in the following sections.

2.3.1Legal bases and applicable limitations/safeguards

Based on the National Intelligence Act and Decree No. 1311/2015, the AFI and DNICRI may access personal data transferred from the EU to Argentina as part of different activities, which are subject to specific limitations and safeguards following from the National Intelligence Act itself, from the LPDP, the Argentinian Constitution, the Argentina Digital Act, and case law.

Pursuant to the National Intelligence Act, the intelligence agencies must “unequivocally frame their activities within the general prescriptions of the Personal Data Protection Act 25.326” 368 . Therefore, the accessing of personal data transferred from the EU to Argentina by these agencies for national security purposes may only take place in so far this is necessary for the performance of their legal duties 369 .

According to Decree No. 1311/2015, the task of the intelligence agencies is to develop “intelligence information, which comprises the body of observations and measurements obtained or gathered from public or classified sources concerning an event or relevant issues in the field of national defence or internal security” 370 . It furthermore specifies that intelligence is developed through three core institutional tasks: information gathering, information management and information analysis. Specifically with regard to the AFI, the decree stipulates that the AFI may, for the purpose of the production of national intelligence, engage in “the collection, gathering and analysis of information on facts, risks and conflicts affecting national defence and internal security through the agencies that are part of the National Intelligence System” 371 . This activity involves the gathering of strategic intelligence 372 and (ii) counterintelligence 373 . Furthermore, to produce criminal intelligence relating to complex federal crimes, the AFI may engage in “the collection, systematisation and analysis of information on the criminal issues in question using AFI resources” 374 .

The use of these powers is subject to limitations and safeguards that are specifically designed to prevent their (mis)use for political purposes and operations, and to ensure the protection of fundamental rights, including those guaranteed by Article 18 and 19 of the Argentinian Constitution. In particular, the Act provides that no intelligence agency may (1) exercise law enforcement powers or carry out criminal investigations (2) produce intelligence based solely on sensitive data of data subjects or (3) interfere in any way with the country’s institutional, political, military, police, social or economic situation, its foreign policy, its political parties, public opinion, individuals, media or associations of any kind 375 .

In terms of procedural safeguards, any intelligence activity must be ordered by the highest body of each authority 376 . Moreover, any intelligence activities involving the interception of private communications of any kind 377 may, without exception 378 , only be carried out when authorised by a judicial warrant 379 .

An interception warrant may only be issued when this “is necessary in the conduct of intelligence or counter-intelligence activities” 380 . Procedurally, interception requests must be submitted to federal judges with criminal competence by the Intelligence Secretariat or an official to whom that power is expressly delegated. Requests must be in writing, justified and must precisely indicate the telephone number(s) or e-mail address(es) or any other facilities/means, intended to be intercepted or collected 381 . As explained above (see section 2.1.1), once approved, the interception may only be conducted by or at the request of the Legal Assistance Directorate for Complex and Organised Crime, a subsidiary body of the Supreme Court 382 . An interception warrant may be granted for a period no longer than sixty days, a period which automatically expires unless it is extended by the judge (or the respective Chamber in the event of a refusal at first instance) when necessary to complete the ongoing investigation, and such an extension may only be for up to sixty days 383 . After the expiry of the time-limit for the initial collection established by judicial order, another judicial order must be issued to determine whether the retention should be prolonged or whether the data should be destroyed 384 .

The role of the judge in assessing the request for an interception warrant is essentially to verify whether the warrant sought is reasonable in light of the facts put forward. This follows from guidelines, issued by the Supreme Court, on the interception of communications (see section 2.2.1) 385 . These guidelines, which address all judicial bodies, clarify that the interception of communications is “an exceptional measure that may only be authorised with a restrictive approach” and that the warrant authorising the interception must be “well founded” and “may not granted on the basis of generic terms.” Moreover, based on settled case-law of the Supreme Court and the Inter-American Court of Human Rights, any interference with the inviolability of communications must be provided for by law, pursue a legitimate aim and comply with the requirements of suitability, necessity and proportionality 386 .

Lastly, violations of the above-mentioned rules are subject to criminal sanctions. Those who, in the permanent or transitory development of the tasks regulated by the National Intelligence Act, “unduly intercept, seize or divert telephonic, postal, telegraphic or fax communications or any other type of information, archive, record and/or private documents whose reading is not authorised nor accessible to the public, and that have not been addressed to them” may be punished by three to ten years of imprisonment and professional disqualification for twice that time 387 . The same sentence is incurred by any official or civil servant who carries out intelligence activities prohibited by Laws No 23.554 (National Defence), Law 24.059 (Internal Security) or the National Intelligence Act 388 . Anyone who fails “to destroy or eliminate the records of wiretaps, copies of postal, cable and fax interceptions or of any other element that accounts for the interceptions, recordings or diversions” after having been compelled to do so by judicial order or otherwise incurs a prison sentence from two to six years and professional disqualification for twice that time 389 .

2.3.2Further use of the information collected

The processing of personal data by the AFI and DINICRI is subject to the LPDP (see sections 2.1 and 2.3.1). In addition, the National Intelligence Act sets out specific safeguards for the storage of data collected by the intelligence agencies. It stipulates that “data which, once stored, is not used for the purposes laid down by this Law, is destroyed” and prohibits the storage of data in intelligence databases “for reasons of race, religious faith, private actions, political opinion, membership of or membership of advocacy, social, human rights, trade unions, community, cooperatives, care, cultural or labour organisations, as well as their lawful activity in any sphere” 390 .

With respect to the further sharing of data with other entities (within or outside Argentina), the National Intelligence Act and the LPDP (which applies to intelligence services, as explained in section 2.1) impose specific limitations. Based on Article 11 LPDP, personal data collected for national security purposes may only be shared with other public authorities for purposes directly related to the legitimate interests of the original controller and the recipient, subject to the conditions and safeguards described in section 2.2.2. Furthermore, the National Intelligence Act provides that the disclosure or dissemination of personal data, acquired by intelligence agencies in the course of their duties, requires a judicial order and a presidential authorisation pursuant to Article 16 of the Act 391 , except when the disclosure or dissemination is provided for in a legal provision 392 .

Based on the LPDP, the transfer of any type of personal data to third countries or international organisations which do not provide adequate levels of protection, is prohibited, subject to limited exceptions (e.g., when the transfer is made for international cooperation purposes between intelligence agencies in the fight against organized crime, terrorism and drug-trafficking) 393 . However, as explained above (see section 1.1.), these exceptions must be interpreted restrictively. Falling within the scope of one of these exceptions is not sufficient to ensure the lawfulness of the transfer; all the data protection principles, obligations and rights of the LPDP must be always complied with.

2.3.3Oversight

The activities of Argentinian national security authorities are supervised by different bodies.

First, the AAIP oversees the activities of the AFI and DINICRI, as provided for in the LPDP and the National Intelligence Act. This oversight follows similar conditions as in a law enforcement context and for public authorities in general, as detailed in Section 2.2.3.

Second, parliamentary oversight in the area of national security is carried out by the Bicameral Commission for the Audit of Intelligence Bodies and Intelligence Activities 394 . This Commission was established in 2001 by the National Intelligence Act as an independent review mechanism composed of officials from the Chamber of Deputies and the Senate 395 . It is charged with supervising the bodies belonging to the National Intelligence System, with a view to oversee that their operation strictly complies with the constitutional, legal and regulatory requirements 396 . To perform its oversight role, the Bicameral Commission may initiate ex officio investigations 397 . Its oversight activities furthermore include (1) studying, analysing and assessing the execution of the National Intelligence Plan (2) studying the Annual Intelligence Activities Report 398 (3) receiving any explanations and reports deemed appropriate from government ministers (4) giving opinions on any draft legislation linked to intelligence activities, and (5) receiving complaints from natural and legal persons about abuses and wrongdoings committed by intelligence agencies 399 . 

The Bicameral Commission has, in principle, access to all the information or documentation it requests from the bodies that make up the National Intelligence System 400 .The Bicameral Commission furthermore has the power to request classified reports containing a list of interceptions carried out within a specified period. It may request such reports from the Legal Assistance Directorate for Complex and Organised Crime, its representatives within the country and from telecom operators active in Argentina, for the purpose of controlling the legality of such interceptions 401 .

The Bicameral Commission submits annual reports with recommendations to the National Executive and the Parliament. These annual reports evaluate the activities, performance, and organization of the National Intelligence System with regard to the National Intelligence Plan 402 . In 2018, the Bicameral Commission wrote a detailed opinion on a new legislative proposal to amend the National Intelligence Act 403 . In addition, in 2020-2021 the Bicameral Commission conducted an in-depth investigation into certain alleged breaches by the AFI during the period of 2016 to 2019. Its extensive report of 20 April 2021 included proposals for structural reforms within the National Intelligence System such as the creation of a whistle-blower system 404 .

Finally, SIGEN (see section 2.2.3) has the possibility to control the administrative processes and the budget execution of the AFI’s public funds 405 .

2.3.4Redress

The Argentinian system offers different avenues to obtain redress, including compensation for damages.

First, individuals have a right to obtain access to and rectification or deletion (“suppression”) of their data held by the AFI or DINICRI under the LPDP, subject to the same conditions as described in section 2.2.4.

Second, any individual may lodge a complaint with the AAIP in respect of any matter relating to the handling of personal information by the AFI or DINICRI, in the same way as described in section 2.2.4.

Third, judicial redress may be sought via a constitutional habeas data action against the AFI, or DINICRI, subject to the same conditions as described in section 2.2.4. For instance, in the Supreme Court case of R. P., R. D. c/Estado Nacional – Secretaría de Inteligencia del Estado, the complainant initiated a habeas data action against the former State Intelligence Service (SIDE) to gain access to information gathered by SIDE from 1961 to 1973, which he considered necessary to receive pension entitlements from the national administration (ANSES). The Supreme Court considered that information processed by intelligence organisations does not per se constitute classified information, and that the judiciary is authorised to have access to the documents in question and to verify whether the decision to refuse the requested access is lawful 406 .

Fourth, the same judicial avenues as the ones described in section 2.2.4 (i.e., a claim for the compensation of damages, preventative action, generic action, action for annulment) are also available against the AFI and DINICRI.

Finally, once all national law remedies are exhausted, data subjects may bring their case before the Inter-American Commission of Human Rights.

III. CANADA

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of Canada

On 20 December 2001, the European Commission adopted its adequacy decision on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) 407 . The decision covers transfers of personal data from the EU to recipients in Canada that are subject to PIPEDA. The Article 29 Working Party adopted its opinion on 20 January 2001 408 .

Since the Commission adopted its adequacy finding in 2001, PIPEDA has been amended on five occasions; by the Anti-Terrorism Act (S.C. 2001, c. 41), the Public Safety Act (which entered into force in 2004, S.C. 2004, c. 15), the Public Servants Disclosure Protection Act (S.C. 2005, c. 46), Canada’s Anti-Spam Legislation (S.C. 2010, c. 23) and the Digital Privacy Act (S.C. 2015, c. 32). Moreover, further interpretations and clarifications have been provided by the courts and the federal data protection authority (the Office of the Privacy Commissioner, OPC).

In June 2022, the Canadian government introduced a bill (Bill C-27) in the Canadian Parliament to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act 409 . The bill is currently being examined by the House of Commons of the Canadian Parliament, after which it will go to the Senate. The proposed Consumer Privacy Protection Act would amend PIPEDA in several ways, e.g., by codifying certain clarifications provided over the years by courts and the OPC (for instance on the validity and modalities of consent, requirements for the legitimacy/lawfulness of data processing, the right to deletion and international data transfers) and by further strengthening the powers of the OPC.

PIPEDA has a specific scope of application, which has been extended several times since the adoption of the adequacy decision 410 . Currently, PIPEDA applies to the collection, use and disclosure of personal information by an organization 411 in the course of a commercial activity 412 , as well as to the processing of personal information about employees of (or applicants for employment with) an organisation that is federally regulated 413 . Since 2015, PIPEDA also applies to processing of personal information by the World Anti-Doping Agency 414 . It does not apply to personal information handled by public authorities, non-profit organisations (unless they handle personal information for commercial purposes), individuals (to the extent they handle the information for purely personal or domestic purposes), or employee information of non-federally regulated organisations 415 . In addition, an amendment in 2015 introduced a specific exception for the processing of business contact information (e.g., name, title, work address, work contact details) solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession 416 . This exception only applies to a limited number of situations (e.g., to use the work e-mail address of a lawyer to obtain legal advice) and cannot be relied upon to use information for different purposes (e.g., to use that same work e-mail address for marketing purposes) 417 .

As regards its territorial scope of application, PIPEDA provides for the possibility to exempt organisations or activities from its application with respect to the processing that occurs solely within a province that has passed legislation deemed to be substantially similar to PIPEDA 418 . In that case, this provincial legislation applies to the processing of personal information taking place within that province. Any processing that takes place across provincial or international borders or that is carried out by federally regulated businesses (regardless of where it takes place) remains subject to PIPEDA. So far, Quebec, Alberta and British Columbia have been found to have substantially similar (comprehensive) privacy legislation, while the health-related privacy laws of Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have been declared substantially similar to PIPEDA with respect to health information. However, this does not affect personal data transferred from the EU/EEA to Canada on the basis of the adequacy decision; data transfers from the EU/EEA under the adequacy decision are considered cross-border data transfers, which are subject to PIPEDA.

While the definition of personal information under PIPEDA (i.e., “information about an identifiable individual” 419 ) has not changed since the adoption of the adequacy decision, this notion has been further interpreted by the OPC, case law and guidance. In particular, it has been clarified the definition of personal information must be given a broad and expansive interpretation 420 , similar to the one under Regulation (EU) 2016/679 (GDPR) 421 , taking into account whether there is a serious possibility that an individual could be identified through the use of that information, either alone or in combination with other Information 422 . For example, a decision of the OPC has clarified that de-identified information remains personal information if it is still possible to link the data back to an identifiable individual 423 .

Since the adoption of the adequacy decision, the main data protection principles provided by PIPEDA, which are closely aligned to the corresponding principles under EU data protection rules, have not changed. This is the case for the principle of purpose limitation (subsection 5(3)), purpose specification (Principle 4.2 of Schedule 1 PIPEDA) data accuracy (Principle 4.6 of Schedule 1), data minimisation (Principles 4.4 and 4.5, of Schedule 1), data retention (Principle 4.5 of Schedule 1), security (Principle 4.7 of Schedule 1), accountability (Principle 4.1 of Schedule 1), and transparency (Principle 4.8 of Schedule 1). At the same time, several aspects of the legal framework have been further clarified and developed, either through legislative amendments or through case law and/or guidance of the OPC.

In particular, the requirements for lawfulness of processing have been further strengthened in different ways. As a general principle, PIPEDA requires the knowledge and consent of the individual for any collection, use or disclosure of personal information 424 , although PIPEDA also contains certain exceptions 425 (see below). The requirements for valid consent have been reinforced by an amendment to PIPEDA introduced by the Digital Privacy Act (2015) 426 , by making clear that that consent is only valid if it is reasonable to expect that individuals understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting 427 . According to the guidance of the OPC 428 , this requires that individuals are provided with information on what personal information will be collected, the purpose of processing, the third parties with whom information will be shared and possible (negative) consequences for the individual (e.g., financial loss, negative effects on credit records, etc.). Organisations must provide this information in an easily accessible form, provide individuals with a clear and easily accessible choice (not) to consent, obtain new consent when making relevant changes to their privacy practices and allow consent to be withdrawn.

Moreover, case law and guidance have provided further clarifications on the form and way consent should be obtained, which may vary, depending on the circumstances and type of information 429 . A Supreme Court decision in 2016 confirmed that, in determining whether consent must be expressly given, organisations need to take into account the sensitivity of the information and the reasonable expectations of the individual, both of which depend on the specific circumstances of the case 430 . OPC guidance and decisions specify that express consent is, in principle, the most appropriate form in any circumstance 431 and must in any event be obtained when the information is sensitive (see below on the notion of sensitivity under PIPEDA), when the processing is outside of the reasonable expectations of the individual (e.g., certain sharing of information with a third party, tracking of location), or when it creates a meaningful risk of significant harm (which is to be understood broadly, including both material and reputational impact). Implied or opt-out consent are only allowed in limited and strictly defined circumstances 432 .

Since the adoption of the adequacy decision, some additional exceptions to consent have been introduced, which may permit the collection, use or disclosure of personal information without obtaining consent from the individual for specific and circumscribed purposes 433 . For example, the Digital Privacy Act (2015) introduced exceptions that allow collection and use (1) when personal information is contained in a witness statement and the collection or use is necessary to assess, process or settle an insurance claim; and (2) when personal information was produced by the individual in the course of employment, business or profession and the collection or use is consistent with the purpose for which the information was produced 434 . In addition, exceptions were introduced allowing the use and disclosure of personal information in the context of prospective and completed business transactions (e.g., in case of a merger or sale of business, but not in case of business transactions where the primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information 435 ) under certain conditions 436 . Finally, other exceptions were added to permit federal works, undertakings or businesses to collect, use and disclose personal information if necessary to establish, manage or terminate an employment relationship and the organisation has informed the individual thereof 437 .

Case law and guidance of the OPC have furthermore elaborated on the requirements for the legitimacy/lawfulness of data processing, regardless of whether personal information is processed on the basis of consent, or an exception applies. In particular, PIPEDA provides that any collection, use or disclosure of personal information may only take place “for purposes that a reasonable person would consider are appropriate in the circumstances” 438 . In Turner v. Telus Communications Inc, the Federal Court 439 set out a number of factors that should be taken into account to determine whether a purpose is appropriate, including the degree of sensitivity of the personal information at issue, whether the processing would be effective in meeting the organization’s need, whether there are less invasive means of achieving the same ends at comparable cost and with comparable benefits and whether the loss of privacy is proportional to the benefits 440 . Consequently, organisations are required to engage in a balancing of interests of the individual and the organisation itself. In order to determine the appropriateness of a purpose, an organisation must take into account the particular facts surrounding the collection, use and disclosure.

Another area of the Canadian data protection regime that has developed since the adoption of the adequacy decision concerns the requirements with respect to security safeguards. In 2015, a mandatory data breach notification requirement was introduced, which entered into force on 1 November 2018. Organisations are now required to report breaches to the OPC and concerned individuals, if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual 441 . To determine whether that is the case, organisations have to take into account factors such as the sensitivity of the personal information, the probability that the information has been, is being or will be misused, etc. 442 . Organisations must provide the notification as soon as feasible after determining that the breach has occurred 443 , maintain a record of every breach 444 and provide such records to the Privacy Commissioner upon request. Deliberately failing to report a breach or maintain data breach records are offences subject to fines 445 .

PIPEDA requires organizations to be accountable for personal information under their control and sets out a number of obligations in this regard. Guidance developed by the OPC has also further clarified how the accountability requirements of PIPEDA should be implemented 446 , for instance by developing privacy management programs, appointing privacy officers or offices, keeping records and establishing internal reporting mechanisms, conducting internal audit and assurance programs to monitor compliance, developing personal information inventories, conducting risk assessments and developing training and education programs.

As regards the processing of special categories of data, PIPEDA does not provide for a closed listed of categories that are subject to additional protections. Instead, PIPEDA considers any information as potentially sensitive, depending on the circumstances and context in which it is collected/used/disclosed. This has the potential to apply additional protections to a broader range of personal information depending on the circumstances. Since the adequacy decision, the OPC and the courts have considered the question of sensitivity in a variety of cases. In 2022, the OPC consolidated existing case law and OPC decisions in an interpretation bulletin clarifying that certain types of information will generally be considered sensitive because of the specific risks to individuals when said information is collected, used or disclosed. This includes information such as health and financial data, ethnic and racial origins, political opinions, genetic and biometric data, an individual’s sex life or sexual orientation, and religious/philosophical beliefs 447 . Such information is subject to specific requirements as regards the form and way in which consent is obtained (see earlier) and the security measures to be put in place 448 .

As regards individual rights, there have been several developments in the Canadian legal framework since the adoption of the adequacy decision. PIPEDA continues to provide individuals with rights of access 449 and correction, and, while PIPEDA in principle does not create a separate right to deletion 450 , the OPC has indicated that a combination of provisions may create rights for individuals/obligations for organisations to delete personal information 451 . For example, the OPC considers that, where individuals withdraw consent 452 , they should be able to delete information they have themselves provided to an online forum involved in a commercial activity, such as on a social network. The same reasoning has also been applied in a broader context, for instance in a case where an individual had requested deletion of personal information contained in an insurance form 453 .

In addition, the entry into force of Canada’s Anti-Spam Legislation (CASL) in 2014 introduced several safeguards that are relevant to the processing of personal information for direct marketing purposes 454 . CASL amended PIPEDA by limiting the possibility for processing an individual’s electronic address without consent, if it is collected by the use of a computer program that is designed or marketed primarily for use in generating or searching for and collecting electronic addresses 455 .

With respect to the rules in PIPEDA on international data transfers 456 , certain requirements have been further interpreted and clarified by the OPC. In particular, as regards the sharing of data with a third party for processing (i.e., a ‘processor’) in a third country 457 , the OPC has clarified that organisations are required to inform individuals of the risk that their personal information may be lawfully accessed under the laws of the third country. This approach has been applied by the OPC in concrete cases that were triggered by complaints from individuals 458 .

1.2.Oversight, enforcement and redress

The OPC is the independent authority charged with oversight and enforcement of PIPEDA 459 . In addition to its power to investigate complaints and undertake audits, it is also tasked with developing and conducting information programs to foster public understanding, undertaking research, encouraging organisations to comply with PIPEDA and otherwise promoting the protection of personal information under PIPEDA 460 .

In terms of powers, the OPC may participate in sector- or issue-wide international privacy sweeps, issue letters of concern to organizations. With respect to its more formal enforcement authorities, it may ask an organization for access to their internal breach records, carry out audits 461  and conduct complaint investigations (in response to a complaint or on its own initiative) 462 . In carrying out audits and investigations, the OPC has access to any relevant information, may summon and enforce the appearance of persons and compel the production of evidence 463 . Upon completing an investigation or audit, the OPC issues a report setting out the findings and recommendations 464 . Since the adoption of the Commission’s adequacy decision, the powers of the OPC under PIPEDA have been strengthened by amendments introduced by the Digital Privacy Act in 2015. Following this amendment, the OPC may now enter into a compliance agreement with an organisation if it believes on reasonable grounds that an organisation has violated, is about to violate or is likely to violate PIPEDA 465 . Such a compliance agreement may contain any terms the OPC deems necessary to ensure compliance and is considered a settlement with the concerned organisation. At the same time, compliance agreements do not preclude individuals from obtaining judicial redress and do not prevent the prosecution of an offence 466 . If an organisation fails to comply with the agreement, the OPC may apply to the Federal Court to obtain an order requiring the organisation to do so 467 . As explained in more detail below, the OPC actively exercises its powers to enforce compliance with PIPEDA.

As regards the possibility for individuals to obtain redress, different avenues continue to be available in the Canadian system. In particular, individuals may turn directly to organisations 468 , file a complaint with the OPC 469 and obtain judicial redress (against organisations 470 or against the findings of the OPC 471 ), which may lead to different types of remedies, including binding orders to bring the handling of personal information in compliance with PIPEDA and compensation for damages.

Since the adoption of the adequacy decision, the OPC has carried out a number of important investigations under PIPEDA. Among the most prominent cases are the investigation of a data breach at Equifax in 2019 (which led to the conclusion of a compliance agreement 472 ), the use of facial recognition tools by Clearview in 2021 (which was a joint investigation with provincial data protection authorities that led to provincial commissioners issuing binding orders requiring Clearview to stop several practices and delete personal data that was unlawfully collected 473 ), the Facebook/Cambridge Analytica scandal (as part of which the OPC applied to the Federal Court in 2020 to seek a binding enforcement order to ensure that Facebook’s unlawful privacy practices are corrected 474 ).

Its annual reports to the Parliament also show that the OPC deals with a number of complaints under PIPEDA on an annual basis: for example, the annual report of 2018-2019 refers to 380 accepted complaints, 178 closed through early resolution and 104 closed through a standard investigation 475 ; the report of 2019-2020 to 289 accepted complaints, 221 closed through early resolution and 97 closed through standard investigation 476 ; and the report of 2020-2021 to 309 accepted complaints, 210 closed through early resolution and 86 closed through standard investigation 477 .

The OPC has also been very proactive in providing guidance on the interpretation and application of PIPEDA, including on topics such as the processing of employee data, biometric data, cloud computing, the development of mobile apps, online behavioural advertising, the processing of data from children, e-marketing, internet of things, etc. 478 . Moreover, the OPC issued several ‘interpretation bulletins’ that summarise the general principles that emerge from court decisions and OPC findings, e.g., on the definition of personal information, accountability, accuracy, transparency and consent 479 . The OPC also developed a number of tools to assist organisations with training and compliance efforts 480 , and provides detailed information on various topics to raise awareness among data subjects (e.g., specifically targeting certain groups such as parents, teachers and seniors; on mobile devices; human resource issues; data concerning health, etc.) 481 .

Finally, the OPC regularly engages with stakeholders, such as businesses (e.g., through 19 advisory engagements in the period of 2019-2020 and 13 in 2020-2021), and the Parliament (e.g., with 8 appearances before Parliamentary committees in the period of 2019-2020 and 3 in 2020-2021, and e.g., having reviewed 29 bills, laws and parliamentary studies for privacy implications during the period of 2019-2020 and 17 in 2020-2021). The OPC also advised the government and Parliament on the protection of personal data in the context of the response to the Covid-19 pandemic 482 and has been an active voice in debates about reforms of data protection legislation at both provincial and federal level 483 .

2.ACCESS TO AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN CANADA

2.1.General legal framework

The limitations and safeguards that apply to the collection and subsequent use of personal information by Canadian public authorities for criminal law enforcement and national security purposes follow from the overarching constitutional framework, specific laws regulating data access, as well as the rules that apply to the processing of personal information by the public sector.

First, access to personal information by Canadian public authorities is governed by general principles that follow from the Canadian Constitution and have been further developed through case law. In particular, Section 8 of the Canadian Charter of Rights and Freedoms (Charter), which is part of the Canadian Constitution, guarantees that “everyone has the right to be secure against unreasonable search or seizure” 484 . This provision protects against unjustified intrusions on a person’s “reasonable expectation of privacy” 485 , which extends to: personal privacy (i.e., physical/bodily privacy 486 ), territorial privacy (i.e., of a place, in particular an individual’s home 487 ) and informational privacy (i.e., “the claim of individuals […] to determine for themselves when, how, and to what extent information about them is communicated to others” 488 ).

According to the Supreme Court of Canada, the interception and recording of a private communication by public authorities constitutes a serious intrusion into privacy rights and would (unless all parties to the conversation expressly consent to the recording) be considered a search within the meaning of Section 8 of the Charter, generally only permissible with prior judicial authorisation 489 . Similarly, personal computers (because of the vast amounts of information they contain, including intimate correspondence, details of financial, medical and personal situations, internet browsing histories, etc.) 490 and internet subscriber information (as it may not only relate to the person’s name or address, but to his or her identity as the source or possessor of certain information) engage a high level of privacy 491 .

To comply with Section 8 of the Charter, a search/seizure must be “reasonable”. In principle, this requires prior judicial authorisation, when the court is satisfied that “the public’s interest in being left alone by government must give way to the government’s interest in intruding on the individual’s privacy in order to advance the goals of law enforcement” 492 . For a warrantless search or seizure, there is therefore a presumption of “unreasonableness,” which can be rebutted by the relevant public authority by establishing that the search was authorised by law, the law itself is reasonable 493 , and the manner in which the search or seizure takes place is reasonable 494 . If no prior judicial authorisation is required, additional safeguards may be required, such as after-the-fact notice to the target of the search and record-keeping requirements 495 . Even when a search or seizure is authorised pursuant to a warrant or reasonable law, it can be found to be in violation of Section 8 because of the manner in which it is carried out 496 . In particular, a search or seizure must be no more intrusive than is reasonably necessary to achieve its objectives 497 .

All laws and government actions at both the federal and provincial levels must conform to the Charter. As described in more detail in sections 2.2.1 and 2.3.1, the general principles following from the Charter are reflected in the specific laws that regulate the powers of law enforcement and national security authorities.

Moreover, the processing of personal information by Canadian federal public authorities (including federal criminal law enforcement authorities and national security authorities) is subject to the Privacy Act (R.S.C., 1985, c. P-21) 498 . The Act limits the collection of personal information by federal institutions to what relates directly to their programs or activities and regulates its use, disclosure and retention 499 . It reflects the principles of purpose limitation, data accuracy, transparency and storage limitation, and provides individuals with a right of access to their personal information and a right of correction 500 . The processing of personal information by provincial/territorial authorities (e.g., local criminal law enforcement authorities) is subject to similar personal information protection laws 501 . In particular, these laws impose limitations on the collection, use and disclosure of personal information, contain key personal information protection principles (such as transparency, accuracy, security, storage limitation and purpose limitation) and provide individuals with a right of access and correction. Moreover, all thirteen provinces and territories have an independent supervisory authority to oversee compliance and handle complaints.

These general limitations and safeguards can be invoked by individuals before independent administrative bodies (e.g., the OPC, provincial personal information protection authorities, the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police and the National Security and Intelligence Review Agency) and courts to obtain redress (see sections 2.2.4 and 2.3.4).

2.2.Access and use by Canadian public authorities for criminal law enforcement purposes

In Canada, criminal law enforcement functions are carried out by different authorities. At federal and territorial 502 levels, these include the federal police force (the Royal Canadian Mounted Police, RCMP), as well as other bodies with specific competences, such as the Canada Border Services Agency, the Canada Revenue Agency, the Canadian Food Inspection Agency and the Competition Bureau. At provincial and municipal levels, criminal law enforcement functions are carried out by the RCMP or local police and peace officers. Canadian law imposes a number of limitations on the access and use of personal information for criminal law enforcement purposes by each of these authorities and provides oversight and redress mechanisms. The conditions under which such access can take place and the safeguards applicable to the use of those powers are described in the following sections.

2.2.1.Legal bases and applicable limitations/safeguards

Personal information transferred under the adequacy decision and processed by Canadian organisations subject to PIPEDA may be obtained by Canadian criminal law enforcement authorities by means of investigative measures under statutes providing for law enforcement access, the primary one being the Criminal Code or on the basis of anti-money laundering and anti-terrorist financing legislation; or through voluntary disclosures.

The Criminal Code provides Canadian criminal law enforcement authorities (at federal, provincial and municipal levels) with a legal basis to access personal information held by commercial operators through searches and seizures, the interception of communications, accessing tracking and transmission data, and the use of production orders. The Criminal Code lays down clear and precise rules on the scope and application of these measures, thereby ensuring that the interference with the rights of individuals will be limited to what is necessary for a specific criminal investigation and proportionate to the pursued purpose. Moreover, to exercise any of these powers, prior judicial authorisation is in principle required (with certain exceptions, e.g., in emergencies, as described in more detail below) 503 .

Searches or seizures may be permitted under a search warrant to take place if there are reasonable grounds to believe 504 that there is anything in a building, receptacle or place for which a connection with an offence can be established (e.g., anything that will produce evidence with respect to the commission of an offence) 505 . In terms of procedural safeguards, a search/seizure may as a general rule only take place on the basis of a court-issued warrant 506 . A search of a computer system in order to seize, reproduce or copy data, must be specifically authorised by the warrant 507 . In principle, the person subject to the search is present when the search is carried out and, where this is not the case, a copy of the warrant is left to inform the individual. Warrantless searches or seizures may take place if the conditions for obtaining a warrant exist but there are exigent circumstances that make it impracticable to obtain a warrant 508 . In accordance with case law, this will be the case if there is an “imminent danger of the loss, removal, destruction or disappearance of the evidence if the search is delayed” 509 or if there is a degree of urgency that necessitates action by law enforcement 510 .

Specific limitations and safeguards apply to the interception of private communications 511 , which in principle may only take place in the context of investigations of serious offences 512 and in most cases on the basis of a judicial authorisation. Procedurally, the application for the authorisation must in principle be signed by the Attorney General of the relevant province or the Minister of Public Safety and Emergency Preparedness and submitted to a judge of a superior court of criminal jurisdiction 513 . An authorisation may be issued  514 if it is in the best interests of the administration of justice and other investigative procedures have been tried and have failed/are unlikely to succeed or the urgency of the matter is such that it would be impractical to carry out the investigation of the offence using only other investigative procedures 515 . An interception authorisation is valid for a maximum period of 60 days (one year for offences related to terrorism or criminal organizations) and may be renewed by the court once for the same period by a judge if the abovementioned conditions remain fulfilled 516 . Intercepting private communications in violation of the Criminal Code is an offence liable to imprisonment for a maximum of five years 517 .

In terms of additional safeguards, the Criminal Code imposes specific reporting and transparency requirements. In particular, within 90 days after the end of the authorisation, the individual that was the object of the interception must be notified in writing and a certification of that notification must be provided to the court that authorised the interception 518 . A longer period for notification must be specifically requested when applying for authorisation and may not exceed three years 519 . Such extension may only be granted if the investigation of the offence to which the authorisation relates is ongoing and it is in the interest of justice 520 . In addition, the contents of private communications may only be used as evidence in judicial proceedings if the accused has been provided with reasonable notice of that intention together with a transcript of the communication and a statement setting out the time, place, date, and parties to the communication 521 . More generally, the Minister of Public Safety and Emergency Preparedness is required to issue an annual public report with, inter alia, the number of applications and authorisations, the number of persons identified in an authorisation against whom proceedings were commenced, the average period for which authorisation and renewals were granted, etc. 522  

Interception of private communications without a prior judicial authorisation by a police officer are permitted to take place (in the context of investigations of any offence) in two exceptional circumstances. First, this may be the case if there are reasonable grounds to believe that a) the urgency of the situation is such that an authorisation could not, with reasonable diligence, be obtained; b) the interception is immediately necessary to prevent an offence that would cause serious harm to any person or to property; and c) either the originator of the private communication or the person intended to receive it is the person who would commit the offence or is the (intended) victim 523 . In this case, the concerned individuals must be notified in the same way as was described above 524 . Second, a warrantless interception may take place by an agent of the state if a) either the originator of the communication or the person intended to receive it has consented to the interception; b) the authority believes on reasonable grounds that there is a risk of bodily harm to the person who consented to the interception; and c) the purpose of the interception is to prevent the bodily harm 525 . In that case, the content of the intercepted communications will only be admissible as evidence in court proceedings for the purposes of proceedings in which actual, attempted or threatened bodily harm is alleged 526 .

In addition to intercepting the content of private communications, criminal law enforcement authorities may collect transmission data 527 if there are reasonable grounds to suspect that an offence has been or will be committed and the data will assist in the investigation 528 . Such collection may again only take place on the basis of a court-issued warrant. Case law 529 confirmed that such a warrant could be used “either to obtain names and records where the suspected phone number but not the name of the suspect is known, or alternatively, to produce the phone number and records, if any, where the police are able to provide the service provider with the name and address but not the cell phone number of the suspected person for whom they seek records”.

Similarly, to collect data related to the location of a transaction, individual or thing (tracking data 530 ), a warrant must be obtained. Such a warrant may authorise the use of a “tracking device” (a device, including a computer program, which may be used to obtain or record tracking data 531 or to transmit it by a means of telecommunication 532 ) for a maximum period of 60 days 533 . When used to track an individual’s movement by identifying the location of a thing that is usually carried or worn by the individual, it may only be used if there are reasonable grounds to believe that an offence has been or will be committed and tracking the individual will assist in the investigation 534 .

Under the Criminal Code, criminal law enforcement authorities may also obtain a production order 535 from a court, ordering a person to produce a copy of a document/prepare or produce a document containing data that is in their possession or control 536 . To issue a general production order, the judge must be satisfied that there are reasonable grounds to believe that an offence has been or will be committed, the document or data is in the person’s possession or control and will produce evidence. For orders requiring the production of specific types of information, i.e., transmission data, tracking data or financial data 537 , the judge must be satisfied that there are reasonable grounds to suspect that an offence has been or will be committed; the relevant information is in the persons control and will assist in the investigation of the offence 538 .

As a general safeguard, warrants authorising the collection of tracking/transmission data and production orders are considered public records to which individuals can obtain access, unless a sealing order has been issued by a judge. A sealing order must be requested by a law enforcement authority at the time of applying for the warrant/order and may be issued if the disclosure would affect the course of justice (e.g., if it would compromise the identity of an informant, compromise an ongoing investigation, etc.) or the information might be used for an improper purpose and this reason outweighs the importance of access to the information by the individual 539 .

In addition to disclosing information pursuant to binding measures adopted under the Criminal Code, organisations subject to PIPEDA may in certain circumstances disclose information to public authorities on a voluntary basis, either on their own initiative or to comply with a request for the information. When receiving information in such cases, criminal law enforcement authorities may only use or disclose it in accordance with the requirements described in section 2.2.2. An organisation may collect and disclose personal information to a government institution on its own initiative when it has reasonable grounds to believe that the information relates to a violation of the law 540 . Organisations may also disclose personal information when receiving a request from a government institution 541 and may collect and use personal information for the purpose of such disclosure 542 . When making a request, the institution must identify its lawful authority to obtain the information. The existence of a reasonable expectation of privacy of the concerned individual is a central factor to take into account in determining whether there is such lawful authority.

Case law clarifies how these provisions are to be applied in practice. For example, the Ontario Court of Appeal found that the routine sharing of information with public authorities (in this case the informal sharing of energy consumption data by electricity provider with the police) does not comply with PIPEDA and needs to be distinguished from a situation where a service provider discloses specific information to the police with concerns that a crime has been committed 543 . The Supreme Court of Canada found that obtaining IP addresses (which can, when associated with an identity, reveal highly personal information) through a request where the police had no authority to compel compliance with that request constituted an unconstitutional search 544 . According to the Court, obtaining such information engaged a reasonable expectation of privacy and therefore constituted a search within the meaning of Section 8 of the Charter, requiring either a warrant or specific empowerment by law. The police could therefore not rely solely on PIPEDA’s provisions relating to voluntary disclosures to obtain the information. Following this decision in 2014, all telecommunication providers that have published transparency reports have reported zero voluntary disclosures of subscriber information.

Finally, criminal law enforcement authorities may also indirectly receive personal information from Canada’s Financial Intelligence Unit, the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) 545 , to which certain organisations subject to PIPEDA have to disclose financial transaction information 546 . For example, under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCLMTFA), such organisations have to report on large electronic fund transfers 547 , terrorist property 548 , large cash transactions 549 and financial transactions for which there are reasonable grounds to suspect that they are related to the (attempted) commission of a money laundering or terrorist activity financing offence 550 . FINTRAC must in turn disclose financial intelligence information to criminal law enforcement authorities where it has reasonable grounds to suspect that the information would be relevant to investigating or prosecuting a money laundering or terrorist financing offence 551 . The information that may be reported includes the name of the person or entity involved in the transaction, the amount and type of currency involved, the transaction and account number, etc. 552 Information received from FINTRAC cannot be used as evidence, but is meant to support law enforcement authorities when applying for judicial authorisation of investigative measures (production orders, warrants). Any information received from FINTRAC can only be processed by a criminal law enforcement authority in accordance with the requirements described below in section 2.2.2.

2.2.2.Further use of the information collected

The processing of personal information collected by Canadian criminal law enforcement authorities is subject to the federal Privacy Act and privacy legislation at provincial/territorial level. The Privacy Act sets requirements on purpose limitation, accuracy, transparency and storage limitation 553 and specify the circumstances in which federal criminal law enforcement authorities may use or disclose personal information. Further processing (use and disclosure) without consent is only allowed under a limited number of grounds that are enumerated in the Act, e.g., when permitted by a federal statute, where necessary to comply with a warrant or subpoena, for internal audit purposes, or where the public interest in the processing clearly outweighs the invasion of privacy or where it clearly benefits the concerned individual 554 . The Act also requires public authorities to keep records of the personal information under their control, including of the purposes for which personal information is used and the applicable retention period 555 . Similar obligations apply under provincial and territorial privacy laws.

In addition, different instruments have been adopted by the Canadian government that further specify how public authorities should protect personal information. With respect to the sharing of data with other entities (within or outside Canada), guidance of the Treasury Board of Canada Secretariat (which is responsible for developing policy instruments, including guidance, concerning the application and implementation of the federal Privacy Act) recommends to put in place information sharing agreements (legally binding agreements or arrangements/memoranda of understanding) containing appropriate personal information protection safeguards 556 . The latter for instance include purpose specification and limitation, security measures, maximum retention periods, rights of access and to request correction for individuals, conflict resolution mechanisms, etc. 557 . More generally, including under the Avoiding Complicity in Mistreatment by Foreign Entities Act, ministerial direction prohibits the disclosure of information by criminal law enforcement authorities with foreign entities where this would result in a substantial risk of mistreatment of an individual by those entities 558 .

The Security of Canada Information Disclosure Act (SCIDA) permits Government institutions to share information related to threats to the security of Canada with other Canadian federal government institutions, such as federal law enforcement and security and intelligence agencies, but places strict parameters around doing so, including by requiring that the information relates to the receiving institutions mandate or responsibilities, and that disclosing would not impact personal privacy rights more than reasonably necessary in the circumstances. Disclosures under the SCIDA are also reviewed annually by the National Security and Intelligence Review Agency (NSIRA), on which a public report is tabled in Parliament.

Finally, with respect to the content of intercepted communications or the existence of such communications, the Criminal Code imposes specific limitations, subject to criminal sanctions (e.g., by prohibiting the use or disclosure without the consent of the concerned individual, except where required in the course of a criminal investigation) 559 .

2.2.3.Oversight

The activities of Canadian criminal law enforcement authorities are supervised by different bodies.

First, the OPC carries out oversight of compliance with the Privacy Act by federal authorities. The OPC receives and investigates complaints from individuals, may initiate investigations on its own initiative 560 and may more generally review processing activities of government institutions to ensure compliance with the Privacy Act. In carrying out investigations, the OPC has access to all relevant information, 561 . In particular, it may summon and enforce the appearance of persons, compel them to give oral or written evidence on oath and produce such documents and things as the OPC deems relevant to the investigation. Similarly, the OPC may enter any premises occupied by any government institution. If the OPC finds a violation of the Privacy Act, it provides the relevant agency with a report setting out the findings and recommendations 562 . Where appropriate, the OPC may also request that, within a specified time, notice must be given of any action taken or proposed to implement the recommendations (or reasons why no such action has been or is proposed to be taken). The OPC is required to report annually to the Parliament and may also make its reports on specific investigations available to the Parliament 563 . For example, in June 2021, the OPC submitted a special report to the Parliament on its investigation on the use of facial recognition technology by the RCMP 564 . The annual reports of the OPC also show that it regularly engages with law enforcement authorities, including at an early stage when new technologies are being tested or rolled out (e.g., body-worn cameras, drones), e.g., in the context of privacy impact assessments and advisory consultations 565 .

Second, at provincial and territorial levels, oversight of compliance by criminal law enforcement authorities with personal information protection rules is carried out by independent Information and Privacy Commissioners, ombudspersons or review officers. Specific oversight powers may vary in each province or territory. For example, some supervisory authorities can issue binding or enforceable orders (in Alberta, British Columbia, Ontario, Quebec and Prince Edward Island), while others issue recommendations (Northwest Territories, Nova Scotia, Nunavut, Saskatchewan, Yukon) that can in some cases be enforced by a court (New Brunswick, Newfoundland and Labrador) or an independent adjudicator (Manitoba).

Third, different specialised bodies oversee the activities of the police more generally, at federal, provincial and territorial levels. In particular, the RCMP is subject to oversight by the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC) 566 . The CRCC can review any activity of the RCMP for the purpose of ensuring compliance with applicable legislation, regulations, ministerial directions, policies, procedures or guidelines, either on the basis of a complaint or on its own initiative and issue a report to the responsible Minister and the head of the RCMP with its findings and recommendations 567 . In carrying out reviews and investigations, the CRCC has access to all relevant information 568 . In 2020-2021, the CRCC issued 322 review reports, with 239 recommendations (e.g., with operational guidance or recommending retraining or policy reviews) 569 , of which 88% were accepted by the RCMP.

Similar bodies provide oversight of law enforcement agencies at provincial and territorial level, e.g., the Independent Investigations Office of British Columbia, the Law Enforcement Review Board in Alberta, the Office of the Independent Police Review Director in Ontario, the Public Complaints Commission in Saskatchewan, the Police Ethics Commissioner in Quebec, the Police Complaints Commissioner in Nova Scotia, etc. 570  

2.2.4.Redress

The Canadian system offers different avenues to obtain redress, including compensation for damages.

First, individuals have rights of access to and correction of their personal information held by public authorities.

At federal level, the Privacy Act provides individuals with a right of access to their personal information and a right of correction. Whereas these rights were in the past only available to Canadian citizens, permanent residents or individuals present in Canada 571 , they have now been extended to all individuals, regardless of their nationality or place of residence 572 . As a consequence, any individual can exercise the rights of access and to request correction under the Privacy Act and has the possibility to file a complaint with the OPC if a request is refused 573 . With respect to the right of access, the relevant public authority may only refuse to disclose the requested records in limited and specific circumstances, by invoking exemptions that are either class-based or injury-based 574 . Class-based exemptions presuppose that the information is inherently sensitive, and that injury or prejudice would result from release. Injury-based exemptions are imposed when there is a “reasonable expectation of probable harm that would result from the disclosure of information” 575 . With a few exceptions 576 , both types of exemptions are not absolute, but leave discretion to the relevant authority, which means that it has to decide on a case-by-case basis whether or not to apply the exemption, after weighing relevant factors involved, including the privacy interests of the concerned individual 577 . Individuals who have been refused access to or correction of personal information, if a complaint has been made to the Privacy Commissioner in respect of the refusal, also have the possibility to apply directly to the Federal Court for a review of the matter, under the Privacy Act 578 . In that case, the Court may order the concerned institution to grant access or correct the information.

In addition, the privacy legislation for the public sector in each province and territory grants any individual (i.e., without limitations related to nationality or residence) the right of access to his/her personal information and to have inaccurate information corrected. Moreover, individuals can request a review of a decision on an access/correction request before the competent supervisory authority. Depending on the province/territory, the rights of access/correction of individuals may be enforced directly by the supervisory authority (by issuing binding orders, e.g., in Alberta, British Columbia, Ontario, Prince Edward Island), an adjudicator (e.g., in Manitoba), or the courts (e.g., in New Brunswick, Newfoundland and Labrador, Nova Scotia, Nunavut, Québec, Saskatchewan and Yukon).

Second, individuals may file complaints with independent oversight bodies.

At the federal level, any individual may file a complaint with the Privacy Commissioner in respect of any matter relating to the handling of personal information by a criminal law enforcement authority or other federal government institution 579 . The Privacy Act does not require the individual to have been personally affected, or to demonstrate injury for a complaint to be admissible. If a complaint is well-founded, the Commissioner issues a report containing findings and non-binding recommendations, as well as, where appropriate, a request to inform the Commissioner of any action taken to Implement a recommendation within a specified time 580 . Where the described action taken or proposed to be taken to implement the recommendations would be inadequate, the OPC must inform the complainant thereof 581 . Individuals may challenge the investigations and reports of the OPC before the Federal Court, pursuant to Section 18.1 of the Federal Courts Act on procedural grounds 582 . For instance, the Federal Court may grant relief if it is satisfied that the Commissioner acted without/beyond jurisdiction; failed to observe a principle of natural justice, procedural fairness or other procedure that it was required by law to observe; erred in law; or based its report on an erroneous finding of fact that it made in a perverse or capricious manner or without regard for the material before it 583 . For example, in Oleinik v Canada (Privacy Commissioner), the Federal Court noted that “the [Privacy Commissioner’s] investigation itself is amenable to review. If the report had material omissions, reached unreasonable conclusions, contained unsustainable inferences, misconstrued the factual and legal context or evinced a bias or pre-disposition on the part of the investigator, the Court could intervene.” 584 The Court may, inter alia, order the OPC to do any act or thing that was unlawfully refused, delayed or failed to be carried out, or declare invalid or unlawful, quash or set aside and refer back a decision, order, act or proceeding 585 .

With respect to compliance by provincial/territorial authorities with local privacy legislation, individuals may file complaints before the independent personal information protection authorities in each province/territory, which can issue binding orders (in Alberta, Quebec, British Columbia, Ontario and Prince Edward Island), orders enforceable by the courts or an adjudicator (in Manitoba, New Brunswick and Newfoundland and Labrador) or recommendations (in Yukon, Saskatchewan, Nunavut and the Northwest Territories). In Nova Scotia, an individual can appeal directly to the Supreme Court if it considers that a public authority has not complied with the recommendations of the personal information protection authority.

Third, individuals may in certain circumstances also file complaints with independent oversight bodies in the area of criminal law enforcement. For example, the CRCC handles complaints from any individual against the RCMP 586 . Individuals may complain directly to the CRCC, or first file a complaint with the RCMP and, if they are not satisfied with the outcome, request a review before the CRCC 587 . Once the investigation of a complaint is concluded, the CRCC prepares a report setting out its findings and recommendations, which is shared with the responsible Minister, the RCMP and the complainant 588 . Reports of the CRCC are final and cannot be appealed or reviewed 589 . In the period 2020-2021, 3361 complaints were filed by individuals (3144 before the Commission and 201 before the RCMP), of which 2273 were admissible 590 . In the same time frame, 2254 complaints were finalised. Similarly, in 2019-2020, 3641 complaints were received, of which 2317 were admissible, and 2067 complaints were finalised. In certain provinces/territories, individuals may similarly obtain redress against law enforcement authorities before independent oversight bodies (e.g., before the Office of the Police Complaint Commissioner in British Columbia, The Saskatchewan Public Complaints Commission, the Commissaire à la déontologie policière in Quebec, the New Brunswick Police Commission, etc.) 591 .

Fourth, different judicial remedies are available, allowing individuals to invoke the limitations and safeguards described in section 2.2.1 to obtain redress.

In particular, anyone directly affected by the improper handling of personal information by government institutions may apply for judicial review before the Federal Court, which does not require a showing of harm or injury 592 .

In addition, civil proceedings for damages 593 can be brought against the federal government for torts committed by government agents, servants or members of the federal police force. While the specific details of tort law vary across provinces, generally speaking the torts of negligence, breach of confidence or intrusion on seclusion could be invoked against the federal government where it misuses personal information. For a negligence claim to succeed, the individual must establish that a duty of care existed (which requires foreseeability of harm and proximity between the parties), that there was a breach of the applicable standard of care (which requires demonstrating that the defendant’s conduct fell below what would have been reasonable in the circumstances) and that this breach caused compensable harm. A successful breach of confidence claim requires establishing that the information that is the subject of the lawsuit was confidential, communicated in confidence and used in an unauthorised manner to the detriment of the plaintiff. With respect to the tort of intrusion on seclusion, a person who intentionally or recklessly intrudes, physically or otherwise, upon the seclusion of another person’s private affairs or concerns may be liable if the invasion would be highly offensive to a reasonable person and causes distress, humiliation or anguish. These same principles generally also apply to civil claims against provincial or municipal authorities. Several court cases demonstrate how these principles may apply to privacy violations by public authorities. For example, in Condon v. Canada, a proposed class action based in negligence and breach of confidence for losing a hard drive containing personal information was allowed to proceed 594 . Similarly, in TDC Broadband Inc. v. Nova Scotia, compensation was successfully claimed against a provincial government for a breach of confidence (involving the unauthorised use of confidential information) 595 .

Finally, judicial remedies are available to any individual whose rights under the Charter have been violated, as a result of government action or legislation.

In particular, under Section 24 of the Charter, anyone whose rights under the Charter have been violated may apply to a court to obtain such remedy as the court considers appropriate and just in the circumstances. This may include compensation for damages, declaratory relief and injunctive relief 596 . Moreover, where the court concludes that evidence was obtained in a manner that infringed any rights or freedoms guaranteed by the Charter and the court finds that the admission of evidence would bring the administration of justice into disrepute, the evidence must be excluded 597 . For a claim under Section 24 of the Charter to be successful, an individual must a) establish an adequate factual foundation, b) bring his or her claim at the correct stage of litigation and c) persuade the court that, on a balance of probabilities, his or her Charter rights have been violated 598 .

In addition, individuals can bring an action for a declaration that certain laws conflict with the Charter and are, therefore, of no force of effect under Section 52 of the Constitution Act 1867. For example, in one case the Supreme Court found that provisions of the Criminal Code were unreasonable because they did not require notification of individuals whose communications had been intercepted without a warrant 599 . Claimants may invoke Section 52 of the Constitution by alleging infringements of their own rights and freedoms; based on being affected by an allegedly unconstitutional law or administrative decision 600 ; or based on “public interest standing”, i.e., if there is a serious issue as to the validity of the legislation, the individual has a genuine interest in the measure’s validity, and the litigation is a reasonable and effective way to bring the matter before the court 601 .

2.3.Access and use by Canadian public authorities for national security purposes

In Canada, two agencies collect personal information for national security purposes.

The core mandate of the Canadian Security Intelligence Service (CSIS) is to collect foreign intelligence in Canada, investigate activities suspected of constituting threats to the security of Canada and advise the Government about these threats, which entails that CSIS is collecting, analysing and retaining information, including personal information. CSIS also has the mandate to take lawful measures to reduce threats to the security of Canada.

The Communications Security Establishment (CSE) is the national signals intelligence agency for foreign intelligence and the expert body for cybersecurity and information assistance 602 . Since the activities of the CSE may not be directed at Canadian individuals or corporations, or any person in Canada, it may in principle only access personal information transferred on the basis of the adequacy decision while it is in transit between the EU and Canada. The relevant powers of both agencies, as regulated by the CSIS Act and CSE Act, are described in the following sections 603 .

2.3.1.Legal bases and applicable limitation/safeguards

2.3.1.1.The Canadian Security Intelligence Service (CSIS)

On the basis of the CSIS Act, CSIS may access personal information transferred from the EU to private operators subject to PIPEDA as part of different activities, each of which is subject to specific limitations and safeguards following from the CSIS Act, the Canadian Constitution (Section 8 of the Charter) and case law 604 .

First, CSIS can, “to the extent strictly necessary,” collect information and intelligence on activities that may on reasonable grounds be suspected of constituting threats to the security of Canada (threat investigations) 605 . Second, CSIS may, in relation to the defence of Canada or the conduct of international affairs, assist the Ministers of National Defence or Foreign Affairs in the collection of information or intelligence within Canada in relation to the capabilities, intentions or activities of any foreign state or group of foreign states and any person other than Canadian citizens, permanent residents, or Canadian corporations (foreign intelligence collection) 606 . Third, if there are reasonable grounds to believe that a particular activity constitutes a threat to the security of Canada, CSIS may, within or outside Canada, take measures to reduce the threat (threat reduction measures), which may in certain circumstances require ancillary access to (personal) information.

For the first and second powers, CSIS must obtain judicial authorisation in the form a warrant issued by the Federal Court prior to using any techniques that would intrude more than minimally on a privacy interest protected by Section 8 of the Charter and/or otherwise violate Canadian law in the execution of the judicial authorisation 607 . This is for example the case for the interception of an individual’s communications 608 , obtaining detailed billing or subscriber information from communication service providers, or using cell-site simulator technology to track an individual’s device. In other words, nothing in the CSIS Act authorises CSIS to violate Section 8 of the Charter. The judicial warrant obtained in this context ensures that lawful authority underlies those CSIS activities that intrude more than minimally on protected privacy interest, thus making make the activities in question compliant with Section 8 of the Charter. Likewise, the warrant may authorise activities that, absent the warrant, would otherwise contravene Canadian law.

A warrant to investigate threats to the security of Canada may be issued if (1) it is required to enable the CSIS to investigate a specific threat (i.e., “the information sought is factually related to a threat to the security of Canada”) 609 and (2) other investigative procedures have been tried and have failed or are unlikely to succeed, the urgency of the matter is such that it would be impractical to carry out the investigation using only other investigative procedures, or it is unlikely that the information could be obtained without a warrant 610 . The CSIS Act lists the information that must be provided in the application for a warrant and the warrant itself, which includes the type of communication to be intercepted or the type of information, records, documents or things to be obtained; the identity of the target, if known; and a general description of the place where the warrant is to be executed 611 . In principle, a warrant may be issued for a period up to one year 612 and may be renewed by a judge, on written application by CSIS, for a period not exceeding the period for which the warrant was issued 613 .

The role of the judge in assessing the application for a warrant is to “ensure all requirements of the legislation are respected in the application for warrants and that the measures sought are justified in light of the facts put forward” 614 . In light of the requirements of the CSIS Act, the judge therefore assesses, inter alia, whether the information sought is “strictly necessary” to investigate a threat and whether other less intrusive techniques or procedures are not available or would not be effective 615 . Moreover, in assessing compliance with Section 8 of the Charter, the judge may look at additional elements, e.g., whether the proposed measure is no more intrusive than is reasonably necessary to achieve its objectives (i.e., whether the measure strikes an appropriate balance between the rights of the individual and the objectives being pursued by the state) 616 . The judge issuing a warrant may specify terms and conditions considered advisable in the public interest 617 .

The same standard and procedure applies to deploy more intrusive investigative techniques (such as intercepting communications) as part of the CSIS’ foreign intelligence collection mandate 618 .

For the third power (threat reduction measures), CSIS must also obtain judicial authorisation in the form a warrant issued by the Federal Court prior to undertaking any threat reduction measure that would either limit a right or freedom guaranteed by the Charter or otherwise be contrary to Canadian law 619 . A warrant to take threat reduction measures may be issued if the measure required to reduce the threat and the measure is “reasonable and proportionate” in the circumstances of the case 620 , having regard to the nature of the threat, the nature of the measures and the reasonable availability of other means to reduce the threat, as well as the reasonably foreseeable effects on third parties, including their right to privacy 621 . Moreover, the measure must comply with the Charter, e.g., the limit effected by the measure on a Charter right or freedom should not be more intrusive than is reasonably necessary to achieve its threat reduction objectives 622 . Terms and conditions deemed advisable in the public interest may be specified in the warrant 623 . The warrant may in principle be issued for a maximum of 120 days 624 and may, upon written application, be renewed twice if the conditions continue to be fulfilled 625 .

Finally, CSIS may, to support its abovementioned duties and functions, collect datasets 626 that contain personal information and that do not directly and immediately relate to activities that represent a threat to the security of Canada, where it is satisfied that the dataset is relevant to the performance of those duties and functions and the dataset is reasonably believed: to be publicly available (i.e., available to the public at the time of collection), to belong to an approved class of Canadian datasets (i.e., relating predominantly to Canadians or individuals/corporations within Canada), or to predominantly relate to non-Canadians who are outside Canada (i.e., foreign dataset)  627 .

Specific substantive and procedural requirements to collect, retain, exploit and query these three types of datasets are set out in the CSIS Act and differ for each type of dataset. When it comes to the retention of a collected dataset, this report focuses on the procedural requirements applicable to foreign datasets, as this is the type of collection that is the most relevant in an adequacy context (i.e., where personal information is transferred from the EU to Canadian commercial operators and may subsequently be accessed by Canadian public authorities). In particular, once a dataset is collected, CSIS has to assess and confirm within 90 days what type of dataset (i.e., whether it is a Canadian, foreign or publicly available dataset) it concerns 628 . During this period, the dataset may in principle (see below) not be queried or exploited 629 . In the course of conducting the evaluation during the 90-day period, a limited number of CSIS staff (“designated employees”) 630 may delete any extraneous, erroneous, or poor-quality information contained in the dataset. During this time, designated employees may also decrypt or translate the information in the collected dataset or apply specific privacy protection techniques 631 . During the 90-day evaluation period, a designated employee must delete any personal information from the dataset that is not relevant to the performance of the CSIS’ duties and functions if its deletion does not affect the integrity of the dataset 632 .

If it is determined that the information constitutes a foreign dataset, CSIS must obtain authorisation from the Minister of Public Safety (the Minister) or a designated person within the abovementioned 90-day period in order to retain the foreign dataset 633 . The Minister or designate may authorise CSIS to retain a foreign dataset when the retention is likely to assist the Service in the performance of its duties and functions and any information for which there is a reasonable expectation of privacy that relates to the physical or mental health of an individual has been removed 634 . The authorisation of the Minister must subsequently be reviewed and approved by an independent body, the Intelligence Commissioner (IC)  635 . The IC approves the authorisation by means of a reasoned decision if (s)he considers that the Minister’s conclusions are reasonable, possibly by imposing specific conditions 636 . An authorisation to retain a foreign dataset may be valid for a maximum period of five years from the date on which approval from the IC is obtained 637 . If no authorisation is granted by the Minister or if the IC does not approve the ministerial authorisation, CSIS must destroy the dataset without delay 638 .

Once the Minister’s authorisation to retain the dataset is approved by the IC, the dataset may only be queried and exploited by a limited number of designated employees at CSIS to assist the Service in its duties and functions under specific conditions 639 . A dataset may be queried and exploited to the extent that it is strictly necessary to assist CSIS in the performance of its duties and functions in relation to threat investigations and taking threat reduction measures 640 , or if required to assist the Ministers of National Defence or Foreign Affairs in collecting foreign intelligence 641 . In exigent circumstances, i.e., that require the querying of a dataset to preserve the life or safety of any individual or to acquire intelligence of significant importance to national security (the value of which would be diminished or lost if the CSIS would be required to comply with the ordinary authorisation procedure), the Director of the CSIS may authorise such querying even if no Ministerial authorisation to retain the dataset has been obtained (yet) 642 . However, in such cases, the IC must first review whether the assessment carried out by the Director is reasonable and must approve the decision, before the query can take place 643 . Notably, the CSIS Act does not allow for exploitation in exigent circumstances.

The results from queries or exploitation may only be retained where the collection, analysis and retention of the results are carried out in performing CSIS’ functions with respect to threat investigations; where the retention is strictly necessary to assist CSIS with the taking of threat reduction measures 644 ; or where the retention is required to assist the Ministers of National Defence or Foreign Affairs in collecting foreign intelligence 645 . Any query or exploitation result that does not satisfy abovementioned conditions must be destroyed without delay 646 .

In terms of additional safeguards, any foreign dataset must be stored and managed separately from all other information collected and retained by CSIS. In addition, only designated employees may have access to the datasets and reasonable measures must be taken to ensure that any information to which employees have access in only communicated for the purpose of their duties and functions under the CSIS Act. Moreover, records must be kept on the rationale for their collection and retention, the details of each query and exploitation, the statutory provision under which the result of a query or exploitation is retained and the results that were retained. CSIS is also required to verify, periodically and on a random basis, if the queries, exploitations and retention of results were carried out in accordance with the CSIS Act 647 . Finally, CSIS must provide NSIRA with, inter alia, reports on the periodic verifications and the authorisations of the Director to query foreign datasets in exigent circumstances 648 .

2.3.1.2.The Communications Security Establishment (CSE)

The CSE’s mandate covers five aspects. First, the CSE’s foreign intelligence mandate is to acquire information from or through the global information infrastructure 649 , and to use, analyse and disseminate the information for the purpose of providing foreign intelligence, in accordance with the Government of Canada’s intelligence priorities 650 . In addition, the CSE provides advice, guidance and services to the Government of Canada and federal institutions with respect to cybersecurity and information assurance, and in this context may also acquire, use and analyse information from the global information infrastructure or from other sources 651 . Moreover, the CSE may carry out defensive 652 and active 653 cyber operations on or through the global information infrastructure 654 . Finally, the CSE may provide technical and operational assistance to federal law enforcement and security agencies, the Canadian Forces and the Department of National Defence 655 .

The CSE may not direct activities carried out in furtherance of the foreign intelligence, cybersecurity and information assurance, defensive cyber operations or active cyber operations aspects of its mandate at Canadian individuals or corporations, or any person in Canada 656 and may not infringe the Charter 657 . Moreover, activities of the CSE as part of its foreign intelligence, cybersecurity and (defensive or active) cyber operations mandates that would otherwise contravene any Act of Parliament (including legislation in the foreign country where the activity takes place) or interfere with the reasonable expectation of privacy of a Canadian or person in Canada can only be carried out after having been authorised by the competent Minister 658 and, for foreign intelligence and cybersecurity authorisations, approved by the independent Intelligence Commissioner .

An authorisation for defensive and active cyber operations may be issued if there are reasonable grounds to believe that the activity is “reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities” 659 and “the objective of the cyber operation could not reasonably be achieved by other means” and that no information will be acquired under the authorisation except in accordance with a (separately issued) foreign intelligence or cybersecurity authorisation 660 .

A foreign intelligence authorisation may be issued if there are reasonable grounds to believe that 661 : (1) the activity is “reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities” 662 (which would require taking into account the benefits to be achieved by the activities and any anticipated impact on privacy interests) 663 ; (2) any information acquired under the authorisation “could not reasonably be acquired by other means and will be retained for no longer than is reasonably necessary”; and (3) if the authorisation authorises the acquisition of unselected information 664 : any unselected information could not reasonably be acquired by other means.

Similarly, a cybersecurity authorisation may be issued if there are reasonable grounds to believe that, inter alia, (1) the activity is “reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities” 665 ; (2) any information acquired will be retained for no longer than is reasonably necessary; (3) the consent of all persons whose information may be acquired could not reasonably be obtained (in case the activity concerns the information infrastructure of federal institutions), and (4) any information acquired under the authorisation is necessary to identify, isolate, prevent or mitigate harm to electronic information or information infrastructure of federal institutions or that has been designated as being of importance to the Government of Canada.

Any authorisation issued by the Minister 666 must, inter alia, specify: (1) the activities or classes of activities that it authorises; (2) the persons or classes of persons who are authorised to carry out the activities or classes of activities; (3) any terms, conditions or restrictions that the Minister considers advisable in the public interest, or advisable to ensure the reasonableness and proportionality of any activity authorised by the authorisation; and (4) the day on which the authorisation is issued and expires 667 . In case of a foreign intelligence authorisation, it must also specify whether the activities authorised include acquiring unselected information, and any terms, conditions or restrictions that the Minister considers advisable to limit the use, analysis and retention of, and access to, unselected information 668 . An authorisation may be valid for a period not exceeding one year 669 . An authorisation may be repealed at any time by the Minister 670 or amended in case of a significant change in the underlying facts (if, taking into account the significant change, there are reasonable grounds to believe that the conditions for issuing an authorisation continue to be met) 671 . Within 90 days after the expiration of an authorisation, the CSE must provide a written report to the Minister on the outcome of the activities carried out, which the Minister must in turn provide to the IC and NSIRA 672 .

Foreign intelligence and cybersecurity authorisations issued by a Minister are only valid if they are approved by the IC, who reviews whether the conclusions of the Minister are reasonable 673 and issues a written, reasoned decision approving or not approving the authorisation 674 . In order to carry out this review, the IC must be provided with all information that was before the Minister, including the application of the CSE, any supporting document or (written or oral) information that was considered by the Minister, the conclusions of the Minister and the authorisation itself 675 . While the term “reasonable” is not defined in this specific context, according to the IC it is to be interpreted in the same way as in administrative law jurisprudence (in the context of judicial review of administrative decisions) 676 . The IC must therefore be satisfied that the Minister’s conclusions are based on a proper justification, transparent, intelligible, and justified in relation to the relevant factual and legal context 677 . In case of a significant change in any factual element that was set out in the application for an authorisation, the CSE must notify the Minister, who must in turn notify the IC and NSIRA 678 . Such amendment is only valid once approved by the IC 679 .

A copy of each decision of the IC must be provided to the NSIRA to assist it in its review role 680 . According to its annual reports, in 2021 the IC approved two foreign intelligence authorisations, while finding one authorisation “partially reasonable”, and approved two cyber security authorisations 681 . In 2020, the IC received (and approved) three foreign intelligence authorisations and one cybersecurity authorisation.

In emergency situations, i.e., if the Minister believes on reasonable grounds that the conditions for the authorisation are met, but the time required to obtain the IC’s approval would defeat the purpose of issuing the authorisation, an authorisation may be issued and will be valid without having been approved by the IC 682 . Such an authorisation must be notified to the IC and the NSIRA as soon as feasible after it has been issued and is valid for a maximum period of five days 683 .

2.3.2.Further use of the information collected

The processing of personal information by CSIS and CSE is subject to the Privacy Act (see the information provided in section 2.2.2). With respect to the further sharing of data with other entities (within or outside Canada), the Act specifically governing the activities of the CSIS and CSE impose specific limitations.

In accordance with the CSIS Act, CSIS may not disclose any information it has obtained except in specific, limited situations 684 , e.g., (1) for the purposes of the performance of its duties and function; (2) to a police officer or Attorney General, where the information may be used in an investigation or prosecution of an offence; (3) to the Minister of Foreign Affairs, where the information relates to the conduct of international affairs of Canada; (4) to the Minister of National Defence, where the information is relevant to the defence of Canada; or (5) to any other Minister, where necessary in the public interest, which clearly outweighs any invasion of privacy that could result from the disclosure. Disclosures under the last ground have to be reported to the NSIRA. The CSE may, on the basis of the CSE Act, enter into arrangements with entities that have similar powers and duties (including of foreign states or international organisations), for the purpose furthering its mandate, including for information sharing or other cooperation 685 . An arrangement with a foreign entity must be approved by the competent Minister, after consultation with the Minister of Foreign Affairs.

The rules on data sharing under the CSIS Act and CSE Act are supplemented by the guidance of the Treasury Board of Canada on the need to put in place appropriate personal information protection safeguards in information sharing agreements/arrangements and by the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA), Directions [for Avoiding Complicity in Mistreatment by Foreign Entities, and Ministerial Direction collectively addressing the disclosure of information that would result in a substantial risk of mistreatment (i.e., torture or other cruel, inhuman, or degrading treatment or punishment) of an individual by a foreign entity (as described in more detail in section 2.2.2).

2.3.3.Oversight

In Canada, the activities of national security authorities are supervised by different bodies.

First, the OPC oversees compliance of data processing by the CSIS and CSE with the Privacy Act, in the same way as described in section 2.2.3. In its annual report of 2020 - 2021, the OPC reported a rise in requests for consultation from national security authorities under the Privacy Act 686 . In exercising its oversight function over intelligence agencies, the OPC also collaborate closely with NSIRA, including on the basis of a memorandum of understanding that establishes procedures for coordination, carrying out joint reviews or investigations and information sharing 687 .

Second, independent review of the activities of the CSIS and CSE (as well as any other activity that relates to national security or is referred to it by a Minister) is carried out by NSIRA 688 . The NSIRA may review any of the CSIS’ and CSE’s activities 689 and in this context adopt any findings and recommendations it considers appropriate, including with respect to compliance with the law or ministerial directions, as well as the reasonableness and necessity of their exercise of powers 690 . In carrying out its reviews, the NSIRA is in principle entitled to access almost any information held by the CSIS and CSE with the exception of confidences of the King’s Privy Council 691 . The NSIRA is required to report annually to the relevant Minister on the compliance of the activities of the two intelligence agencies with the law and applicable Ministerial Directions, as well as the reasonableness and necessity of the exercise of their powers 692 . When finding that an activity may be contrary to the law, the NSIRA must report this to the relevant Minister and to the Attorney General of Canada 693 . Moreover, the NSIRA must report annually on its findings and recommendations to the Prime Minister, who in turn is required to report to the Parliament 694 . The 2020 annual report of the NSIRA indicates that it conducted two reviews of the CSIS’ activities (the use of threat reduction measures and intelligence sharing with the RCMP) and three of the CSE’s activities (including of ministerial authorisations and the CSE’s data retention policies and procedures for signals intelligence) 695 . The recommendations issued by the NSIRA in the context of these reviews and the response of both agencies (which accepted the recommendations) are described in the NSIRA’s public annual report.

Finally, parliamentary oversight in the area of national security is carried out by the National Security and Intelligence Committee of Parliamentarians (NSICOP) 696 . The NSICOP is tasked with reviewing the legislative, regulatory, administrative, policy and financial framework for national security and intelligence, any matter relating to national security or intelligence that is referred to it by a Minister as well as any activity relating to national security or intelligence, unless it concerns an ongoing operation and the competent Minister determines that the review would be injurious to national security 697 . In the latter case, the Minister must inform the Committee that the review may be conducted once (s)he determines that review by the NSICOP would no longer be injurious to national security, or the activity is no longer ongoing, the Minister must inform the Committee that the review may be conducted 698 . The NSICOP must inform the appropriate Minister and Attorney General of any activity related to national security that may not be in compliance with the law 699 .

In conducting its tasks, the NSICOP is entitled to have access to any information under the control of a government department that is related to the fulfilment of the Committee’s mandate, including information that is protected by litigation privilege, solicitor-client privilege or the professional secrecy of advocates and notaries 700 . Exceptions to this power include a confidence of the King’s Privy Council, the identity of a confidential source of information to the Government, or information directly relating to an ongoing investigation carried out by a law enforcement agency that may lead to a prosecution 701 . The competent Minister may also refuse to provide information which the NSICOP is entitled to access if it constitutes special operational information and if provision of the information would be injurious to national security 702 . In that case, the Minister must provide the refusal and the reasons therefore to the NSICOP, as well as to the NSIRA 703 .

The NSICOP submits annual reports with findings and recommendations to the Prime Minister 704 , who submits it to Parliament, subject to possible redactions where the disclosure of specific information would be injurious to national security, national defence or international relations, or is protected by litigation privilege or by solicitor-client privilege or the professional secrecy of advocates and notaries 705 . Such reports must also contain the number of times that a Minister determined that a review would be injurious to national security and the number of times that a Minister refused to provide information in the course of a review.

2.3.4.Redress

The Canadian system offers different avenues to obtain redress, including compensation for damages.

First, individuals have a right of access and correction of their personal information held by CSIS and CSE under the Privacy Act, under the same conditions as described under section 2.2.4.

Second any individual may file a complaint with the OPC in respect of any matter relating to the handling of personal information by the CSIS and CSE, in the same way as described in section 2.2.4.

Third, any individual may file a written complaint to the NSIRA with respect to any activity carried out by CSIS or CSE 706 . The NSIRA investigates such complaints if the complainant has first complained to the Director of the CSIS/ Chief of CSE and has not received a response within a reasonable time or is not satisfied with the response, and if it is satisfied that the complaint is not trivial, frivolous, vexatious or made in bad faith (there are no further admissibility requirements and the complainant therefore does not have to demonstrate that (s)he has in fact been injured for the complaint to be handled). The NSIRA may attempt to resolve the complaint informally or conduct a formal investigation 707 , and may ask the Canadian Human Rights Commission for its opinion on the complaint 708 . In the course of an investigation of a complaint, the complainant as well as the Director or concerned deputy head must be given an opportunity to give representations, present evidence and be heard 709 . Moreover, the NSIRA has the power to summon and enforce the appearance of persons and compel them to give oral or written evidence, as well as to produce all relevant documents 710 . If an individual is not satisfied with a decision of the NSIRA, he or she may apply to the Federal Court for judicial review of that decision 711 . In 2020, the NSIRA received 15 complaints against CSIS, of which it accepted three, and received one complaint against the CSE. In the same year, the NSIRA closed five complaint investigations, of which three were withdrawn by the complainant, one was resolved informally, and one was completed with a final report.

Finally, the same judicial avenues as the ones described in section 2.2.4 (i.e., review before the Federal Court, redress pursuant to Section 24 of the Charter, civil claims for damages 712 , or redress under Section 52 of the Constitution) are also available against CSIS and CSE.

IV. FAROE ISLANDS

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of the Faroe Islands

The Commission adopted the adequacy decision for the Faroe Islands on 5 March 2010 713 , after having received the opinion of the Article 29 Working Party on 9 October 2007 714 . The decision found that, for the purposes of Article 25(2) of Directive 95/46/EC (Data Protection Directive) 715 , the Faroe Islands provided an adequate level of protection for personal data transferred from the EU to recipients subject to the Faroese Act on Processing of Personal Data (APPD) 716 .

At the time of the adoption of the adequacy decision, the legislative framework for the protection of personal data in the Faroe Islands consisted of the APPD, which entered into force on 1 January 2002 and was based on the standards of the Data Protection Directive. In August 2017, a process to modernise the APPD was initiated, which led to the adoption of a new Data Protection Act (DPA) 717 that entered into force on 1 January 2021. As explained in more detail below, the DPA is closely aligned with Regulation (EU) 2016/679 (GDPR) 718  and has strengthened the Faroese data protection framework in several areas. The DPA is accompanied by a special commentary, which refers to the GDPR and its recitals, in particular by specifying that the GDPR is to be used when interpreting the Act.

Like the previous APPD, the new DPA has a broad scope of application, applying to both private operators and public authorities 719 . While the definitions of ‘personal data’, ‘controller’, ‘processor’ 720 , ‘data subject’ and ‘processing’ (which are identical to those used in the GDPR) have not changed compared to the previous APPD 721 , the DPA has brought even more convergence with the GDPR, e.g., by introducing a definition of ‘pseudonymisation’ 722 and further clarifying when a person is ‘identifiable’ by applying the same criteria of recital 26 of the GDPR 723 . The DPA has also extended the territorial scope of the Faroese data protection rules by adopting the same approach as Article 3 of the GDPR 724 .

The main data protection principles and obligations that were already provided by the APPD at the time of the adoption of the adequacy decision have remained in place without substantial changes. This is the case for the principles of purpose limitation 725 , data quality and proportionality 726 , data retention 727 and data security 728 . At the same time, a number of principles and obligations have been further strengthened, in particular in the context of the recent reforms, e.g., the principle of lawfulness of processing, the requirements for data breach notification, the transparency obligations and the principle of accountability.

As regards the principle of lawfulness and fairness of processing, the DPA has reduced and further clarified the grounds that are available for processing, which are now identical to those listed in Article 6(1) GDPR 729 . Furthermore, the requirements for valid consent have been reinforced under the DPA, by making clear that, in addition to being freely given, specific and informed 730 , consent must be unambiguous and expressed by a clear affirmative action 731 .

Similarly, the DPA has strengthened the existing transparency obligations by requiring that additional information is provided to the individual (e.g., the contact details of the data protection officer, the fact that the controller intends to transfer the data to a third country, the retention period, the right to withdraw consent, the existence of automated decision-making, etc.) 732 when data is collected directly from the individual 733 or from third parties 734 and when it is further processed 735 . The exceptions to transparency requirements have also been narrowed and further clarified. In particular, under the DPA, the transparency obligations do not apply in limited circumstances, e.g., if disclosing the information would endanger national security or jeopardise the investigation of a criminal offence 736 . In this respect, the special commentary clarifies that to rely on an exception, a concrete assessment should be made in each individual case. Restrictions could only be made if a concrete assessment leads to the conclusion that the information, if disclosed, would fall under one of the exceptions.

With respect to the principle of data security, the DPA expanded the requirements on reporting data breaches. While controllers were already required to notify data breaches to the Data Protection Agency 737 , the DPA has clarified the modalities for such notifications, e.g., by specifying that breaches should be reported without undue delay (and where feasible within 72 hours), and exempting data breaches that are unlikely to result in a risk to the rights of individuals 738 . Moreover, the DPA introduced a requirement to notify data breaches to the concerned individuals, where it is likely to result in a high risk to their rights 739 .

The DPA has also modernised the accountability requirements that applied under the previous regime (e.g., on record keeping and risk assessments) 740 , by introducing an obligation to implement principles of data protection by design and by default, keep records of processing, appoint a data protection officer and carry out data protection impact assessments (and consult the Data Protection Agency prior to processing where a data protection impact assessment indicates that the processing would result in a high risk in the absence of measures taken by the controller to mitigate the risk) 741 .

In addition to the strengthening of data protection principles and obligations, the protections for special categories of data have been reinforced since the adoption of the adequacy decision. The APPD already offered additional protection for data about colour and family bonds; religion, philosophy, or political conviction; sexual life; health; trade union connections; relative social problems and other private concerns 742 . The DPA has codified the existing interpretation of “colour and family bonds,” “sexual life” and “data about health” by explicitly mentioning data revealing racial and ethnic origin, sexual orientation and genetic data in the list of special categories of data 743 and included biometric data processed for the purpose of uniquely identifying a natural person 744 . As regards the safeguards that apply to the processing of special categories of data, the DPA has replaced the previous requirement to obtain prior authorisation from the Data Protection Agency 745 by a general prohibition on processing, only allowing the processing of such data in a limited number of situations 746 . For example, similarly to the GDPR, the DPA allows the processing of special categories of data where the data subject has given explicit consent, where processing is based on a law, where processing is necessary to protect the vital interest of the data subject, or where processing is necessary for reasons of substantial public interest 747 .

The DPA has also modernised the APPD’s provisions on data subject rights, which included a right to obtain information, a right of insight (i.e., access) and the rights of rectification, erasure and blocking 748 . In particular, the DPA contains updated provisions on the rights of rectification, erasure 749 , restriction and object (also including a general right to object to the processing of personal data for direct marketing purposes) that correspond to the rights provided by the GDPR, both as regards the conditions under which these rights can be exercised and possible exceptions 750 . In addition, the right of access has been further strengthened, by not only requiring controllers to provide individuals with information about the processing of their data (as was already the case under the APPD) 751 , but also to give access to personal data (including by providing a copy) 752 . The DPA has also further circumscribed the exceptions to the right of access, which only apply in limited circumstances, e.g., if disclosing the information would endanger national security or jeopardise the investigation of a criminal offence 753 , and, according to the special commentary, must be applied on a case-by-case basis.

Moreover, the DPA introduced new rights. This includes a right for individuals not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affect them 754 . Such automated decision making may only take place under certain conditions (e.g., only if authorised by law or based on the data subject’s explicit consent) and subject to specific safeguards (e.g., informing the individual about the processing and the envisaged consequences) 755 . In addition, the DPA introduced a right to data portability that corresponds to the same right available under the GDPR 756 .

The DPA has also introduced several changes to the rules on international transfers (onward transfers for the purpose of the adequacy decision) 757 . In particular, the regime of the APPD that allowed international transfers on the basis of a specific transfer instrument (an adequacy decision adopted by the Minister of Justice, adequate safeguards or certain statutory grounds) after obtaining prior permission from the Data Protection Agency has been updated 758 . The DPA abolished the prior authorisation requirement and allows transfers to non-EEA countries under the same conditions as the GDPR. In particular, as a general principle, the special commentary clarifies that the rules on international transfers are intended to ensure that the level of protection ensured by the DPA will not be lowered, which also applies when personal data are onward transferred from the third country to which they were transferred from the Faroe Islands.

Moreover, as was the case under the APPD, different instruments can be used for data transfers. First, the Minister of Justice can adopt an adequacy decision, for which the special commentary specifies that the same elements as those provided by Article 45 GDPR have to be taken into account and adequacy decisions adopted by the European Commission may be taken into account. In practice, the same countries that have received an adequacy decision from the Commission under the Data Protection Directive have been recognised by the Faroe Islands, with the addition of Gibraltar 759 . In addition, a transfer may take place on the basis of appropriate safeguards (by means of a legally binding and enforceable instrument between public authorities, standard data protection clauses adopted by the Minister or contractual clauses approved by the Data Protection Agency), on the condition that enforceable data subject rights and effective legal remedies are available to the data subject. In particular, the Minister has approved the standard contractual clauses for the transfer of personal data to third countries set out in the Commission implementing decision (EU) 2021/914. Finally, the DPA allows transfers on the basis of ‘derogations’ 760 , which correspond to those provided by Article 49 GDPR and which, according to the special commentary, have a narrow scope and cannot be relied upon for regular and repeated transfers.

1.2.Oversight, enforcement and redress

The independent entity in charge of overseeing compliance with the data protection rules is the Data Protection Agency. The Agency supervises compliance of any processing activity, either on its own initiative or on the basis of complaints from data subjects 761 . In addition, it carries out a number of tasks, such as promoting public awareness in relation to data protection, giving its opinion on administrative and legislative measures relating to data protection, promoting the awareness of controllers and processors of their obligations, monitoring and informing of relevant developments regarding data protection on the Faroe Islands and abroad, and publishing annual reports on its activities 762 . In performing its supervisory duties, the Agency has access to all relevant information, as well as to the premises where processing operations are carried out or administered and where data or technical equipment are stored or used 763 .

Since the adoption of the adequacy decision, both the resources and powers of the Agency have been strengthened. In particular, the number of members of the Agency (i.e., the Council) has increased from three under the APPD (a chair and two other members) to five under the new DPA (a chair and four members, two of which are nominated by the Association of Municipalities and the Faroe Employer’s Association) 764 . Furthermore, the number of staff members of the Agency has doubled, from three to six members of staff. To further strengthen the independence of the Council, the special commentary to the DPA provides that the members must remain free from external influence, whether direct or indirect, and may neither seek nor take instructions from anybody. In addition, the budget of the Agency has increased in the past years, from 2.0 million DKK (~ 268 000€) in 2018 and 2.445 million DKK (~ 324 000€) in 2018, to 3.252 million DKK (~ 435 000€) in 2020.

Under the former APPD, compliance with data protection requirements was ensured through a combination of different measures, including notification, prior authorisation, corrective measures (issued by the Data Protection Agency) and criminal sanctions (i.e., fines or imprisonment, imposed by the Prosecution Service) 765 . The new DPA has strengthened the enforcement powers of the Data Protection Agency, while abolishing most prior notification and authorisation requirements.

The DPA has provided the Agency with a broad range of powers, in particular to issue warnings, reprimands and orders (inter alia to discontinue processing, bring processing into compliance with the Act, implement security measures and rectify, erase or restrict processing), and to make its decisions public 766 . The DPA also introduced the possibility for the Data Protection Agency to issue a fixed penalty notice 767 , i.e., a fine that may be imposed where an infringement is estimated not to result in a penalty higher than a fine, if the concerned entity admits to being guilty and accepts the fine indicated in the notice within a specified time limit. This procedure deviates from the general principle that the police, prosecution service and courts handle criminal cases and allows the settle a case without legal proceedings. Because of the criminal nature of a penalty notice, it may only be issued for infringements that are simple and where there is no evidentiary doubt.

In addition to the powers of the Data Protection Agency, the new DPA has also retained a regime of criminal sanctions, e.g., for violations of the provisions on data protection principles, the obligations for controllers and processors, international transfers, and individual rights 768 . As regards the amount of fines, the special commentary provides that the Faroese authorities should take into account the same factors as those listed in Article 83(2) GDPR, i.e., the intentional or negligent character of the infringement, any action taken by the controller or processor to mitigate the damage suffered by data subjects, duration of the infringement etc. Moreover, as a starting point, the level of fines on the Faroe Islands should follow the developments in Denmark under the GDPR.

As regards possibilities for individuals to obtain redress, the Faroese system continues to offer various avenues, including the possibility to lodge a complaint with the Data Protection Agency 769 , obtain judicial redress directly against controllers and processors (both private operators and public authorities) 770 and obtain compensation for damages 771 .

Despite its relatively small office, the Data Protection Agency plays an active role, both when it comes to its engagement with stakeholders and exercising its oversight role.

In particular, according to information received from the Faroese authorities, the Data Protection Agency annually handles a number of files, including inspections, notifications, written questions, complaints and proposals for legislation. For example, in 2022, 379 files were handled and 319 in 2023. In the context of the Covid-19 pandemic, the Agency also advised the Faroese Government on issues relating to data protection (e.g., as regards the processing of sensitive data as part the testing strategy). Moreover, since the entry into force of the new DPA, the Data Protection Agency handled over 500 files, as part of which it received more than 22 notifications of data breaches and launched more than 28 data protection inspections. It also sent questionnaires to various controllers investigating different aspects of compliance with the new Act. This has already led to enforcement action in several cases, including reprimands and orders demanding that processing be brought into line with the new Act.

Finally, since June 2020, when the new DPA was passed by the Faroese parliament, the Data Protection Agency issued over 20 guidelines (e.g., on data protection officers, data protection in the workplace, data breaches, consent and data subject rights) and around ten templates (e.g., for notifying data breaches). The Agency also engages in various outreach activities, such as presentations and courses for both the private and public sector (so far reaching around 1000 participants) and launched a new website, as well as a podcast series about data protection.

2.ACCESS TO AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN THE FAROE ISLANDS

2.1.General legal framework

The Faroe Islands enjoy a special status as an autonomous nation within the Danish Kingdom, regulated by the Home Rule Act of 1948 (Act No. 137 of 23 March 1948). Whereas certain aspects (the Constitution, the foreign exchange and monetary policy, the Supreme Court and the foreign, defence and security policy) always remain under Danish authority, the Takeover Act (Act No. 578 of 24 June 2005) provides the Faroe Islands with the possibility to assume legislative and executive power in all other areas. If the Faroe Islands decide not to take over a certain area, it remains under the jurisdiction of Denmark 772 . This is the case for the activities of the police, the prosecution service, the prison and probation service and the courts, which have not been taken over by the Faroe Islands. Given that criminal law enforcement and national security therefore remain under Danish jurisdiction, activities in these areas in the Faroe Islands are exercised exclusively by Danish authorities 773 . As explained in more detail below, these authorities are subject to laws under Danish auspices that, after having been approved by the Faroese Parliament, have been put into force in the Faroe Islands by an Executive Order of the Danish government.

The limitations and safeguards that apply to the collection and subsequent use of personal data by public authorities on the territory of the Faroe Islands for criminal law enforcement and national security purposes follow from the overarching constitutional framework of the Danish Kingdom, specific laws regulating data access, as well as rules that apply to the processing of personal data.

Firstly, Section 72 of the Danish Constitution guarantees the right to privacy. It stipulates that no house search, seizure, examination of letters and other papers, or any breach of secrecy in postal, telegraph and telephone matters may take place except under a judicial order, unless a particular exception is warranted by statute.

In addition, the European Convention on Human Rights applies to the Faroe Islands. The European Convention on Human Rights protects the right to respect for private and family life (and the right to the protection of personal data as part of it). In particular, pursuant to Article 8 of that Convention, a public authority may only interfere with the right to privacy in accordance with the law, in the interests of one of the aims set out in Article 8(2), and if proportionate in light of that aim. Article 8 also requires that the interference is “foreseeable”, i.e., has a clear, accessible basis in law, and that the law contains appropriate safeguards to prevent abuse.

In addition, in its case law, the European Court of Human Rights has specified that any interference with the right to privacy and data protection should be subject to an effective, independent and impartial oversight system that must be provided for either by a judge or by another independent body (e.g., an administrative authority or a parliamentary body) 774 . Moreover, individuals must be provided with an effective remedy, and the European Court of Human Rights has clarified that the remedy must be offered by an independent and impartial body which has adopted its own rules of procedure, consisting of members that must hold or have held high judicial office or be experienced lawyers, and that there must be no evidential burden to be overcome in order to lodge an application with it. In undertaking its examination of complaints by individuals, the independent and impartial body should have access to all relevant information, including closed materials. Finally, it should have the powers to remedy non-compliance 775 .

Therefore, through its adherence to the European Convention on Human Rights, as well as its submission to the jurisdiction of the European Court of Human Rights, the Faroe Islands is subject to a number of obligations, enshrined in international law, that frame its system of government access on the basis of principles, safeguards and individual rights similar to those guaranteed under EU law and applicable to the Member States.

Secondly, as explained in more detail in section 2.2.1 and 2.3.1, these general principles are reflected in specifics laws that regulate the access and use of personal data for criminal law enforcement and national security purposes and impose minimum safeguards. This includes in particular the Faroese Administration of Justice Act 776 .

Thirdly, the processing of personal data by public authorities for criminal law enforcement and national security purposes is subject to specific data protection rules. Danish law enforcement authorities in the Faroe Islands are subject to the Act on the Processing of Personal Data by Law Enforcement Authorities that was set into force in the Faroe Islands on 1 July 2022 777 . This Act essentially transposes the legislation that was adopted by Denmark to implement Directive (EU) 2016/680 (Law Enforcement Directive) in the Faroe Islands, with minor adaptions to reflect the local conditions (for instance removing references to cooperation in/with the European Data Protection Board) 778 . It inter alia provides for key data protection principles (e.g., purpose limitation, data minimisation, data accuracy, data security), obligations for law enforcement authorities (e.g., on the processing of sensitive data, international data transfers, notification of data breaches, etc.) and rights for individuals (e.g., to obtain access, correction or deletion of personal data). In addition, the Act is complemented by several Executive Orders that have been put into force in the Faroe Islands:

(1)Executive Order No. 1051 of 12 September 2017 for the Faroe Islands on security measures for the protection of personal data processed by the public administration 779 ;

(2)Executive Order No. 1058 of 12 September 2017 for the Faroe Islands on derogating from the obligation to notify certain proceedings carried out by the public administration 780 ;

(3)Executive Order No. 1057 of 12 September 2017 for the Faroe Islands derogating from the obligation to notify certain proceedings conducted by the courts 781 ;

(4)Executive Order No. 1059 of 12 September 2017 for the Faroe Islands on security measures for the protection of personal data processed before the courts 782 ;

(5)Executive Order No. 442 of 16 March 2021 on Processing of Personal Data in the Central Criminal Register (Order no. 442 of 16 March 2021 for the Faroe Islands) 783 .

In the area of national security, the Act on the Security and Intelligence Service 784 (ASIS) governs the activities of the Danish Security and Intelligence Service in the Faroe Islands with regard to the collection and (further) processing of personal data for national security purposes. This Act was set into force on the Faroe Islands on 1 January 2021 and mirrors the Danish Act on the Security and Intelligence Service, with some adaptations for the local Faroese situation. As explained in more detail in section 2.3.2, under the Act, all core principles (lawfulness, purpose limitation, data minimisation, data accuracy, storage limitation), individual rights and data protection obligations (e.g., rules on international transfers) apply 785 . The Act is complemented by two Executive Orders:

(1)Executive Order for the Faroe Islands on security measures to protect information about natural and legal persons processed by the Danish Security and Intelligence Service (Order No.254 of 22 February 2021, DSIS Order on security measures) 786 ;

(2)Executive Order for the Faroe Islands on the Danish Security and Intelligence Service’s processing of information on natural and legal persons, etc. (Order No. 253 of 22 February 2021, EOFIDSIS) 787 .

These general limitations and safeguards can be invoked by individuals before independent oversight bodies (e.g., the Danish data protection authority, the Intelligence Oversight Board) and courts to obtain redress (see sections 2.2.4 and 2.3.4).

2.2.Access and use by public authorities in the Faroe Islands for criminal law enforcement purposes

The legal framework that applies to criminal law enforcement authorities in the Faroe Islands imposes a number of limitations on the access and use of personal data for criminal law enforcement purposes and provides oversight and redress mechanisms. The conditions under which such access can take place and the safeguards applicable to the use of those powers are described in the following sections.

2.2.1.Legal bases and applicable limitations/safeguards

Personal data transferred from the EU on the basis of the adequacy decision and subsequently processed by Faroese controllers or processors may be collected by Danish authorities (i.e., the Danish police) for criminal law enforcement purposes in the context of a search or seizure, on the basis of a production order, by accessing communications or by collecting location data through telecommunications observation. The conditions, limitations and safeguards that apply to the use of these powers are laid down in the Faroese Administration of Justice Act. This Act lays down clear and precise rules on the scope of application of these measures, thereby ensuring that the interference with the rights of individuals will be limited to what is necessary for a specific criminal investigation and proportionate to the pursued purpose. As explained in more detail below, prior judicial authorisation is in principle required in order to access personal data, unless in exceptional cases specifically listed in the Act. Moreover, specific (procedural) safeguards exist to guarantee due process rights for individuals.

First, searches of places, documents (including electronic documents), objects, papers, etc. 788 may in principle only take place if the targeted person is suspected on reasonable grounds of an offence that is subject to public prosecution and the search may be presumed to be of major importance to the investigation 789 . To perform searches of accommodation, documents, papers and the content of locked objects, additional requirements must be met, i.e., the investigation must concern an offence punishable by imprisonment or there must be specific reasons to presume that evidence will be found 790 . With regard to searches concerning a person who is not a suspect, a higher threshold applies: such a search may only be conducted if the person consents to the search 791 or if the investigation concerns an offence punishable by imprisonment and there are specific reasons to presume that the search will produce evidence 792 . In all cases, a search is not allowed where, considering the purpose of the measure, the significance of the case, and the intrusion and inconvenience that the measure may be presumed to cause, the measure would be disproportionate 793 .

Procedurally, searches of accommodation, documents or papers may in principle only be conducted on the basis of a court order that contains information on the specific circumstances of the case demonstrating that the abovementioned conditions are met 794 . Where the purpose of the search would be defeated by applying for a court order (i.e., if the search would no longer lead to the collection of evidence in the investigation if it would be delayed to obtain a court order), a search may take place without a court order, upon a decision of the police 795 . In principle, persons whose accommodation, premise or object is to be searched are informed of and/or present at the search (whether the search is conducted on the basis of a court order or not) 796 . This requirement may only be derogated from under certain conditions (in particular if it is of crucial importance for the investigation that the search is conducted without the knowledge of the suspect and others, and only with respect to investigations of intentional violations of certain crimes, such as crimes against the independence of the State) and on the basis of a court order 797 .

Second, seizures may be conducted to secure evidence; to secure the State’s claim for legal costs, confiscation and fines; to secure the victim’s claim for restoration or compensation, and where the accused has evaded prosecution 798 . Any seizure may only take place as part of an investigation of an offence subject to public prosecution 799 , if there is reason to presume that the object may serve as evidence or should be confiscated, or if the object was taken from someone during the offence who can claim it back 800 . A production order requiring a person who is not a suspect to produce or surrender objects may be issued under the same conditions 801 . A seizure may not take place and a production order may not be issued if the measure is disproportionate in light of the significance of the case and the loss or inconvenience that the measure is likely to cause 802 . Moreover, a seizure or production order may only be conducted/issued to the least extent necessary. If the purpose of the measure may be achieved by less intrusive means, a written agreement to this effect may be concluded with the person against whom the measure is directed 803 .

Seizures and production orders may only take place/be issued when authorised by a court order, which must contain information on the specific circumstances of the case demonstrating that the abovementioned conditions are met 804 . If the purpose of the seizure/production order would be defeated by waiting for a court order, the objects/information may be obtained without a court order 805 . In that case, the person against whom the measure is directed may request that the case is brought before the court (as soon as possible and at the latest within 24 hours) to determine whether the seizure/production order can be approved 806 . In principle, the person against whom a seizure is directed is informed thereof when the measure is initiated, unless upon a court decision finding that it is of crucial importance to the investigation that it is conducted without the knowledge of the suspect or others 807 .

Third, the police may intercept communications and collect information on communications (e.g., through telephone tapping, the interception of mail, or by obtaining information on which devices are connected to a phone number or communication device) 808 . These measures may only be carried out under strict conditions: (1) there must be specific grounds for supposing that information is being passed or items sent to or from a suspect 809 ; (2) the measures may be assumed to be of crucial importance to the investigation and (3) the investigation concerns an offence that is punishable by law with imprisonment of at least six years or another serious offence specified by the Act 810 , or, for certain measures (telephone tapping and obtaining information on which telephones or similar communication devices within a specified area are connected to a particular telephone or other communication device), a crime that has endangered or may endanger human life or important public assets 811 . In any event, such measures may not take place where, considering the purpose of the measure, the significance of the case, and the intrusion and inconvenience that the measure may be presumed to cause the person or persons affected, the measure would be disproportionate 812 .

Similarly, the police may obtain information from telecommunication providers on the location of a mobile telephone that is presumed to be used by a suspect (‘telecommunications observation’). Such collection of location data may take place in the context of an investigation concerning an offence punishable by a term of imprisonment of at least 1.5 years, if there are specific reasons to assume that the mobile phone is used by a suspect and the measure is of major importance for the investigation 813 . Telecommunications observation may not be initiated if it would be disproportionate in light of the purpose of the interception and the importance of the case, as well as the harm and inconvenience it would likely cause to the concerned individual 814 .

Specific procedural safeguards apply to the interception of communications, the collection of information about communications and the collection of location data, which may in principle only take place on the basis of a court order, which must set out the specific circumstances of the case justifying that the abovementioned conditions are met, as well as the telephone numbers, premises, addressees, or items of mail affected by the measure 815 . The court order must also specify the time period in which the measure may be conducted, which must be as short as possible, not exceeding four weeks, unless extended by another court order 816 . Exceptionally, the police may collect (information on) communications without a court order, where obtaining the order would defeat the purpose of the measure, in which case approval from the court must be sough as soon as possible and no later than 24 hours after the measure is implemented 817 .

Moreover, when an application to a court is made by the police for the authorisation of measures concerning communications (including the interception of communications and the collection of location data), a lawyer must be appointed to represent the concerned individual, who is entitled to access the materials provided by the police, attend hearings and provide comments 818 . In addition, the concerned individual must in principle be notified by the court within 14 days after the measure has ended 819 . Such notice may only be dispensed with or deferred upon a decision of a court and after having provided the appointed lawyer with the opportunity to comment, if it would prejudice an ongoing investigation or the protection of confidential information on the police’s investigative methods, or if other circumstances argue against notification 820 .

Fourth, on the basis of a court order, the police may read data in an information system that is not publicly accessible with the aid of programs or other equipment (data reading) where (1) there are specific grounds for supposing that the information system is being used by a suspect in connection with certain serious crimes (i.e., crimes punishable with imprisonment of at least six years or crimes against the independence of the State and security or against the State constitution and the highest State authorities) and (2) the measure may be assumed to be of crucial importance to the investigation 821 . Data reading may not take place where, considering purpose of the measure, the significance of the case, and the intrusion and inconvenience that the measure may be presumed to cause the person or persons affected, the measure would be disproportionate 822 . The safeguards mentioned above for the collection of communications (i.e., on exceptional collection without a court order, the appointment of a lawyer and the notification of concerned individuals) also apply to data reading 823 .

Finally, certain entities in the Faroe Islands are required to report information (including personal data) to criminal law enforcement in accordance with rules on the prevention of money laundering and the financing of terrorism. In particular, the Act on Measures to prevent Money Laundering and Financing of Terrorism (Money Laundering Act) 824 requires certain entities (e.g., banks, fund brokers, payment service providers, investment management companies, etc.) to investigate complex and unusually large transactions, as well as all unusual patterns of transactions and activities that have no clear economic or demonstrable lawful purpose, in order to determine whether there is suspicion or reasonable grounds to presume that those transactions or activities are or have been connected to money laundering or financing of terrorism 825 . They must immediately notify the Public Prosecutor for Serious Economic and International Crime when they suspect, or have reasonable grounds to presume, that a transaction is or has been connected to money laundering or financing of terrorism 826 . Similarly, the Royal Decree on Specific Measures to combat Terrorism requires entities covered by the Money Laundering Act to immediately notify the Danish Money Laundering Secretariat of a transaction or request that has or has had a connection to persons or entities mentioned on the lists of names used in connection with Denmark’s implementation of the sanctions under United Nations Security Council Resolution No 1373 of 28 September 2001 827 .

2.2.2.Further use of the information collected

The processing of personal data collected by law enforcement authorities in the Faroe Islands is subject to the Act on the Processing of Personal Data by Law Enforcement Authorities 828 . As explained above, this Act essentially mirrors (with some minor adjustments to take the Faroese context into account, e.g., by removing references to cooperation with/in the European Data Protection Board) the Danish Act on the Processing of Personal Data by Law Enforcement Authorities 829 , which has transposed the Law Enforcement Directive into the Danish legal order. Therefore, the legal framework that applies in the Faroe Islands to the processing of personal data by criminal law enforcement authorities is based on the framework that applies in the EU. It provides for key data protection principles (e.g., purpose limitation, data minimisation, data accuracy, data security, accountability) 830 , imposes data protection obligations on law enforcement authorities (e.g., prohibiting the processing of sensitive data unless this is necessary for the protection of vital interests of individuals or the data is manifestly made public by the individual; 831 to report data breaches 832 , keep records of processing activities 833 , appoint a data protection officer 834 etc.) and imposes specific conditions for transfers of personal data to third countries or international organisations (in particular allowing transfers to countries/organisations for which the European Commission has adopted an adequacy decision under the Law Enforcement Directive, or, in the absence thereof, on the basis of an international agreement containing data protection safeguards or a self-assessment of all the circumstances of the transfer carried out by the controller) 835 .

In addition, more specific requirements on the use of information collected by criminal law enforcement authorities follow from the Administration of Justice Act. For example, the Act provides that any information incidentally obtained by the police in the context of a search or the collection of (information on) communications may not be used as evidence in court, unless a court decides otherwise if other investigative measures are unlikely to provide evidence in the case and the case concerns an offence that is punishable by imprisonment for at least 1.5 years (for information obtained through the collection of communications) or 6 years (for information obtained through a search)  836 . Moreover, under the Administration of Justice Act, any material obtained through the collection of (information on) communications must be destroyed if it proves not to be relevant to the investigation 837 .

2.2.3.Oversight

The activities of Danish criminal law enforcement authorities in the Faroe Islands are supervised by different bodies.

First, oversight of the processing of personal data by Danish criminal law enforcement authorities in the Faroe Islands is carried out by the Danish data protection authority (Danish DPA), under the Act on the Processing of Personal Data by Law Enforcement Authorities 838 . The Danish DPA may investigate compliance with the Act, on the basis of complaints from individuals or on its own initiative 839 . It has access to all information relevant to its activities and may conduct on-site inspections 840 . In terms of remedial powers, the Danish DPA may issue opinions that planned processing activities are likely to infringe the Act, may order processing operations to comply with the Act, or may temporarily or definitely restrict/prohibit the processing of personal data 841 . Non-compliance with an order of the Danish DPA is punishable by a criminal fine imposed by a court 842 .

Second, the activities of the Danish criminal law enforcement authorities in the Faroe Islands are subject to the general oversight of the Danish Ombudsman, the Danish Independent Police Complaint Authority and the Danish Audit Office.

The Danish Parliamentary Ombudsman is elected by the Danish Parliament to investigate, at its own initiative or acting on a complaint by an individual, whether public authorities act unlawfully or otherwise commit errors or derelictions in the discharge of their duties 843 . The Ombudsman is independent from the Parliament 844 and may only be dismissed by the Parliament if (s)he ceases to enjoy its confidence 845 . The Ombudsman has jurisdiction over all parts of the public administration, with the exception of courts 846 . In conducting investigations, the Ombudsman has access to all relevant information and can access all relevant premises 847 . The Ombudsman may express criticism, issue recommendations and otherwise state his/her views of a case, but cannot take legally binding decisions 848 . If the Ombudsman’s investigation of a case reveals errors or derelictions of major importance, it must be reported to the Parliament’s Legal Affairs Committee, as well as to the minister, municipal council or regional council concerned.

The Independent Police Complaints Authority is an independent body with the power to investigate, on the basis of complaints or on its own initiative, allegations of police misconduct (including in the Faroe Islands) 849 . In conducting an investigation of possible misconduct, the Authority has access to all relevant information 850 . Unless an investigation is terminated 851 , the Authority issues a decision within a reasonable time, in which it may include comments on the conduct of the police 852 . The Authority may also initiate an investigation into allegations of criminal offences committed by the police, either upon a complaint from an individual or ex officio, when there is a reasonable suspicion that police personnel in service have committed a criminal offense which is subject to prosecution by the public authorities 853 . In this context, the Authority has access to all relevant information and may use the investigatory powers, including the coercive powers, which are available to the police, 854 . When an investigation is completed, the Authority sends the case to the public prosecutor for a decision on possible prosecution 855 . In addition, the Authority shares an annual report on its investigation with the Danish Attorney General 856 . According to the 2022 annual report of the Authority, it handled 17 cases concerning the Faroe Islands in 2022, including two criminal cases concerning the unlawful disclosure of information 857 .

The Danish Audit Office is an independent body headed by an Auditor General, who is appointed by the Speaker of the Danish Parliament and approved by the Parliament’s Standing Orders Committee 858 . While the main role of the Audit Office is to conduct financial audits, it may also examine whether government-funded agencies and enterprises comply with applicable laws and regulations and on the efficiency and effectiveness of the administration. For example, in 2020, the Audit Office published a report on the outsourcing of sensitive and confidential personal data by central government IT systems 859 .

2.2.4.Redress

Individuals whose personal data is collected by criminal law enforcement authorities in the Faroe Islands have access to different avenues to obtain redress, including compensation for damages.

First, individuals have a right to obtain access to, correction 860 of and deletion 861 of their data processed by criminal law enforcement authorities under the Act on the Processing of Personal Data by Law Enforcement Authorities 862 . The exercise of the right of access may be postponed, restricted or refused if providing access would be prejudicial to (1) official or legal inquiries, investigations or procedures, (2) the prevention, detection, investigation or prosecution of criminal offences or the execution of criminal penalties, (3) the protection of national security, (4) the protection of public security or (5) the protection of the rights of the data subject or others 863 . In response to a request for erasure, the authority may instead restrict the processing of personal data where the accuracy of the data is contested by the data subject and the accuracy/inaccuracy cannot be ascertained, or the data must be maintained for the purposes of evidence 864 . In case of a postponement/restriction/refusal, a law enforcement authority has to inform the individual of the reasons thereof or indicate to the individual that it is not possible to disclose whether or not personal data regarding him/her are being processed 865 . In both cases, the individual has to be informed about the possibility to appeal the decision, or to request that the Danish DPA exercises the rights on behalf of the individual (the outcome of which can in turn be appealed before a court) 866 .

Second, any individual may lodge a complaint concerning the processing of their data by a criminal law enforcement authority with the Danish DPA 867 . In response to a complaint, the latter may make use of all of the investigatory and remedial powers described in the previous section. Decisions or inaction of the Danish DPA can be appealed before the Danish courts 868 . The court may annul administrative decisions and return the decision to the specific authority (cassation) or replace an administrative decision with a new decision 869 .

Third, any individual can lodge a complaint about the actions of Danish criminal law enforcement authorities in the Faroe Islands, including the collection and use of personal data, before the Danish Parliamentary Ombudsman, who can make use of the powers described in the previous section. Similarly, individuals can turn to the Independent Police Complaints Authority, which can make use of the powers described in the previous section to investigate and handle complaints or allegations of criminal offences concerning activities of Danish criminal law enforcement authorities 870 .

Fourth, individuals can also directly invoke the Act on the Processing of Personal Data by Law Enforcement Authorities against criminal law enforcement authorities in court to obtain judicial redress 871 . This also includes the possibility to obtain compensation for material or immaterial damage suffered as a result of unlawful data processing by a criminal law enforcement authority 872 .

Fifth, different judicial redress avenues are available to individuals to challenge the unlawful use of investigative measures (e.g., search, seizure, intervention with the secrecy of communications, etc.). In particular, disputes on the lawful use of investigatory powers may be brought before the court during an investigation, in which case an individual can invoke Section 72 of the Danish Constitution 873 . Furthermore, depending on the circumstances, unlawfully obtained evidence may be ruled inadmissible by the court in the criminal case 874 . In addition, any individual who, in the course of criminal proceedings, has been subjected to investigative measures may obtain compensation for financial damage, mental suffering, inconvenience, disturbance or deterioration of position or condition as a result of these measures 875 . The Prosecution Service decides whether to award a claim for damages 876 . If the claim for damages is refused, the claimant can, within two months of notification of the refusal, request that the claim is brought before the district court 877 .

Finally, any individual may obtain judicial redress before the European Court of Human Rights against the unlawful collection of his/her data by Danish criminal law enforcement authorities in the Faroe Islands, provided that all available domestic remedies have been exhausted.

2.3.Access and use by public authorities for national security purposes

Personal data transferred from the EU to the Faroe Islands based on the adequacy decision may be accessed for national security purposes by the Danish Security and Intelligence Service (DSIS) on the basis of legislation put into force in the Faroe Islands and Faroese implementing rules 878 . The DSIS, which is part of the police, is primarily tasked with preventing, investigating and combating crimes against the independence and security of the State, as well as crimes against the constitution and supreme State authorities 879 . In addition, the DSIS performs several other tasks in the area of national security, such as informing the Minister of Justice of matters relating to internal security, collecting intelligence on threats to the country, and drawing up threat assessments 880 . As described in more detail below, the collection of personal data by the DSIS in the Faroe Islands, as well as the further use of such data, is regulated by the ASIS, the Faroese Administration of Justice Act and Faroese Executive Orders.

2.3.1.Legal bases and applicable limitations/safeguards

The ASIS lays down the different powers of the DSIS (described in more detail below), as well as the overarching conditions and limitations that apply to the use of each power. Importantly, while the ASIS provides the DSIS with a legal basis to collect information (including personal data), the DSIS can only make use of coercive measures – such as carrying out a search/seizure, issuing a production order, or intercepting communications – in accordance with the conditions, limitations and safeguards of the Administration of Justice Act described in section 2.2.1 881 . As a result, the same requirements as the ones that apply to criminal law enforcement activities of the Police, also apply to the national security activities of the DSIS. For example, the information must be important in the context of a specific criminal investigation, the DSIS must comply with the principle of proportionality, prior judicial authorisation must in principle be obtained, and individuals must in principle be notified about the collection of their data (e.g., within 14 days after the interception of communications), etc.

More generally, the DSIS is, as any other public authority, subject to principles of general administrative law, including the principle of proportionality. This means, inter alia, that the means and methods used by the DSIS to collect or obtain personal data must be appropriate for that purpose, that less intrusive means and methods must be deemed not to be sufficient, and that the method chosen must not be disproportionate to the purpose for which the data are collected or obtained 882 .

In accordance with the ASIS, the DSIS provides that it may open “inquiries” into natural and legal persons, if the inquiry is likely to be relevant for the performance of its tasks relating to the prevention and investigation of crimes against the independence and security of the State or against the constitution, or if the inquiry is necessary for the performance of its other tasks 883 . An inquiry is an activity aimed at specifically selected natural or legal persons for the purpose of collecting or obtaining information about them. The actual collection of personal data in the context of an inquiry may only take place if additional conditions are met.

First, the Act provides that the DSIS may collect and obtain data that may be relevant to its activities 884 . Based on the preparatory work for the Danish DSIS Act (on which the Faroese Act is based), the “collection” of personal data means accessing data that is readily available (e.g., information available on the internet), while “obtaining” personal data means accessing data that is not readily available but can be obtained by contacting a third party such as a public authority, association, organisation or private person 885 . According to an evaluation report of the Danish Ministry of Justice on the activities of the DSIS, the criterion “may be relevant” implies that data may only be collected or obtained by the DSIS if the data is likely to have an impact on the effectiveness of the Service 886 . In any event, a third party receiving a request is not obliged under the ASIS to disclose personal data to the DSIS 887 . Whether the requested data can be disclosed must therefore be determined based on the legal grounds for processing set out in the applicable data protection legislation, in this case the Faroese Data Protection Act. The only way for the DSIS to compel the third party to disclose data is by following the procedures of the Administration of Justice Act (e.g., to obtain a production order) 888 .

Second, the DSIS may obtain data from other public authorities (including in the Faroe Islands) 889 , which are obliged to disclose the data if the DSIS considers that the data are likely to be relevant to the performance of its tasks relating to the prevention and investigation of crimes against the independence and security of the State, as well as crimes against the constitution. The criterion “likely to be relevant” implies that there must be a more specific presumption that the data which the Service wishes to obtain will have an impact on the performance of the Service’s tasks 890 . In other words, there must be a certain probability (and not a remote possibility) that the data may contribute to the Service’s performance of those tasks 891 .

Additional limitations and safeguards follow from the EOFIDSIS, which for instance requires that the collection of particularly sensitive health data (e.g., information on psychiatric diagnoses) and data on groups of persons who are not identified in advance may only take place with the prior approval of the head or general counsel of the DSIS 892 . When obtaining data on groups of unidentified persons, the DSIS is required, as soon as circumstances permit, to assess whether the persons to whom the data relates are relevant for its tasks. To the extent this is deemed not to be the case, the irrelevant data must be deleted immediately 893 . In addition, the use of coercive investigative measures must always be approved by the head or general counsel of the DSIS or their deputies 894 . If the measure in question requires a court order, the approval must be given before the case is referred to the court in accordance with the rules of the Administration of Justice Act 895 .

As stressed above, the provisions of the ASIS on the possibility for the DSIS to open inquiries and in that context collect information do not by themselves authorise the DSIS to initiate criminal investigations or to make use of coercive powers such as searches, seizures, production and the interception of communications (or collection of information on communications). The latter may only be carried out if all relevant legal requirements are fulfilled, i.e., under (1) the ASIS (e.g., establishing the relevance or necessity of the collection for the performance of the DSIS’ tasks), (2) the EOFIDSIS (e.g., as regards internal approval) and (3) the Administration of Justice Act (e.g., relevance/importance to a specific criminal investigation, compliance with the principle of proportionality, need to obtain prior authorisation from a court, obligation to notify concerned individuals, etc.).

2.3.2.Further use of the information collected

The processing of personal data collected by the DSIS is also governed by the ASIS, which imposes the principle of purpose limitation, data minimisation, data accuracy and limited data retention 896 . With respect to data retention, the ASIS generally requires the DSIS to delete data on natural persons where no new information has been obtained in connection with the inquiry or investigation in the last 15 years 897 . Data may only be kept longer where the data is needed on imperative grounds relating to the performance of the DSIS’ tasks, in which case the DSIS must inform the Intelligence Oversight Board (see below) thereof 898 . However, if the DSIS becomes aware that there is no longer a legal basis to keep data before the abovementioned retention period has expired (i.e., because the data is no longer relevant to the performance of its tasks relating to the investigation of certain crimes or the data is no longer necessary for the performance of the DSIS’ other tasks), that data must be deleted immediately 899 . This obligation does not apply where the information is included in documents for which there is still a legal basis for the processing 900 . The DSIS must carry out regular spot checks on the deletion of data, on which it is required to regularly report to the Intelligence Oversight Board 901 .

The DSIS is also required to have technical and organisational measures in place to ensure the security of the data it processes, in accordance with the DSIS Order on security measures 902 . This includes having internal rules on inter alia physical security measures, access control and authorisation schemes, guidance on the use of computer equipment, etc., which must be reviewed at least annually 903 . More generally, the EOFIDSIS requires the DSIS to regularly carry out spot checks on deletion, logging, opening of investigations, obtaining of data, investigative measures and transfer of data 904 and report on such checks to the Intelligence Oversight Board 905 .

Under the ASIS, the further sharing of personal data with other entities is subject to specific requirements. First, the DSIS may share data with the Danish Defence Intelligence Service if such sharing may be relevant to the performance of the tasks of both services 906 . The disclosure of information to other entities (within or outside the Faroe Islands) may take place only (1) in compliance with all data protection principles (e.g., purpose limitation, data minimisation, data accuracy); (2) if the individual has given consent, the disclosure is likely to be relevant to the performance of the DSIS’ tasks relating to the prevention and investigation of crimes against the independence and security of the State or against the constitution, or the disclosure is necessary for the performance of its other tasks and (3) when the disclosure is presumed reasonable following a case-by-case assessment (which, according to the preparatory work on the ASIS, requires to examine in particular, the content of the information, the purpose of the disclosure and an assessment of the damaging effect that such disclosure could cause for the concerned individual) 907 . An additional requirement applies to sensitive personal data, which may only be transferred to foreign authorities with the prior approval of the head or general counsel of the DSIS or their deputies 908 .

Finally, when making use of the powers under the Administration of Justice Act, the same limitations under that Act as the ones described in Section 2.2.2, e.g., as regards the use of intercepted communications as evidence or the deletion thereof when the information is not relevant for the investigation, also apply to data processed by the DSIS.

2.3.3.Oversight

The activities of the DSIS are supervised by different bodies.

First, compliance by the DSIS with the ASIS, including its requirements on the processing of personal data, is overseen by the independent Danish Intelligence Oversight Board 909 . The Board can investigate compliance with the ASIS (and the rules established under the ASIS, such as the EOFIDSIS) 910 on its own initiative or on the basis of a complaint from an individual 911 . For example, in 2021, the Board inter alia carried out checks of compliance by the DSIS with the requirements for obtaining information from other public authorities, the data retention requirements, the rules for data sharing with third parties, as well as data security 912 . In carrying out its oversight activities, the Board can access all relevant information (including by ordering the DSIS to provide any information or material relevant to its activities, to access the premises of as well as the data processed by the DSIS) 913 . In addition, the DSIS is required to regularly report to the Board, e.g., about the collection of personal data from public authorities and about its regular internal audits concerning data deletion, logging, the opening of investigations, obtaining of data, the use of investigative measures and transfers of data 914 . The Board may issue an opinion with recommendations to the DSIS, which may also be provided to the Minister of Justice 915 . If, in exceptional cases, the DSIS does not comply with a recommendation of the Board, it must notify the Board and immediately submit the matter to the relevant minister for decision 916 . If also the minister decides not to follow the recommendation of the Board, the Government must notify the Parliamentary Committee for the Intelligence Services 917 .

Second, the DSIS is more generally subject to independent oversight by the Danish Parliamentary Ombudsman, who can make use of all the powers described in section 2.2.3.

Third, the DSIS, as a part of the Danish police, is also subject to the oversight of the Independent Police Complaints Authority, which can make use of all the powers described in section 2.2.3.

Fourth, the Danish National Audit Office also has the power to supervise the activities of the DSIS, under the same conditions as described in section 2.2.3.

Finally, the DSIS is subject to specific parliamentary oversight by the Danish Parliamentary Committee for the Intelligence Services 918 . To this end, the Government must provide the Committee with an annual update on the activities of the intelligence services, including the DSIS, and keep it informed of significant circumstances of a security nature and foreign policy issues relevant to the activities of the intelligence services 919 . The Committee may also request information from the government on the activities of the intelligence services, including statistical information 920 . Finally, prior to issuing guidelines on the activities of the intelligence services, the government must inform the Committee of their content 921 . The Committee may, either orally or in writing, provide the government with its opinion on all the matters under its consideration 922 . However, since the members of the Committee are bound by a duty of confidentiality, the recommendations of the Committee are not made public 923 .

2.3.4.Redress

Individuals can make use of different avenues to obtain redress against the DSIS, including compensation for damages.

First, individuals may request the Intelligence Oversight Board to investigate whether the Service is processing personal data about them “without justification” 924 . Following such a request, the Board must ensure that this is not the case and inform the person concerned thereof 925 . In particular, the Board will, on the basis of a request from an individual, verify whether the DSIS complies with the ASIS, including for instance with the applicable data protection principles (e.g., purpose limitation, data accuracy, data minimisation). If during its investigation the Board finds that the Service is processing personal data without a legal basis (or no longer has a legal basis for the processing), the DSIS is obliged to delete that data under the ASIS 926 . In addition, in case “special circumstances so warrant”, the Board may also order the Service to provide the data subject full or partial access to personal data about him/her processed by the Service 927 . For example, in 2021, the Board received 35 requests from individuals, which led to a finding that data was processed unlawfully in six cases, after which the data was deleted by the DSIS 928 . Decisions of the Board in response to a request from an individual can be challenged before the Danish courts in accordance with Section 63(1) of the Constitution to obtain judicial review, as described in section 2.2.4.

In addition, while under the ASIS individuals are in principle not entitled to have direct access to data processed by the DSIS or to know whether the DSIS is processing such data, the DSIS may provide full or partial access to data upon request “if special circumstances so warrant”, i.e., where the individual has a vital interest in having access to the data, e.g., if it could have serious psychological harmful effects if the person is not informed that he or she is not registered with the Service, or in cases where unlawful processing of personal data has caused a person significant financial or non-financial damage 929 .

Second, any individual can lodge a complaint about the actions of Danish national security authorities in the Faroe Islands, including the collection and use of personal data, before the Danish Parliamentary Ombudsman, who can make use of the powers described in the previous section.

Third, individuals can turn to the Independent Police Complaints Authority, which can make use of the powers described in the previous section to investigate and handle complaints concerning activities of Danish national security authorities 930 .

Fourth, the same judicial avenues as the ones described in section 2.2.4 (e.g., invoking Section 72 of the Danish Constitution, claiming compensation for damages suffered because of the unlawful use of investigative measures under the Administration of Justice Act) are also available against the DSIS.

Finally, any individual may obtain judicial redress before the European Court of Human Rights against the unlawful collection of his/her data by the DSIS, provided that all available domestic remedies have been exhausted.

V. BAILIWICK OF GUERNSEY

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of Guernsey

On 21 November 2003 the European Commission adopted a decision in which the Bailiwick of Guernsey was considered as providing an adequate level of protection for personal data 931 . The Article 29 Working Party had adopted a positive opinion on the level of protection of personal data in Guernsey on 13 June 2003 932 . At the time, the legal framework for the protection of personal data was set out in the Data Protection (Bailiwick of Guernsey) Law 2001 (Data Protection Law 2001), which was closely aligned with the UK’s Data Protection Act 1998. The latter had been enacted to give effect to the provisions of Directive 95/46/EC (Data Protection Directive) 933 .

Since the adoption of the Commission’s adequacy decision, Guernsey has significantly modernised its data protection framework, in particular by adopting the Data Protection (Bailiwick of Guernsey) Law 2017 (Data Protection Law). The Data Protection Law was intended to bring the Guernsey regime in line with Regulation (EU) 2016/679 (GDPR) 934 . It applies in full since 26 May 2019 935 .

The Data Protection Law is complemented by several Ordinances and Regulations. The most important one is the Data Protection (Law Enforcement and Related Matters) (Bailiwick of Guernsey) Ordinance, 2018 (LEO), which regulates the processing of personal data by competent authorities for criminal law enforcement and national security purposes 936 .

With the adoption and full entry into force of the Data Protection Law and the abovementioned Ordinances and Regulations, the Guernsey data protection regime has been significantly strengthened. As set out in more detail below, the Data Protection Law mirrors the provisions of the GPDR with respect to all of its key aspects. In particular, in areas where the GDPR has enhanced the protection of personal data when compared to the protection offered by its predecessor, the Data Protection Directive, the Data Protection Law of Guernsey has been strengthened as well.

Like the Data Protection Law 2001, the new Data Protection Law has a broad scope of application, applying to both private operators and public authorities 937 . While the definitions of ‘personal data’, ‘controller’, ‘processor’, ‘data subject’ and ‘processing’ 938 (which are identical to those used in the GDPR) have not changed, the Data Protection Law has brought even more convergence with the GDPR, e.g., by introducing a definition of ‘pseudonymisation’ 939 and further clarifying when a person is “identifiable” by applying the same criteria of recital 26 of the GDPR 940 . Also the territorial scope of the Law has been extended to cover the processing of personal data by controllers or processors not established in Guernsey, subject to the same conditions that are set out in Article 3 of the GDPR 941 . This confirms the intention of the Guernsey legislator to strengthen the effectiveness of Guernsey’s data protection regime.

The main data protection principles (i.e., the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality) were already present in the Data Protection Law 2001 and are present also in the modernised Law 942 . Some of them have been further strengthened, e.g., the principle of lawfulness of processing, the transparency obligations, the security principle and the principle of accountability.

In particular, as regards the principle of lawfulness, the requirements for valid consent have been reinforced, by making clear that, in addition to being freely given, specific and informed, consent must be unambiguous and expressed by a clear affirmative action 943 . Similarly, the Data Protection Law has strengthened the existing transparency obligations by requiring that additional information is provided to the individual (e.g., the contact details of the data protection officer, the fact that the controller intends to transfer the data to a third country, the retention period, the right to withdraw consent, the existence of automated decision-making, etc.) when data is collected directly from the individual 944 or from third parties 945 and when it is further processed 946 .

With respect to the principle of data security, the Data Protection Law has introduced the obligation to notify data breaches 947 , which was previously not present in the Guernsey regime. As also required by the GDPR, in case of a personal data breach, the controller must, as soon as practicable, and in any event, within 72 hours after becoming aware of the breach (unless the latter is not practicable), notify the personal data breach in writing to the Authority. If a personal data breach is likely to pose a high risk to the significant interests of a data subject, written notice must be provided also to the data subject.

In terms of accountability, the obligations have been fully aligned with the GDPR and requirements that were not present in the Data Protection Law 2001 have been introduced: The Data Protection Law contains the obligations to implement principles of data protection by design and by default 948 , to keep records of processing 949 , to designate a data protection officer 950 , and to conduct impact assessments 951 . Like the GDPR, the Data Protection Law follows a risk-based approach, and the scope of the obligations is tailored to the risks for the rights and freedoms of natural persons.

In addition to the strengthening of data protection principles and obligations, the protections for special categories of personal data have been reinforced since the adoption of the adequacy decision. The Data Protection Law 2001 already offered additional protection for information about the racial or ethnic origin, political opinions, religious beliefs or other beliefs of a similar nature, about membership in a trade union or other labour organisation, about physical or mental health and the commission or alleged commission of an offence 952 . The Data Protection Law extends this protection to biometric and genetic data 953 . As regards the safeguards that apply to the processing of special categories of data, the Data Protection Law allows the processing of special categories of data only in specific circumstances, and, in certain cases requires the processing to be accompanied by additional safeguards 954 . That was already the case under the Data Protection Law 2001 955 .

In terms of rights, Part III of the Data Protection Law provides individuals with all of the key data protection rights, notably the right of access, rectification, and erasure 956 , and it also provides for a right to restriction 957 and objection 958 . In addition, the Law provides for a right not to be subject to decisions based on automated processing 959 .

Compared to the previous legislation, the Data Protection Law has strengthened the rights of individuals in several ways. The right of access not only requires controllers to provide individuals with information about the processing of their data (as was already the case under the Data Protection Law 2001 960 ), but also to give access to personal data (including by providing a copy) 961 . Moreover, additional grounds to object to processing have been added 962 . For instance, individuals have a right to object to the processing of their personal data where such processing is based exclusively on grounds of public interest or on the legitimate interest of the controller 963 . In addition, the data subject no longer has to apply to a court to order the rectification and erasure of their personal data, as was required under the Data Protection Law 2001, but instead can make a request directly to the controller 964 .

Importantly, new rights have been introduced in the Guernsey Data Protection Law. This includes a right for individuals not to be subject to a decision that is based solely on automated processing and affects the significant interests of the data subject. 965 . Such automated decision making may only take place under certain conditions (e.g., only where authorised by law or based on the data subject’s explicit consent) and subject to specific safeguards (e.g., informing the individual about the processing, the logic involved and the envisaged consequences, allowing the data subject to obtain human intervention) 966 . In addition, the Data Protection Law introduced a right to data portability that corresponds to the same right available under the GDPR 967 .

As is the case in the GDPR, the data subject rights are subject to certain restrictions intended to allow the balancing of the data protection interests of individuals with objectives of general public interest and with the fundamental rights and freedoms of others.

First, Part I of Schedule 8 allows the restriction of individual rights based on the nature of the personal data being processed. These restrictions apply automatically whenever one of the listed categories of personal data is being processed. The categories are listed in an exhaustive manner and cover a narrowly construed set of situations, such as the provision of references in confidence by the controller in the context of the education, employment or appointment of the data subject, or personal data recorded by a candidate during an examination or marking. These categories are not only very limited in scope, but also do not typically cover situations where personal data is transferred to Guernsey from the EU.

Second, Part II of Schedule 8 sets out restrictions on grounds of prejudice. They can be invoked only when (and to the extent that) the application of the provisions “would be likely to prejudice” the legitimate aim pursued. For example, controllers can restrict data subject rights to the extent that their application would be likely to prejudice the combat effectiveness of the armed forces of the Crown 968 , or would be likely to prejudice judicial independence or the conduct of judicial proceedings 969 .

The Data Protection Authority of Guernsey has issued interpretative guidance that clearly frames the application of the exemptions. It clarifies the scope of the different exemptions, including by means of examples, which helps to prevent these exemptions being misunderstood and applied in an overly broad manner. It also explains how the requirements of necessity and proportionality should be applied with respect to a specific exemption 970 .

With respect to international transfers of personal data, i.e., concerning the potential onward transfer of personal data that has been transferred from the EU, Guernsey has reorganised and clarified its transfer regime and put in place a system that is very similar to the rules on international transfers set out in Chapter V of the GDPR in terms of structure and requirements. Section 55 of the Data Protection Law lays down a prohibition on transferring data to unauthorised jurisdictions, except when specifically authorised by the Law. Authorised jurisdictions are Member States of the European Union, as well as any country or international organisation for which the European Commission has determined that it ensures an adequate level of protection within the meaning of Article 45(2) of the GDPR 971 .

The Data Protection Law further clarifies that countries which have been found adequate by the European Commission are only considered as authorised jurisdictions as long as the adequacy finding is still in force 972 . Guernsey has thus ensured an automatic alignment between the adequacy decisions of the EU and its own data transfer authorisations.

Sections 56, 57 and 59 of the Data Protection Law set out the conditions for transfers to unauthorised jurisdictions. Section 56 allows transfers if the controller or processor is satisfied of the existence of appropriate safeguards and of a mechanism for data subjects to enforce their rights and obtain effective legal remedies against the recipient. The instruments that can be used to provide such safeguards are similar to those provided in Article 46 of the GDPR: (1) a legally binding and enforceable agreement between public authorities, (2) binding corporate rules 973 , (3) standard data protection clauses 974 , (4) an approved code of conduct and (5) an approved certification mechanism 975 .

Under the conditions laid down in Section 57, personal data can be transferred to unauthorised jurisdictions if authorised by the Data Protection Authority 976 . Section 57 explicitly requires the Authority to take into account any opinions or decisions of the European Data Protection Board in determining whether to authorise a transfer. In this area, Guernsey has thus ensured that beyond the alignment of the law itself, also the interpretation of the law remains in line with the interpretation within the EU.

Finally, transfers can take place on the basis of certain statutory grounds listed in Section 59(1) of the Data Protection Law 977 . These statutory grounds for transfers overlap to a large extent with the derogations for specific situations listed in Article 49 of the GDPR. Moreover, the Guernsey authorities have confirmed that a transfer under Section 59(1) would need to be justified on a case-by-case basis, i.e., each instance of transfer, and each piece of personal data transferred would need to fulfil the specific statutory conditions in the relevant provision of Section 59(1) in order for the transfer to be lawful. They have also confirmed that Section 59(1) of the Data Protection Law has to be interpreted in a manner equivalent to Article 49 of the GDPR to preclude systematic or repetitive transfers.

1.2.Oversight, enforcement and redress

Guernsey has also reformed its system of oversight and enforcement of the Data Protection Law. Oversight and enforcement are carried out by the Data Protection Authority (the Authority), which replaces the Commissioner under the Data Protection Law 2001 978 . The Authority is composed of a chairman, four to eight other voting members (the Members), and a commissioner (an ex officio and non-voting member) 979 . Compared to the previous Commissioner, the independence of the Authority has been significantly strengthened in several ways.

First, the independence of the Authority is explicitly provided by Section 62 of the Data Protection Law, which requires it to act independently, free from direct or indirect external influence and without seeking or taking instructions from any person. Second, the Authority now enjoys a status of a legal person separate from its members 980 . Third, the Law lays down specific requirements for the appointment and dismissal of the Members and the Commissioner. The Members are appointed by resolution of the Parliament of Guernsey among individuals nominated by a Parliamentary Committee 981 . The Commissioner, which is the chief executive of the Authority, is appointed by the Authority itself 982 . They must have the qualifications, experience and skills necessary to exercise and perform their functions, in particular in the area of data protection. In addition, the Members must have a strong sense of integrity and must be able to maintain confidentiality 983 .

Members can only be removed from office by a resolution of the Parliament of Guernsey, on the basis of a report and recommendation from the Parliamentary Committee, on the basis that the specific conditions for dismissal as set out in the Law are met 984 . The conditions for the dismissal of the Commissioner by the Authority are equally set out in the Law 985 . The Commissioner may not engage in any other employment, occupation or business, or receive any benefits other than the salary, allowances and other expenses awarded by the Authority, except with the approval of the Authority 986 .

The Data Protection Law has also equipped the Authority with additional investigatory and enforcement powers that are very similar to those foreseen in the GDPR. In particular, the Authority can conduct audits 987 , investigate individual complaints 988 and carry out general inquiries on its own initiative 989 . In carrying out its functions, the Authority has access to all relevant information 990 . Upon finding of a violation of the Data Protection Law, the authority can impose various sanctions, ranging from warnings and reprimands to binding orders (for instance to discontinue processing, bring processing into compliance with the Law, rectify, erase or restrict processing or suspend the transfer of personal data) 991 .

Moreover, the Authority can impose administrative fines for certain violations of the Law 992 . The fines must be effective, proportionate and have a deterrent effect 993 . As regards the amount of fines, the Authority has to take into account the same factors as those listed in Article 83(2) GDPR, i.e., the intentional or negligent character of the infringement, any action taken by the controller or processor to mitigate the damage suffered by data subjects, duration of the infringement etc. 994 . In addition, several violations of the Data Protection Law continue to constitute offences and may therefore be subject to criminal sanctions 995 .

As regards possibilities for individuals to obtain redress, the Guernsey system continues to offer various avenues, including the possibility to lodge a complaint with the Authority 996 , to obtain judicial redress directly against controllers and processors (both private operators and public authorities) 997 and obtain compensation for damages 998 . In addition, individuals can obtain judicial redress against decisions of the Authority 999 .

Despite its relatively small size, the Authority plays an active role, both when it comes to its engagement with stakeholders and exercising its oversight role. The Authority handles a number of files, including inspections, notifications, written questions and complaints each year. For example, between 25 May and 31 December 2018, the Authority handled 34 complaints and conducted 30 investigations 1000 . In 2019, the Authority handled 67 complaints and conducted 50 investigations, which led to a breach determination in 8 cases and reprimands being imposed in 6 cases. Moreover, the Authority held 11 public events and organised sessions for organisations every two weeks, in which it provided information and advice 1001 . In 2020, the Authority issued seven reprimands, one warning, two fines and one order and again dealt with a number of complaints and investigations 1002 . The Authority also engages in various outreach activities on an ongoing basis, such as presentations for both the private and public sector, for instance on data protection for start-ups and small businesses, on individual rights or on how to respond to data subject access requests 1003 .

2.ACCESS TO AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN GUERNSEY

2.1.General legal framework

The limitations and safeguards that apply to the collection and subsequent use of personal data for purposes of criminal law enforcement and national security follow from Guernsey’s international obligations in the area of fundamental rights and personal data protection, from the rules that apply to the processing of personal data by the public sector, as well as from specific laws regulating access to data by Guernsey public authorities.

First, as an exercise of power by a public authority, government access in Guernsey must be conducted in full respect of the law. The ratification of the European Convention of Human Rights by the United Kingdom has been extended to Guernsey since 1953 1004 . The right to respect for private and family life (and the right to data protection as part of that right) is protected by the Human Rights (Bailiwick of Guernsey) Law 2000, which incorporates the European Convention on Human Rights into Guernsey law 1005 . Article 8 of the Convention provides that any interference with privacy must be in accordance with the law, in the interests of one of the aims set out in Article 8(2) and proportionate in light of that aim. Article 8 also requires that the interference is “foreseeable”, i.e., have a clear, accessible basis in law, and that the law contains appropriate safeguards to prevent abuse.

In addition, in its case law 1006 , the European Court of Human Rights has specified that any interference with the right to privacy and data protection should be subject to an effective, independent and impartial oversight system that must be provided for either by a judge or by another independent body 1007 (e.g., an administrative authority or a parliamentary body).

Moreover, individuals must be provided with an effective remedy, and the European Court of Human Rights has clarified that the remedy must be offered by an independent and impartial body which has adopted its own rules of procedure, consisting of members that must hold or have held high judicial office or be experienced lawyers, and that there must be no evidential burden to be overcome in order to lodge an application with it. In undertaking its examination of complaints by individuals, the independent and impartial body should have access to all relevant information, including closed materials. Finally, it should have the powers to remedy non-compliance 1008 .

Second, the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) also applies in Guernsey 1009 . Article 9 of Convention 108 provides that derogations from the general data protection principles, the rules governing special categories of data and data subject rights are only permissible when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences, or for protecting the data subject or the rights and freedoms of others.

Therefore, through adherence to the European Convention of Human Rights and to Convention 108, Guernsey is subject to a number of obligations, enshrined in international law and that frame its system of government access on the basis of principles, safeguards and individual rights similar to those guaranteed under EU law and applicable to the Member States. Furthermore, as far as the ECHR is concerned, compliance with these obligations is subject to the judicial control of the European Court of Human Rights.

Third, the Guernsey Parliament has adopted specific provisions for the processing of personal data for law enforcement purposes, i.e., the Data Protection (Law Enforcement and Related Matters) (Bailiwick of Guernsey) Ordinance, 2018 (LEO). The material scope of the LEO is similar to the one of the Law Enforcement Directive. It applies to the processing of personal data by competent authorities 1010 for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security or national security, as well as for exercising or performing any power or duty conferred or imposed on a public authority by a criminal proceeds enactment 1011 .

Furthermore, the data protection principles of lawfulness and fairness 1012 , purpose limitation 1013 , data minimisation 1014 , accuracy 1015 , storage limitation 1016 and security 1017 are retained in the LEO in similar terms as in the Law Enforcement Directive. In essence, the processing of personal data by a competent authority for a law enforcement purpose is permitted only if and to the extent that it is carried out in the context of a function imposed by law and the data subject has given consent, the processing is necessary for the performance of a task carried out by the authority, or an enactment authorises or requires such processing 1018 . In addition, the LEO imposes specific transparency obligations 1019 and recognises the same data subject rights as the LED 1020 . In particular, individuals enjoy a right of access 1021 , correction 1022 and deletion 1023 and have the right not to be subject to automated decision-making 1024 . Competent authorities are also required to implement data protection by design and default 1025 , to keep records of processing activities 1026 , and, in certain situations, to conduct data protection impact assessments and to pre-consult the Data Protection Authority 1027 . Moreover, they are required to put in place appropriate measures to ensure security of processing 1028 and are subject to specific obligations in case of a data breach, including notification of such breaches to the Authority and data subjects 1029 . Like in the Law Enforcement Directive, there is also a requirement for a controller (unless it is a court or other judicial authority acting in a judicial capacity) to designate a data protection officer who assists the controller in complying with its obligations as well as monitoring that compliance 1030 . Finally, the LEO contains specific provisions on international transfers of personal data 1031 . The provisions substantially echo those in the Law Enforcement Directive. Essentially, transfers to “unauthorised jurisdictions” 1032 are prohibited unless they are necessary for a law enforcement purpose and based on appropriate safeguards 1033 . In the absence of appropriate safeguards, transfers to unauthorised jurisdictions are only possible in specific circumstances that are listed in the law in an exhaustive manner and correspond to the ‘derogations' set forth in the Law Enforcement Directive 1034 .

Under similar conditions as under the Law Enforcement Directive, Section 24 of the LEO specifies that certain specific provisions of the LEO 1035 may be restricted to the extent that and as long as, having regard to the significant interests of the data subject, the restriction is a necessary and proportionate measure for one of the purposes listed in the law 1036 .

Moreover, Schedule 3 to the LEO imposes the same restrictions (where relevant in the context of the LEO) to specific provisions 1037 of the LEO as the ones provided by the Data Protection Law 1038 . First, Schedule 3 allows the restriction of individual rights based on the nature of the personal data being processed. These restrictions apply automatically whenever one of the listed categories of personal data is being processed. These categories are listed in an exhaustive manner and cover a very limited, narrowly construed set of situations. In addition, they do not typically cover situations where personal data is transferred to Guernsey from the EU 1039 . Second, Schedule 3 sets out restrictions on grounds of prejudice. They can be invoked only when and to the extent that the application of the provisions “would be likely to prejudice” the legitimate aim pursued. For example, controllers can restrict data subject rights to the extent that their application would be likely to prejudice the combat effectiveness of the armed forces of the Crown 1040 , or would be likely to prejudice judicial independence or the conduct of judicial proceedings 1041 . As explained in section 1.1., the Data Protection Authority of Guernsey has issued interpretative guidance that clearly frames the application of the restrictions. It clarifies the scope of the different restrictions, including by means of examples, which helps to prevent them being misunderstood and applied in an overly broad manner. It also explains how the requirements of necessity and proportionality should be applied with respect to specific restrictions 1042 .

The processing of personal data for national security purposes in Guernsey is either subject to the provisions of the Data Protection Law described in Section 1.1., or to the provisions of LEO as described above. As explained above, the LEO applies to the processing of personal data by a competent authority, including for the purpose of safeguarding against or preventing threats to national security. The Data Protection Law applies if the processing of personal data for national security purposes is not conducted by a competent authority. While both the LEO 1043 and the Data Protection Law 1044 provide for an exemption from specified provisions for national security purposes, these provisions may only be restricted to the extent that their application would be likely to prejudice national security. In addition, the application of these exemptions has been clarified through detailed guidance. As recalled above for restrictions applicable in the field of criminal law enforcement, in particular, relying on the exemption must be necessary and proportionate in a democratic society. The exemption cannot be invoked in a blanket manner but can be relied upon only the basis of a case-by-case analysis and considering the actual consequences of applying the relevant provision. Controllers must be able to show that there is a real possibility of an adverse effect on national security if the relevant provision is applied. All decisions to rely on an exemption have to be documented and controllers must be prepared to share that documentation with the Data Protection Authority 1045 .

Moreover, according to paragraph 18(2) of Schedule 3 to the LEO and paragraph 18(2) of Schedule 8 to the Data Protection Law, a certificate signed by Her Majesty’s Procureur can confirm the legality of the reliance on the restriction 1046 . That means that the certificate serves as conclusive evidence of the fact that a restriction from one or more provision specified in the certificate is required for the purposes of national security. It is important to note that the national security certificate does not provide for an additional ground for restricting data protection rights and obligations for national security reasons. In other words, the controller or processor can only rely on a certificate when it has concluded that it is necessary to rely on the national security restriction which, as explained above, must be applied on a case-by-case basis 1047 . Even if a national security certificate applies to the matter in question, the Guernsey Data Protection Authority can investigate whether or not reliance on the national security restriction was justified in a specific case 1048 . Moreover, any person directly affected by the issuing of a certificate may appeal to the Royal Court. The Royal Court will review the decision to issue a certificate and decide whether there were reasonable grounds for issuing it. The Court can consider a wide range of issues, including necessity, proportionality and lawfulness, having regard to the impact on the rights of data subjects and balancing the need to safeguard national security. As a result, the Court can quash the certificate or determine that the certificate does not apply to specific personal data which is the subject of the appeal 1049 .

It follows from the above that limitations and conditions are in place under the applicable Guernsey legal provisions, as interpreted by the Guernsey Data Protection Authority, to ensure that these exemptions and restrictions remain within the boundaries of what is necessary and proportionate to protect criminal law enforcement and national security.

2.2.Access and use by Guernsey public authorities for criminal law enforcement purposes

In Guernsey, criminal law enforcement functions are carried out by the Island Police Force, which is headed by the Chief Officer. Guernsey law imposes a number of limitations on how the Police Force has access to and uses personal data for criminal law enforcement purposes, and it also provides oversight and redress mechanisms in this area. The conditions under which access to personal data can take place and the safeguards applicable to the use of these powers are assessed in the following sections.

2.2.1.Legal bases and applicable limitations/safeguards

Personal data transferred under the adequacy decision and processed by organisations in Guernsey may be obtained by Guernsey criminal law enforcement authorities by means of investigative measures under the Police Procedures and Criminal Evidence (Bailiwick of Guernsey) Law 2003 (PPCE), on the basis of the Regulation of Investigatory Powers (Bailiwick of Guernsey) Law 2003 (RIPL), or on the basis of anti-money laundering legislation 1050 .

The PPCE provides the Guernsey police with a legal basis for accessing personal data held by commercial operators through searches and seizures. The PPCE lays down detailed rules on the scope and application of these measures, aimed at ensuring that the interference with the rights of individuals will be limited to what is necessary for a specific criminal investigation and proportionate to the pursued purpose. Searches and seizures may only take place on the basis of a court-issued search warrant 1051 and the issuing of such warrant is subject to specific procedural and substantive requirements.

More specifically, a police officer may apply for a search warrant to the Bailiff 1052 or an appropriate judicial officer in Alderney or Sark 1053 . An application for a warrant must set out the grounds for the application, the premises to be searched and, as far as practicable, the articles or persons to be sought 1054 .

A search warrant may be issued only if the Bailiff/judicial officer is satisfied that there are reasonable grounds 1055 to believe that (1) a serious arrestable offence 1056 has been committed; (2) there is material which is likely to be of substantial value to the investigation of the offence; (3) the material is likely to be relevant evidence; and (4) it does not consist of or include items that are subject to legal professional privilege or otherwise excluded 1057 .

In terms of formal requirements, the warrant must specify the identity of the person who applied for it, the date of issuance, the enactment under which it is issued, the premise to be searched and, in as far as practicable, the articles or persons to be sought 1058 . The police officer carrying out the search must provide the occupier of the searched premise with the warrant, or in case the latter is not present, leave a copy of the warrant 1059 .

A police officer who is lawfully on any premises may seize anything at that premise if (s)he has reasonable ground for believing that it has been obtained in consequence of the commission of an offence and that it is necessary to seize it in order to prevent it being concealed, lost, damaged, altered or destroyed 1060 . Moreover, the police officer may require any information which is stored in electronic form and is accessible from the premises to be produced in a form in which it can be taken away and in which it is visible and legible, provided that (s)he has reasonable grounds for believing that it is evidence in relation to an offence which he is investigating or any other offence, or that it has been obtained in consequence of the commission of an offence, and that it is necessary to do so to prevent it being concealed, lost, damaged, tampered with or destroyed 1061 .

Specific limitations and safeguards also apply to the use of investigatory powers by public authorities in Guernsey. The use of investigatory powers to obtain information on communications is governed by the Regulation of Investigatory Powers (Bailiwick of Guernsey) Law 2003 (RIPL) 1062 . The RIPL regulates notably the interception of communications, acquisition of communications data (i.e., metadata stored by the service providers), the use of surveillance (such as covert investigations), and the investigation of electronic data protected by encryption (for example to obtain passwords allowing access to electronic devices) by a specified list of public authorities.

Section 1 RIPL introduces a general principle of confidentiality of communications by providing that it is an offence to intercept communications in the course of their transmission by means of a public postal service or a public or private telecommunication system without lawful authority 1063 . Sections 1(5) and 5 RIPL further clarify that to be lawful, any interception of communications must be authorised by an interception warrant 1064 issued by Her Majesty’s Procureur 1065 .

An interception warrant is issued on application by certain persons specifically listed in the law 1066 if the Procureur is satisfied that it is necessary for one of the purposes listed in Section 5(3) RIPL. These include the purpose of preventing or detecting serious crime 1067 . Importantly, the law explicitly requires that the conduct that would be authorised must be proportionate to what is sought to be achieved by that conduct 1068 . In considering the necessity and proportionality of the measure, the Procureur must take into account whether any alternative means could be reasonably used to obtain the information 1069 . In addition, Section 2.5 of the Code of Practice on Interception of Communications further clarifies that this requires a balance of the intrusiveness of the interference against the need for it in operational terms. The interception of communications will not be proportionate if it is excessive in the circumstances of the case. In addition, any interception should be carefully managed to meet the objective in question and must not be arbitrary or unfair 1070 .

In accordance with Section 7 RIPL, the warrant must either name or describe one person as the interception subject or specify a single set of premises as the premise in relation to which the interception is to take place. The warrant must also describe the communications for which interception is authorised, including the addresses, numbers, apparatus or other factors used to identify the communications 1071 . An interception warrant ceases to have effect after 3 months beginning with the day of the warrant's issue, unless it is renewed. A renewal may be authorised by Her Majesty’s Procureur only where (s)he is satisfied that the warrant remains necessary for the purposes described in Section 5(3) RIPL 1072 .

The RIPL also regulates the acquisition of communications data. The acquisition of communications data is not aimed at obtaining the content of a communication, but aimed at obtaining information such as traffic data, information about the use of a postal service or telecommunications service, and any other information held or obtained by a postal service/telecommunication service in relation to persons to whom the service is provided 1073 .

Persons designated with respect to a specific public authority 1074 may obtain communications data by giving notices to a postal or telecommunications operator, requiring the operator to obtain and/or disclose relevant data 1075 . A notice may only be issued if the designated person believes that it is necessary to obtain communications data for one of the specific purposes listed exhaustively in the law, including for the purpose of preventing or detecting crime or of preventing disorder 1076 .

Importantly, the notice or authorisation may only be granted if the designated person believes that obtaining the data in question is proportionate to what is sought to be achieved 1077 . According to the Code of Practice on Accessing Communications Data, this means that even if an action that interferes with a Convention right is directed at pursuing a legitimate aim, this will not justify the interference if the means used to achieve the aim are excessive in the circumstances 1078 . Any interference with a Convention right must be carefully designed to meet the objective in question and must not be arbitrary or unfair 1079 . Even taking all these considerations into account, in a specific case interference may still not be justified because the impact on the individual or group is too severe 1080 .

The notice must be issued in writing and specify the communications data to be obtained, the grounds on which it is necessary to obtain the data, the office, rank or position held by the person issuing the notice, and the manner in which any disclosure required by the notice is to be carried out 1081 . The effect of a notice is limited and unless it is renewed, it ceases to require that data be obtained one month after the date on which the notice is given 1082 . A notice may be renewed before the end of the period of one month under the same conditions as described above 1083 .

Finally, Part III RIPL covers the investigation of electronic data protected by encryption and allows for the issuing of notices requiring the disclosure of the key to encrypted information that is lawfully within the possession of the authorities (such as to obtain passwords allowing access to electronic devices). Such notices may be given where any protected information has come into possession of authorities 1084 and a person with the appropriate permission 1085 reasonably believes that a key to the protected information is in the possession of a person and that the imposition of a disclosure requirement in respect of the protected information is necessary for one of the purposes listed exhaustively in the law, notably in the interest of national security or for the purpose of preventing or detecting crime 1086 . In addition, the person imposing the disclosure requirement must believe on reasonable grounds that the measure is proportionate to what is sought to be achieved and that it is not reasonably practicable to obtain possession of the protected information in an intelligible form without the disclosure requirement 1087 . The notice must be given in writing or in a manner that produces a record 1088 and must describe the protected information to which the notice relates, must specify the office, rank or position held by the person giving it, must specify the time by which the notice is to be complied with and must set out the disclosure that is required by the notice and the form and manner in which it is to be made 1089 .

In Guernsey, criminal law enforcement authorities can also obtain personal data from business organisations in the context of investigations into whether a person has engaged in or benefited from criminal conduct, or into the whereabouts of the proceeds of criminal conduct.

These powers are governed by the Criminal Justice (Proceeds of Crime (Bailiwick of Guernsey) Law, 1999 (POCL). In addition, the Drug Trafficking (Bailiwick of Guernsey) Law, 2000 (DTL) introduces similar powers in connection with investigations into whether a person has carried on or has benefited from drug trafficking, the whereabouts of the proceeds of drug trafficking, or drug money laundering.

In accordance with these laws, the Bailiff can, on an application of a police officer, make orders to make material available, issue search warrants to obtain that material where a production order is not appropriate or not complied with, make customer information orders and account monitoring orders.

Each type of order is subject to strict formal and substantial requirements. In essence, the scope of such orders is always limited to one individual or one set of premises, they must contain specific mandatory information, and they may only be issued for limited purposes.

For instance, under the POCL, the Bailiff can make an order 1090 to make material available if there are reasonable grounds for suspecting that a specified person has engaged in or benefited from criminal conduct, there are reasonable grounds for suspecting that the material is likely to be of substantial value to the investigation, and does not consist of or include items subject to legal professional privilege or excluded material 1091 , and there are reasonable grounds for believing that it is in the public interest that the material should be produced or that access to it should be given 1092 .

The Bailiff can issue a search warrant 1093 under the POCL authorising a police officer to enter and search specific premises, provided that the same conditions as described above are met and an order to make material available has not been complied with, or it would not be appropriate to make such an order. Where a police officer has entered premises in the execution of a search warrant, he or she may seize and retain any material, other than items subject to legal professional privilege or excluded material, which is likely to be of value to the investigation. All applications for production orders and search warrants must have the consent of Her Majesty's Procureur.

A customer information order requires a financial services business 1094 , on a notice given by Her Majesty’s Procureur or a police officer, to provide any customer information 1095 that the institution has relating to a person specified in the application 1096 , in such manner, and by such time, as they require 1097 . An account monitoring order requires the financial services business specified in the application to provide account information specified in the order to an appropriate officer, for the period 1098 , in a manner, and by the time stated in the order 1099 . The conditions for issuing these orders are identical to the ones described above 1100 .

Under the Disclosure (Bailiwick of Guernsey) Law, 2007 (DL) obligations are placed on financial services businesses 1101 and other (non-financial services) businesses to disclose certain information 1102 to a prescribed police officer, where they know or suspect, or have reasonable grounds for knowing or suspecting, that another person is engaged in money laundering or that certain property is or is derived from the proceeds of criminal conduct 1103 .

Importantly, any disclosure of personal data obtained on the basis of the abovementioned provisions has to comply with the Data Protection Law, and the further processing by criminal law enforcement authorities of personal data obtained through such disclosures is subject to the provisions of the LEO.

2.2.2.Further use of the information collected

The further use of data collected by Guernsey criminal law enforcement authorities on one of the grounds referred to in Section 2.2, as well as the sharing of such data with a different authority for purposes other than the ones for which it was originally collected (so-called ‘onward sharing’), is subject to safeguards and limitations.

First, the processing of personal data by law enforcement authorities in Guernsey is governed by the provisions of the LEO as described in section 2.1. With respect to onward sharing, Article 6(2) of the LEO, like the Law Enforcement Directive, allows that personal data collected for a law enforcement purpose may be further processed (whether by the original controller or by another controller) for any other (secondary) law enforcement purpose if the data subject has given its consent to the further processing, if the further processing is for a historical or scientific purpose, or if the controller processes the data for the secondary purpose in the context of discharging a function imposed by law, and the processing is necessary and proportionate to that secondary purpose. In this case, all the safeguards provided by the LEO and the Data Protection Law (referred to in section 2.1) apply to the processing carried out by the receiving authority.

When law enforcement authorities in Guernsey intend to share personal data processed under the LEO with law enforcement authorities of a third country, specific requirements apply 1104 . These requirements are very similar to those set out by the Law Enforcement Directive. Transfers of personal data to “unauthorised jurisdictions” (essentially jurisdictions other than the EU Member States and any country or international organisation that the European Commission has found to ensure an adequate level of protection within the meaning of Article 36 of the LED) 1105 can only take place if they are necessary for a law enforcement purpose and based on appropriate safeguards 1106 . In the absence of appropriate safeguards, transfers to unauthorised jurisdictions are only possible in specific circumstances that are listed in the law in an exhaustive manner, e.g., for the protection of vital interests of individuals, to safeguard legitimate interests of the data subject, to prevent immediate and serious threats to the public or national security of any country, in individual cases for a law enforcement purpose, and in individual cases in the context of legal proceedings and legal advice relating to a law enforcement purpose 1107 .

Second, the different laws that allow for data collection by criminal law enforcement authorities in Guernsey impose specific limitations and safeguards as to the use and further dissemination of the information obtained in exercising the powers they grant.

As regards the powers of search and seizure under the PPCE, the police officer who seizes anything must, if requested by the occupier of premises, provide in reasonable time that person with a record of what he has seized. The police officer must also grant access to or supply a photograph or a copy of the seized or retained item at the request of the person who had custody of the item before it was seized 1108 . Importantly, anything that has been seized by the police may not be retained longer than necessary in the circumstances 1109 .

With respect to the interception of communications, Sections 12 and 13 RIPL set out the safeguards that need to be applied to material intercepted on the basis of a warrant. In particular, the Procureur must make arrangements to ensure that the dissemination of the intercepted material (i.e., the number of people who can access it, the extent to which the material is disclosed or copied, the number of copies 1110 , etc.) is limited to the minimum necessary for the purposes authorised by the warrant. Each copy made of any of the materials must be destroyed as soon as there are no longer any grounds for retaining it as necessary for any of the authorised purposes 1111 . Intercepted material may be shared with authorities of a country or territory outside of Guernsey only if the Procureur has made arrangements that ensure corresponding limitations, to the extent that the Procureur seems fit, and that prevent any disclosure that would not be lawful within Guernsey 1112 .

These safeguards are further specified in the Codes of Practice on the Interception of Communications. In particular, the Code of Practice requires all intercepted material to be handled in accordance with the arrangements made by the Procureur, the details of which must be made available to the Investigatory Powers Commissioner (see section 2.2.3 below) 1113 . All intercepting agencies are required to keep detailed records of interception warrants for which they have applied 1114 . The Code further requires intercepted material, as well as copies and summaries of the material, to be handled and stored securely to minimise the risk of loss or theft. In particular, it must be inaccessible to persons without the required level of security clearance, and this requirement for secure storage also applies to communications service providers. It also requires intercepted material to be securely destroyed as soon as it is no longer needed for any of the authorised purposes and retained material to be reviewed at appropriate intervals to confirm that its retention is justified and valid. 1115  

Concerning the acquisition of Communications Data, the Code of Practice on Accessing Communications Data provides that applications and notices for communications data must be retained by the relevant public authority until they have been audited by the Investigatory Powers Commissioner. The public authority should also keep a record of the dates on which an authorisation or notice is started and cancelled. The Code furthermore provides that communications data, as well as all copies, extracts and summaries of it, must be handled and stored securely 1116 .

For the investigation of electronic data protected by encryption, Section 51 RIPL sets out additional safeguards. In particular, it requires all persons involved in such investigations to make arrangements in order to ensure that any key disclosed in the context of the investigation is used only for obtaining access to information to which the investigation relates, that the use and retention of the key are proportionate to what is sought to be achieved, that the key is stored in a secure manner and that it is destroyed as soon as it is no longer needed 1117 .

Finally, under the DL any information obtained by Her Majesty's Procureur or a police officer under this law or any other enactment, or in connection with the carrying out any of their respective functions, may be disclosed to any other person only if the disclosure takes place for a specified purpose, notably for the prevention, detection, investigation or prosecution of criminal offences, whether in Guernsey or elsewhere, the carrying out the functions of the Guernsey Financial Services Commission or a body in another country or territory which carries out any similar function to the Commission, or for the carrying out of any functions of any intelligence service. Any such disclosure must not contravene the Data Protection Law or LEO 1118 .

2.2.3.Oversight

Different bodies carry out oversight of the activities of criminal law enforcement authorities.

First, the processing of personal data by competent authorities for criminal law enforcement purposes is subject to the oversight of the Data Protection Authority, whose independence is enshrined in law 1119 . The tasks and powers of the Data Protection Authority mirror those set out in Article 46 and 47 of the LED 1120 . To perform those tasks, the Data Protection Authority may investigate complaints, conduct inquiries into the processing of personal data by criminal law enforcement authorities 1121 , issue recommendations, make a determination of a violation of the Law and impose sanctions 1122 . These sanctions can include reprimands, warnings or corrective orders (e.g., requiring the authority to bring processing in compliance with the Law, rectify or erase data, cease the processing, etc.). In determining which order to impose, the Authority must have regard to different factors, such as the nature, gravity and duration of the violation, whether the violation was intentional or negligent, the degree of cooperation with the Authority to remedy the breach, any other action taken to mitigate any damage suffered by data subjects etc. 1123 .

According to information provided by the Data Protection Authority, since the entry into force of the LEO, the Authority has been involved in 17 complaints, two inquiries and 11 self-reported data breaches that concerned data processing carried out by law enforcement authorities. The Authority issued one enforcement notice against a law enforcement authority in a case that concerned the unlawful sharing of data. The notice required the authority to review safeguarding and associated data sharing procedures. The Data Protection Authority also regularly engaged with law enforcement authorities by providing guidance and advice.

Second, the use of investigatory powers under the RIPL is overseen by the Investigatory Powers Commissioner. Under Part IV of the RIPL, the Bailiff must appoint a judge of the Court of Appeal (of Guernsey) as the Investigatory Powers Commissioner. The Commissioner is responsible for reviewing the activities under the RIPL, including the issuing of interception warrants, notices for the collection of communications data and investigations of electronic data protected by encryption 1124 . All persons involved in the use of investigatory powers are required to disclose or provide to the Commissioner all documents and information that the Commissioner may require for the purpose of enabling him to carry out his functions 1125 . The Commissioner is in turn required to prepare an annual report on the use of investigatory powers for submission to the Bailiff of Guernsey 1126 . The Bailiff must lay before the Royal Court a copy of every annual report made by the Commissioner 1127 . The Commissioner’s report is also made public. If it appears to the Commissioner that there has been a contravention of the RIPL or insufficient safeguards have been put in place for intercepted communications, he/she must report that to the Bailiff 1128 .

As described in the Commissioner’s recent annual reports, the overwhelming majority of warrants requested and granted in Guernsey are in support of the activities of the Guernsey Police and the Guernsey Border Agency and for the purpose of preventing or detecting crime, notably drug trafficking and related anti-money laundering. In his annual reports, the Commissioner found that warrants had been issued for properly identified statutory purposes, in respect of the principles of necessity and proportionality and in compliance with procedural requirements. He also noted that the safeguards required by Sections 12 and 51 RIPL had been implemented in a satisfactory manner. In a limited number of instances, the Commissioner noted that he had made recommendations for further practical improvements 1129 .

2.2.4.Redress

As regards the processing of personal data by law enforcement authorities in Guernsey, redress mechanisms are available under the data protection legislation, under the Human Rights Act 2001 and under the RIPL. This series of mechanisms provide data subjects with effective administrative and judicial means of redress, enabling them in particular to ensure their rights, including the right to have access to their personal data, or to obtain the rectification or erasure of such data.

First, data subjects have the right to lodge a complaint with the Data Protection Authority concerning the processing of their personal data by criminal law enforcement authorities 1130 . The Authority has the power to determine breaches of the LEO and impose necessary sanctions. It also has the power, on request by a data subject or on its own initiative, to bring proceedings before a court in respect of any breach or anticipated breach of the Law. Following such complaint, the court can make any order, relief and remedy it considers just under the circumstances, including an award of compensation to any person who suffers damage as a result of the breach, an injunction or interim injunction to restrain any actual or anticipated breach of an operative provision, and a declaration that a breach was committed 1131 .

Second, individuals can obtain judicial redress against decisions of the Authority. This includes the possibility to challenge an action or inaction of the Authority before a court, e.g., decisions not to investigate a complaint, or decisions finding that there has been no violation of the Law. Moreover, an individual can appeal to court against any failure of the Authority to provide written notice that a complaint is either being investigated or not being investigated, within the time period specified in the Law, or if the complaint is being investigated, written notice of the progress and, where applicable, the outcome of the investigation within the time period specified in the Law 1132 . If a determination of the Authority is appealed, the court has the power to confirm or annul the determination of the Authority and remit the matter back to the Authority for reconsideration and make any other order it considers just 1133 .

Third, under Section 79 of the Data Protection Law, individuals can also obtain judicial redress against criminal law enforcement authorities directly before the courts. In particular, if there is a breach of the operative provisions of the Law and the breach causes damage to another person, it is actionable in court by that person 1134 .

Fourth, as far as any person considers that their rights, including rights to privacy and data protection, have been violated by public authorities, individuals can obtain redress before the Guernsey courts under the Human Rights Law 2001. Under Section 6(1) of the Human Rights Law, it is unlawful for a public authority to act in a way which is incompatible with rights provided in the law 1135 . A person who claims that a public authority has acted (or proposes to act) in a way which is unlawful under Section 6(1) can bring proceedings against the authority under this Law in the appropriate court or tribunal, when he or she is (or would be) a victim of the unlawful act 1136 . If the court finds any act of a public authority to be unlawful, it can grant such relief or remedy, or make such order, within its powers as it considers just and appropriate 1137 .

Finally, any individual may obtain judicial redress before the European Court of Human Rights against the unlawful collection of his/her data by criminal law enforcement authorities, provided that all available domestic remedies have been exhausted.

For violations of the RIPL, individuals can obtain redress before the Interception of Communications Tribunal. This redress avenue is described in section 2.3.4 below.

2.3.Access and use by Guernsey public authorities for national security purposes

In Guernsey, access to information transferred under the adequacy decision for purposes of national security can take place in the form of the interception of communications, the acquisition of communications data and the investigation of data protected by encryption on the basis of the RIPL 1138 .

2.3.1.Legal bases and applicable limitations/safeguards

The interception of communications, acquisition of communications data and investigation of data protected by encryption on the basis of the RIPL may not only take place in the context of criminal investigations, but also when necessary in the interests of national security or to safeguard the economic well-being of the Bailiwick 1139 . The use of these powers for those purposes is subject to the same substantive and procedural limitations and safeguards as described in section 2.2.1 in the context of criminal law enforcement, notably the need for independent authorisation, requirements of necessity and proportionality and limitation to specific communications or information 1140 . 

Moreover, although the notion of “economic well-being” may appear broad, Section 5 RIPL sets out that an interception warrant can only be considered necessary for the purpose of safeguarding the economic well-being of Guernsey if the purpose is to obtain information relating to the acts or intentions of persons outside Guernsey 1141 . In addition, the Code of Practice on the Interception of Communications further specifies that Her Majesty's Procureur can only issue an interception warrant for the purpose of safeguarding the economic well-being of Guernsey if he considers, on the basis of the facts of each case, that there is a direct link between the economic well-being of the Bailiwick and national security 1142 . Similarly, the Code of Practice on Accessing Communications Data sets out that communications data can only be obtained for the purpose of the economic well-being of Guernsey if, on the basis of the facts of each case, the economic well-being is related to national security 1143 .

2.3.2.Further use of the information collected

The further use of personal data obtained in the interests of national security is governed either by the provisions of the LEO or of the Data Protection Law, as described in section 2.1 1144 . Section 6(2) of the LEO allows that personal data collected for a law enforcement purpose (within the meaning of the LEO) may be further processed for any other (secondary) law enforcement purpose only if the data subject has given its consent to the further processing, if the further processing is for a historical or scientific purpose, or if the controller processes the data for the secondary purpose in the context of discharging a function imposed by law, and the processing is necessary and proportionate to that secondary purpose. Pursuant to Sections 5and 6(1)(b) of the LEO, data processing must be lawful and fair, and data must not be further processed in a manner that is incompatible with the purpose for which it was collected.

Moreover, specific requirements apply when personal data is shared with authorities outside of Guernsey 1145 . As described in more detail in sections 1.1, 2.1 and 2.2.2, these requirements are very similar to those set out by the EU’s data protection framework. Transfers of personal data to “unauthorised jurisdictions” (essentially jurisdictions other than the EU Member States and any country or international organisation that the European Commission has found to ensure an adequate level of protection) 1146 can only take place if they are based on appropriate safeguards 1147 . In the absence of appropriate safeguards, transfers to unauthorised jurisdictions are only possible in specific circumstances that are listed in the law in an exhaustive manner 1148 .

In addition, the RIPL, complemented by the relevant Codes of Practice, sets out specific safeguards for the further use and sharing of data obtained on the basis of its provisions. These involve particular arrangements to ensure that the dissemination of material obtained is limited to the minimum necessary for the purposes pursued with the authorisation. Material must be handled and stored securely to minimise the risk of loss or theft and must be destroyed as soon as there are no longer any grounds for retaining it as necessary for any of the authorised purposes. Retained material must be reviewed at appropriate intervals to confirm that its retention is justified and valid. All agencies exercising powers on the basis of the RIPL are required to keep detailed records of warrants or authorisations for which they have applied 1149 . Intercepted material may be shared with authorities of a country or territory outside of Guernsey only if arrangements are in place to ensure corresponding limitations and to prevent any disclosure that would not be lawful within Guernsey 1150 .

2.3.3.Oversight

Government access for national security purposes in Guernsey is overseen by different bodies. The Data Protection Authority oversees the processing of personal data in light of the LEO and the Data Protection Law, while specific oversight on the use of the investigatory powers under the RIPL is provided by the Investigatory Powers Commissioner.

The processing of personal data carried out for national security purposes is governed by the provisions of both the LEO and the Data Protection Law. The general functions and powers of the Guernsey Data Protection Authority are laid down in Section 61 et seq. of the Data Protection Law in conjunction with Schedule 7 to the Data Protection Law 1151 . The tasks include, but are not limited to, monitoring and enforcement, promoting public awareness, advising the Guernsey parliament and government and other institutions on legislative and administrative measures, promote the awareness of controllers and processors of their obligations, provide information to a data subject concerning the exercise of the data subject’s rights, handle complaints, conduct investigations, issue guidance etc. The Authority has the powers to notify controllers of an alleged infringement and to issue warnings that a processing is likely to infringe the rules, issue reprimands, ban processing or order the controller to take certain actions 1152 . While the Data Protection Law 1153 allows exemptions from certain provisions, including from those that concern the Authority, for national security purposes, these provisions may only be restricted on a case-by-case basis to the extent that their application would be likely to prejudice national security and if necessary and proportionate (as explained in section 2.1).

Furthermore, as described in section 2.2.3 above, the Investigatory Powers Commissioner oversees the application of the RIPL i.e., the interception of communications, the acquisition of communications data and the investigation of data protected by encryption. In his recent annual reports, the Commissioner noted that the overwhelming majority of warrants in Guernsey were requested and granted in support of the activities of the Guernsey Police and the Guernsey Border Agency and for the purpose of preventing or detecting crime 1154 .

2.3.4.Redress

First, an individual who believes that his or her rights under the LEO have been (or are about to be) breached can make a complaint to the Data Protection Authority, which exercises oversight over processing by competent authorities (as described in section 2.3.3 above). Redress mechanisms under the LEO and the Data Protection Law include breach determinations or sanctions issued by the Authority, and civil proceedings before a court, in which a court can make any order, relief and remedy it considers just under the circumstances, including an award of compensation to any person who suffers damage as a result of the breach, an injunction or interim injunction to restrain any actual or anticipated breach of an operative provision, and a declaration that a breach was committed (as described in section 2.2.4 above).

Individuals can also obtain redress for violations of the RIPL before an independent Tribunal established by Section 56 RIPL 1155 . 

The Tribunal is the appropriate forum for any complaint by a person, including any individual in the EU, who believesthat conduct under the RIPL has taken place in relation to him, his property or his communications 1156 , including conduct by or on behalf of any of the UK intelligence services, conduct in connection with the interception of communications in the course of their transmission, conduct in connection with the collection of communications data, or conduct in connection with the investigation of data protected by encryption 1157 . In addition, the complainant is required to believe that the conduct has taken place either in “challengeable circumstances” 1158  or has been carried out by or on behalf of the intelligence services 1159 .

When considering a complaint, it is the duty of the Tribunal to investigate whether surveillance has taken place in relation to the complainant, as well as the authority for such surveillance, if any 1160 . The Tribunal determines whether any errors of law, errors of fact or procedural errors have been committed, or whether there has been any other irregularity, such as a lack of proportionality 1161 . All persons involved in the exercise of powers under the RIPL are required to provide to the Tribunal all such documents and information that the Tribunal may need to carry out its functions 1162 . The Tribunal also has the power to require the Investigatory Powers Commissioner to provide the Tribunal with all such assistance (including the Commissioner's opinion as to any issue to be determined by the Tribunal) as the Tribunal think fit 1163 . The Commissioner must be kept informed about the proceedings and any determination, award, order, or other decision made in relation to those proceedings 1164 .

If the Tribunal makes a determination in favour of the complainant, the Tribunal must provide the complainant with a summary of that determination including any findings of fact. The tribunal must also give notice to the complainant if no determination has been made in his/her favour 1165 . The Tribunal has the power to issue interim orders and to provide any such award of compensation or other order as it thinks fit. This may include an order quashing or cancelling any warrant or authorisation and an order requiring the destruction of any records of information obtained in exercise of any power conferred by a warrant or authorisation, or otherwise held by any public authority in relation to any person 1166 . According to Section 58(8) RIPL, a determination, award, order, or other decision of the Tribunal, is not subject to appeal 1167 .

Finally, as also described in section 2.2.4 above, as far as individuals consider that their rights, including rights to privacy and data protection, have been violated by public authorities, they can obtain redress before the Guernsey courts under the Human Rights Law 2001. In addition, any individual may obtain judicial redress before the European Court of Human Rights against the unlawful collection of his/her data for national security purposes, provided that all available domestic remedies have been exhausted.

VI. ISLE OF MAN

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of the Isle of Man

On 28 April 2004 the Commission adopted a decision in which the Isle of Man was considered as providing an adequate level of protection for personal data transferred from the EU 1168 . The Article 29 Working Party had adopted a positive opinion on the level of protection of personal data in the Isle of Man on 21 November 2003 1169 . At the time, the legal framework for the protection of personal data in the Isle of Man was set out in the Data Protection Act 2002, which entered into force on 1 April 2003. The Data Protection Act 2002 was closely aligned with the UK’s Data Protection Act 1998 that had been enacted in the UK to give effect to the provisions of Directive 95/46/EC (Data Protection Directive) 1170 .

Since the adoption of the adequacy decision, the Isle of Man has further modernised and significantly strengthened its data protection framework through a comprehensive reform. The Data Protection Act 2002 was replaced with new legislation that closely aligns the Isle of Man regime with the EU’s current data protection legislation. In particular, the Isle of Man has incorporated most of the provisions of Regulation (EU) 2016/679 (GDPR) 1171  into its own legal order while making only minor adjustments on specific aspects, in particular to adapt the framework to the local context. The recitals of the GDPR have also been maintained in the new data protection framework to assist with contextualising and interpreting relevant provisions.

The Isle of Man main data protection framework now consists of:

(1)the Data Protection Act 2018, which enables the Isle of Man to apply EU instruments relating to data protection (including, but not limited to the GDPR, Directive (EU) 2016/680 (Law Enforcement Directive) 1172 , Directive (EU) 2016/681 (PNR Directive) 1173 and Directive (EU) 2016/1148 (NIS Directive 1174 ) as part of the law of the Isle of Man 1175 ;

(2)the Data Protection (Application of GDPR) Order 2018 1176 and Data Protection (Application of LED) Order 2018 1177 (Applied GDPR and Applied LED, respectively) 1178 , which stipulate that the GDPR and the Law Enforcement Directive apply as part of the law of the Isle of Man, subject to the modifications laid down in those orders; and finally

(3)the GDPR and LED Implementing Regulations 2018 (Implementing Regulations), which provide supplementing provisions for the implementation of both of the above-mentioned orders 1179 .

More specifically, the Applied GDPR retains the broad scope of application of the GDPR 1180 . Like the GDPR, the Applied GDPR covers the processing of personal data wholly or partly by automated means, or other processing, if the personal data forms part of a filing system 1181 . Moreover, the GDPR’s definitions of ‘personal data,’ ‘processing’ 1182 , ‘pseudonymisation’ ‘controller’ and ‘processor’ have been retained without modifications in the Applied GDPR. Concerning its territorial scope, the Applied GDPR covers the processing of personal data by controllers or processors established in the Isle of Man 1183 , under identical conditions to those set out in Article 3 of the GDPR. It has also been extended to cover the processing of personal data by controllers or processors not established in the Isle of Man, subject to the same conditions that are set out in Article 3(2) of the GDPR; thereby strengthening the effectiveness of the Isle of Man data protection regime 1184 .

The Data Protection Act 2002 already contained the data protection principles that were set out in the Data Protection Directive. The Applied GDPR retains those principles – namely, the principles of lawfulness and fairness 1185 ; transparency 1186 ; purpose limitation 1187 ; data minimisation, accuracy and storage limitation 1188 ; security, integrity and confidentiality 1189 and accountability 1190 . At the same time, it further strengthens several principles by introducing concrete obligations to implement them. In particular, the Applied GDPR introduces the obligation to notify data breaches subject to the same conditions as in the GDPR 1191 , and reinforces accountability requirements by establishing obligations such as record keeping, data protection by design and default, data protection impact assessments and data protection officers 1192 .

The Applied GDPR also guarantees the same data subject rights as enshrined in the GDPR, i.e., the rights of information, access, rectification, erasure, restriction, objection, and portability 1193 . The provisions establishing these rights have been retained without changes. Concerning the specific rights to object to direct marketing 1194 , and not to be subject to automated individual decision-making 1195 , Isle of Man law now also fully mirrors the GDPR.

As is the case in the GDPR, the data subject rights in the Isle of Man are subject to certain restrictions 1196 intended to allow the balancing of the data protection interests of individuals with objectives of general public interest and with the fundamental rights and freedoms of others.

Some of those allow the restriction of individual rights based on the nature of the personal data being processed. They apply automatically whenever one of the listed categories of personal data is being processed. These categories are listed in an exhaustive manner and cover a narrowly construed set of situations, such as data processing for the purpose of assessing a person’s suitability for certain specific offices (e.g., judicial appointments or appointment made by the Crown) 1197 , the processing of personal data for purposes of providing confidential references 1198 or where personal data consists in marks or other information processed for the purpose of determining the result of an exam 1199 . These categories are not only (very) limited in scope, but also do not typically cover situations where personal data is transferred to the Isle of Man from the EU.

The majority of the restrictions have to be based either on grounds of prejudice or can only be invoked to the extent that the application of a certain right would interfere with a protected interest at stake, i.e., a public interest or the rights and freedoms of others. Restrictions subject to the prejudice test can be invoked only when (and to the extent that) the application of the provisions “would be likely to prejudice” the legitimate aim pursued. For example, controllers can restrict data subject rights to the extent that their application would be likely to prejudice the prevention or detection of crime or the assessment or collection of any tax or duty 1200 , or would be likely to prejudice the combat effectiveness of any of the armed forces of the Crown 1201 .

The Isle of Man Information Commissioner, as well as the Attorney General’s Chambers together with the Cabinet Office, have issued interpretative guidance that clearly frames the application of the exemptions. It clarifies the scope of the different exemptions, including by means of concrete examples, which should help preventing that they are misunderstood and applied in an overly broad manner. It also explains how the requirements of necessity and proportionality should be applied with respect, in general, to the “likely to prejudice” or “to the extent” standard, and for specific exemptions 1202 . Finally, and importantly, the guidance explicitly states that it should be read in conjunction with the Guidelines 10/2020 on restrictions under Article 23 of the GDPR that have been issued by the EDPB 1203 .

The current Isle of Man regime for special categories of personal data is similar to that of the GDPR. The Applied GDPR recognises as special categories of data all data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic and biometric data, and data concerning a natural person’s sex life or sexual orientation. The processing of such data is prohibited unless specific exceptions apply, which correspond to those in the GDPR 1204 . Moreover, the processing of special categories of data is subject to additional requirements, in particular the obligation to appoint a data protection officer in case of large-scale processing 1205 and to conduct a data protection impact assessment 1206 . Finally, the Applied GDPR retains without modification the GDPR’s prohibition on automated individual decision-making on the basis of special categories of data 1207 .

In the field of international transfers of personal data, the legal framework of the Isle of Man is closely aligned with Chapter V of the GDPR and therefore ensures continuity of protection for the onward transfer of personal data that was originally received from the EU. In particular, the Applied GDPR incorporates Chapter V of the GDPR into the Isle of Man legal framework with certain adaptations to the local context (e.g., by deleting references to binding corporate rules and to procedures before the EDPB) 1208 and is complemented by the Implementing Regulations, which further specify under which conditions international data transfers can take place. Transfers of personal data to third countries or international organisations are prohibited except if the country or international organisation benefits from an adequacy decision, if appropriate safeguards that meet the requirements of Article 46 of the GDPR are in place, or if one of the derogations set out in the Implementing Regulations apply 1209 .

With respect to adequacy, the Applied GDPR and Implementing Regulations refer to decisions adopted by the European Commission 1210 . As a result, controllers and processors in the Isle of Man can transfer personal data freely, without having to put in place specific safeguards, to all countries and territories for which the Commission has adopted an adequacy finding. Appropriate safeguards may be provided by a legally binding and enforceable instrument between public authorities or bodies, standard contractual clauses, an approved code of conduct or an approved certification scheme 1211 . The Information Commissioner has so far not issued specific standard contractual clauses but has instead directed controllers and processors to use the standard contractual clauses adopted by the European Commission 1212 . Moreover, subject to prior authorisation by the Information Commissioner, an international transfer can be carried out on the basis of ad hoc contractual clauses or administrative arrangements between public authorities 1213 . Finally, in specific situations (i.e., as an exception to the general rule that an adequacy decision or appropriate safeguards should be in place), data transfers may take place on the basis of one of the grounds listed in the Implementing Regulations 1214 . These ‘derogations/exceptions’ correspond to those of Article 49 GDPR, while providing for certain specifications as regards the situations in which they may apply 1215 .

1.2.Oversight, enforcement and redress

Since the adoption of the adequacy decision, oversight and enforcement of compliance with the Isle of Man data protection law have been strengthened, notably by reinforcing the supervisory authority’s independence and by extending its powers.

Oversight and enforcement of the Applied GDPR and the Implementing Regulations are now carried out by the Information Commissioner, whose appointment and powers are governed by the Freedom of Information Act 2015. The Commissioner is explicitly mandated to perform his or her functions and powers independently and, in doing so, not to be subject to the direction of Tynwald (the Isle of Man parliament), its Branches or the Council of Ministers 1216 . The Commissioner is appointed by the Council of Ministers for a term of up to 5 years. Only candidates with appropriate qualifications, skills and competence can be appointed 1217 , and the candidate has to be approved by Tynwald 1218 . The Information Commissioner may be removed before the end of his or her term only for very specific reasons set out in law 1219 , and the Freedom of Information Act covers cases where the office may become vacant 1220 .

The functions and powers of the Information Commissioner have been aligned with those of supervisory authorities under the GDPR. In particular, the Information Commissioner may issue enforcement and penalty notices for violations of provisions of the Applied GDPR and Implementing Regulations on data protection principles, lawfulness of processing, transparency and individual rights, obligations for controllers and processors and the rules on international transfers, or for non-compliance with an information notice, an assessment notice or an enforcement notice 1221 . The Information Commissioner also has the power to bring proceedings before a court in respect of a failure to comply with its notices and order compliance 1222 . Certain violations of data protection legislation may also constitute offences and lead to criminal sanctions such as fines, imprisonment, or both 1223 . This would for example be the case when information is altered or erased with the intention of preventing disclosure of information that any person has requested to access, or with the intention of preventing the controller or processor from supplying the information requested by the Information Commissioner 1224 .

Avenues for redress for violations of the Applied GDPR and the Implementing Regulations are available to data subjects under the same conditions as those provided by the GDPR 1225 . In essence, data subjects have a right to an effective judicial remedy both before courts and before the Information Commissioner. The Data Protection Tribunal is the competent forum to hear appeals against decisions from the Information Commissioner 1226 . Obtaining judicial redress directly before the Data Protection Tribunal against controllers and processors 1227 is also possible, under the cause of action of breach of statutory duty (i.e., for violations of a data subjects’ right).

Taking into account of the size of the territory for which it has jurisdiction, the office of the Information Commissioner has been active in exercising its different functions. For example, in 2021, the Information Commissioner received 112 personal data breach reports and 44 complaints, engaged in four investigations and issued three information notices, five reprimands, and three enforcement notices. In 2022, it handled 225 breach reports and 32 complaints, carried out seven investigations and issued two information notices, three warnings, one reprimand, three enforcement notices and one penalty notice 1228 .

Moreover, the Information Commissioner has issued several guidance documents for organisations, for instance concerning specific categories of controllers (such as churches, religious organisations or small businesses), specific processing activities (e.g., in the context of cloud computing services), or on specific obligations (e.g., on carrying out data protection impact assessments) 1229 . To facilitate the exercise of rights by individuals, the Information Commissioner has also developed dedicated guidance and template letters (e.g., for submitting access requests) 1230 , as well as an online tool for submitting complaints to the Information Commissioner 1231 .

2.ACCESS TO AND USE OF PERSONAL DATA TRANSFERRED FROM THE EUROPEAN UNION BY PUBLIC AUTHORITIES IN THE ISLE OF MAN

2.1.General legal framework

The limitations and safeguards that apply to the collection and subsequent use of personal data for purposes of criminal law enforcement and national security follow from the Isle of Man’s international obligations in the area of fundamental rights and personal data protection, from the rules that apply to the processing of personal data by the public sector, as well as from specific laws regulating access to data by Isle of Man public authorities.

First, the right to the protection of personal data forms part of the right to respect for private and family life enshrined in the Human Rights Act 2001, which incorporates into Isle of Man law the rights stemming from the European Convention of Human Rights 1232 . According to the Human Rights Act 2001, all actions of public authorities must be in compliance with the Convention 1233 , and all primary and subordinate legislation shall be read and given effect in a way that is compatible with the Convention’s rights 1234 . Article 8 of the Convention provides that any interference with privacy must be in accordance with the law, in the interests of one of the aims set out in Article 8(2) and proportionate in light of that aim. Article 8 also requires that the interference is “foreseeable”, i.e., have a clear, accessible basis in law, and that the law contains appropriate safeguards to prevent abuse.

In addition, in its case law 1235 , the European Court of Human Rights has specified that any interference with the right to privacy and data protection should be subject to an effective, independent and impartial oversight system that must be provided for either by a judge or by another independent body 1236 (e.g., an administrative authority or a parliamentary body). Moreover, individuals must be provided with an effective remedy, and the European Court of Human Rights has clarified that the remedy must be offered by an independent and impartial body which has adopted its own rules of procedure, consisting of members that must hold or have held high judicial office or be experienced lawyers, and that there must be no evidential burden to be overcome in order to lodge an application with it. In undertaking its examination of complaints by individuals, the independent and impartial body should have access to all relevant information, including closed materials. Finally, it should have the powers to remedy non-compliance 1237 .

Second, the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (Convention 108) applies to the Isle of Man by virtue of the United Kingdom’s membership to this convention 1238 . Article 9 of Convention 108 provides that derogations from the general data protection principles (Article 5 Quality of data), the rules governing special categories of data (Article 6 Special categories of data) and data subject rights (Article 8 Additional safeguards to the data subject) are only permissible when such derogation is provided for by the law of the Party and constitutes a necessary measure in a democratic society in the interests of protecting State security, public safety, the monetary interests of the State or the suppression of criminal offences, or for protecting the data subject or the rights and freedoms of others.

Therefore, through adherence to the European Convention of Human Rights and submission to the jurisdiction of the European Court of Human Rights, the Isle of Man is subject to a number of obligations, enshrined in international law, that frame its system of government access on the basis of principles, safeguards and individual rights similar to those guaranteed under EU law and applicable to the Member States.

Third, the processing of personal data by criminal law enforcement authorities in the Isle of Man is subject to the rules of the Applied LED, which essentially replicates the Law Enforcement Directive. The material scope of the Applied LED is identical to the one of the Law Enforcement Directive. It applies to the processing of personal data by competent authorities 1239 for the purposes of the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security 1240 . Furthermore, the data protection principles of lawfulness and fairness, purpose limitation, data minimisation, accuracy, storage limitation and security are retained in the Applied LED in the exact same terms as in the LED 1241 . In essence, the processing of personal data by a competent authority is only permitted when necessary for a law enforcement purpose, and only in accordance with a law specifying at least the objectives of the processing, the personal data to be processed, and the purposes of the processing 1242 . In addition, the Applied LED imposes specific transparency obligations 1243 and recognises the same data subject rights as the Law Enforcement Directive without any modifications 1244 . In particular, data subjects enjoy a right to access 1245 , correction 1246 and deletion 1247 and have the right not to be subject to automated decision-making 1248 . Competent authorities are also required to implement data protection by design and default 1249 , to keep records of processing activities 1250 , and, for certain processing operations, to carry out data protection impact assessments and to pre-consult the Information Commissioner 1251 . Moreover, they are required to put in place appropriate measures to ensure security of processing 1252 and are subject to specific obligations in case of a data breach, including notification of such breaches to the Information Commissioner and data subjects 1253 . Like in the Law Enforcement Directive, there is also a requirement for a controller (unless it is a court or other judicial authority acting in a judicial capacity) to designate a data protection officer who assists the controller in complying with its obligations as well as monitoring that compliance 1254 . Finally, the Applied LED contains specific provisions on international transfers of personal data to a third country or an international organisation 1255 . The provisions substantially echo those in the Law Enforcement Directive. Essentially, transfers are prohibited unless the receiving country benefits from an adequacy decision by the European Commission, or if appropriate safeguards are in place 1256 . Transfers are still possible in the absence of an adequacy decision or appropriate safeguards, but only in specific circumstances listed in an exhaustive manner and identical to those set forth in the LED 1257 .

Under identical conditions as under the Law Enforcement Directive, the Implementing Regulations specify that certain specific provisions of the Applied LED 1258 may be restricted to the extent that the application of those provisions would be likely to prejudice any of the matters mentioned in Article 1(1) of the Applied LED (i.e., the prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security) 1259 .

The Isle of Man Information Commissioner and the Attorney General’s Chambers and Cabinet Office have clarified through guidance how the law enforcement exemption functions in practice 1260 . Importantly, the guidance stresses that the exemptions must not be applied in a blanket manner, but “on a case-by-case basis”, i.e., where necessary and proportionate for law enforcement purposes in light of all the circumstances of the specific case. Finally, in the absence of specific judicial authority in the Isle of Man, the guidance refers to the case law of the High Court of England and Wales where it has been held that the term “likely” connotes a degree of probability where there is a very significant and weighty chance of prejudice to the identified public interests 1261 .

The processing of personal data for national security purposes in the Isle of Man is subject to the provisions of the Applied GDPR and the Implementing Regulations that are described in section 1 above 1262 . At the same time, Regulation 22 of the Implementing Regulations provides for an exemption from specified provisions of the Applied GDPR and the Implementing Regulations 1263 when such exemption is required for the purpose of safeguarding national security or for defence purposes. The application of this exemption has been clarified through detailed guidance by the Isle of Man Information Commissioner and the Attorney General’s Chambers and Cabinet Office 1264 . In particular, relying on the exemption must be necessary and proportionate in a democratic society. The exemption cannot be invoked in a blanket manner but can be relied upon only the basis of a case-by-case analysis and considering the actual consequences of applying the relevant provision of the Applied GDPR. Controllers must be able to show that there is a real possibility of an adverse effect on national security if the relevant provision is applied. All decisions to rely on an exemption have to be documented and controllers must be prepared to share that documentation with the Information Commissioner 1265 .

Moreover, according to Regulation 23 of the Implementing Regulations, controllers may apply for a certificate signed by the Chief Minister which certifies that the restriction of the specific provisions listed under Regulation 22 is required to the protection of national security. It is important to note that the national security certificates do not provide for an additional ground for restricting data protection rights for national security reasons. In other words, the controller or processor can only rely on a certificate when it has concluded it is necessary to rely on the national security exemption which, as explained above, must be applied on a case-by-case basis 1266 . Even if a national security certificate applies to the matter in question, the Isle of Man Information Commissioner can investigate whether or not reliance on the national security exemption was justified in a specific case 1267 .

Any person directly affected by the issuing of the certificate may appeal to the Isle of Man Data Protection Tribunal 1268 against the certificate 1269 or, where the certificate identifies data by means of a general description, challenge the application of the certificate to specific data 1270 . The tribunal will review the decision to issue a certificate and decide whether there were reasonable grounds for issuing the certificate. It can consider a wide range of issues, including necessity, proportionality and lawfulness, having regard to the impact on the rights of data subjects and balancing the need to safeguard national security. As a result, the tribunal can quash the certificate or determine that the certificate does not apply to specific personal data which is the subject of the appeal 1271 .

It follows from the above that limitations and conditions are in place under the applicable Isle of Man legal provisions, as interpreted by the Isle of Man government and the Isle of Man Information Commissioner, to ensure that these exemptions and restrictions remain within the boundaries of what is necessary and proportionate to protect criminal law enforcement and national security.

2.2.Access and use by Isle of Man public authorities for criminal law enforcement purposes

In the Isle of Man, criminal law enforcement functions are carried out by the police force, officially called the Isle of Man Constabulary, which is headed by the Chief Constable. In the specific case of financial crime, the responsible authority is the Financial Intelligence Unit (FIU) 1272 . The law of the Isle of Man imposes a number of limitations on the access to and use of personal data for criminal law enforcement purposes, and it provides oversight and redress mechanisms in this area. The conditions under which access to personal data can take place and the safeguards applicable to the use of these powers are assessed in the following sections.

2.2.1.Legal bases and applicable limitations/safeguards

Personal data transferred under the adequacy decision and processed by organisations in the Isle of Man may be obtained by Isle of Man criminal law enforcement authorities by means of investigative measures under the Police Powers and Procedures Act 1998, on the basis of the Interception of Communications Act 1988, or on the basis of anti-money laundering and anti-terrorist (financing) legislation, including through (voluntary) disclosures.

The Police Powers and Procedures Act 1998 (PPP Act) provides the Isle of Man police with a legal basis for accessing personal data held by commercial operators through searches and seizures. The PPA Act lays down detailed rules on the scope and application of these measures, aimed at ensuring that the interference with the rights of individuals will be limited to what is necessary for a specific criminal investigation and proportionate to the pursued purpose. Searches and seizures may only take place on the basis of a court-issued search warrant 1273 and the issuing of such warrant is subject to specific procedural and substantive requirements.

More specifically, a police officer must apply for a search warrant to a Justice of the Peace 1274 . An application for a warrant must set out the grounds for the application, the legal basis for issuing the warrant and, as far as practicable, the persons and premises 1275 to be searched 1276 . In case the application would request authorisation for more than one search entry, it should also indicate the maximum number of entries desired 1277 .

A search warrant may be issued only if the Justice of the Peace is satisfied that: (1) a serious offence 1278 has been committed and there is material on the premises to be searched which is likely to be of substantial value to the investigation of the offence, or a person has in his possession any property in respect of which an offence has been committed; (2) the material or the property is likely to be relevant evidence; and (3) it does not consist of excluded material or items subject to legal privilege 1279 .

In terms of formal requirements, the warrant must specify the name of the person who applies for it, the date of issuance, the enactment under which it is issued, and the particular premises to be searched, or (in the case of an all-premises warrant) the person who is in occupation or control of the premises to be searched, together with any premises under that person’s occupation or control that can be specified and that are to be searched. The warrant must also identify, as far as it is practicable, the articles or persons to be sought 1280 .

According to Section 22 PPP Act, a police officer who is lawfully on any premises may furthermore seize anything at those premises, including any information which is stored in electronic form 1281 , if he has reasonable grounds for believing 1282 that it has been obtained in consequence of the commission of an offence or that the item is evidence in relation to an offence which he is investigating or any other offence, and that it is necessary to seize it in order to prevent it being concealed, lost, damaged, altered or destroyed 1283 .

Importantly, the Isle of Man Department of Home Affairs has adopted a code of practice for searches and the seizure and treatment of property by police officers which sets out additional limitations and safeguards 1284 . The Code notably stresses that “[t]he right to privacy and respect for personal property are key principles of the Human Rights Act 2001. Powers of entry, search and seizure should be fully and clearly justified before use because they may significantly interfere with the occupier’s privacy. Officers should consider if the necessary objectives can be met by less intrusive means. Powers to search and seize must be used fairly, responsibly, with respect for people who occupy premises being searched or are in charge of property being seized and without unlawful discrimination” 1285 . The Code also specifies in more detail the requirements for making an application for a search warrant, in particular the need to check the accuracy of information on which an application for a search warrant is based 1286 .

Specific limitations and safeguards also apply to the interception of communication in the course of transmission by post, by means of a courier service or a public telecommunication system 1287 . The interception of communications is regulated in the Interception of Communications Act 1988 (IOCA). Section 1 IOCA introduces a general principle of confidentiality of communications by providing that it is an offence to intentionally intercept communications. Section 1 further clarifies that to be lawful, any interception of communications must be authorised by a warrant issued by the Chief Minister under section 2 IOCA 1288 . The Chief Minister can only issue a warrant if s/he considers that the warrant is necessary in the interests of national security or for the purpose of preventing or detecting serious crime 1289 . Importantly, in considering the necessity of a warrant, the Chief Minister must assess whether the information sought to be obtained could reasonably be acquired by other, less intrusive means 1290 . Before issuing or renewing a warrant the Chief Minister is required to consult the Attorney General, i.e., obtain legal advice from the Government’s principal legal adviser on whether the conditions for issuing a warrant are fulfilled.

As the further conditions, limitations and safeguards that apply to the issuing of interception warrants are identical for interception carried out for law enforcement and for national security purposes, they are addressed in detail in the section on access and use of personal data by Isle of Man public authorities for national security purposes.

In the Isle of Man, criminal law enforcement authorities can also obtain personal data from business organisations in the context of financial and asset recovery investigations. These powers are governed by the Proceeds of Crime Act 2008 (POCA) which covers confiscation investigations 1291 , money laundering investigations 1292 , civil recovery investigations 1293 , and detained cash investigations 1294 . During such investigations, police officers 1295 may request a Deemster 1296 to issue several types of orders: production orders 1297 , search and seizure warrants 1298 , disclosure orders 1299 , customer information orders 1300 , and account monitoring orders 1301 . Each type of order is subject to strict formal and substantial requirements. In essence, the scope of such orders is always limited to one individual or one set of premises, they must contain specific mandatory information, and they may only be issued for limited purposes. For example, search and seizure warrants must specify the subject of the investigation (a person or property), they must state that the order is sought for the purposes of the investigation and in relation to material specified in the application, and that the person specified in the application appears to be in possession or control of that material 1302 . Then, a Deemster may only issue the order if there are reasonable grounds to believe or suspect 1303 that there is related material specified in the warrant 1304 on the premises 1305 , and that, for instance, in the case of a money laundering investigation, the person specified in the application has committed a money laundering offence or an ancillary money laundering offence 1306 .

The Anti-Terrorism and Crime Act 2003 (ATCA) provides the Isle of Man police with specific powers to obtain information in the course of terrorism investigations, including by conducting searches and seizures, by obtaining customer information and through account monitoring orders. These powers can generally be exercised only on the basis of a search warrant issued by a Justice of the Peace under similar procedural and substantive conditions as regular warrants 1307 . However, in the specific context of anti-terrorism, warrantless searches are allowed on the basis of a written order from a police officer of at least the rank of chief inspector, but only in case of serious emergency requiring immediate action 1308 . Furthermore, a police officer, or a person authorised in writing by the Attorney General, may also request account monitoring orders to a High Court judge 1309 . Such an order may not exceed 90 days 1310 , is subject to formal requirements 1311 , and may only be issued if the tracing of the terrorist property is desirable for the purposes of the investigation and will enhance its effectiveness 1312 . Lastly, the police also have the power to obtain customer information orders 1313 . Such orders may be issued by a High Court judge under the same conditions as an account monitoring order 1314 .

Finally, criminal law enforcement authorities in the Isle of Man, including the FIU, may obtain personal data through (voluntary) disclosure by private individuals, business organisations or public authorities.

In terms of disclosures to the FIU, Sections 142 – 144 POCA introduce an obligation to disclose information related to suspected money laundering when a person obtained that information in the course of a business in the so-called regulated sector 1315 . Section 14 ACTA similarly imposes a duty on the regulated sector to disclose information where there are reasonable grounds for knowing or suspecting that another person has committed an offence related to financing of terrorism 1316 . Section 11 of the ACTA requires any other person that believes or suspects, based on information which comes to his or her attention in the course of a business or employment, that another person has committed an offence related to the financing of terrorism, to disclose this suspicion, and the information on which it is based. According to Section 12 ACTA, any person may disclose to the FIU a suspicion or belief that any money or other property is terrorist property (or is derived from terrorist property), as well as any matter on which the suspicion or belief is based. Pursuant to the Financial Intelligence Unit Act 2016 (FIUA), any person may disclose information if the disclosure is made for the purposes of the exercise of any functions of the FIU 1317 . The FIU then has the power to request additional information from certain entities or individuals 1318 , but only when it reasonably considers that, for the proper fulfilment of any of its functions, it is necessary or expedient to seek additional information from the person in question 1319 .

In terms of disclosures to the Isle of Man police, Section 26 ACTA imposes a duty on any person to disclose specific information which he or she knows or believes to be of material assistance in preventing the commission of an act of terrorism, or in securing the apprehension, prosecution or conviction of another person, in the Isle of Man, for an offence involving the commission, preparation or instigation of an act of terrorism. In addition, Section 56 ACTA provides that public authorities may (voluntarily) disclose certain information obtained under other Isle of Man legislation 1320 . In that case, no disclosure of information can be made unless the public authority is satisfied that making the disclosure is proportionate to what is sought to be achieved by it 1321 .

Importantly, any disclosure of personal data on the basis of the abovementioned provisions has to comply with the Applied GDPR and the Implementing Regulations, and the further processing by criminal law enforcement authorities of personal data obtained through such disclosures is subject to the provisions of the Applied LED and the Implementing Regulations.

2.2.2.Further use of the information collected

The further use of data collected by Isle of Man criminal law enforcement authorities on one of the grounds referred to in Section 2.1.1, as well as the sharing of such data with a different authority for purposes other than the ones for which it was originally collected (so-called ‘onward sharing’), is subject to safeguards and limitations.

First, the processing of personal data by law enforcement authorities in the Isle of Man is governed by the provisions of the Applied LED and the Implementing Regulations as described in section 2.1. With respect to onward sharing, Article 4(2) of the Applied LED, like the LED, allows that personal data collected for a law enforcement purpose may be further processed (whether by the original controller or by another controller) for any other law enforcement purpose, provided that the controller is authorised by law to process data for the other purpose and the processing is necessary and proportionate to that purpose. In this case, all the safeguards provided by the Applied LED, the Applied GDPR and the Implementing Regulations (referred to in section 2.1) apply to the processing carried out by the receiving authority.

Second, the different laws that allow for data collection by criminal law enforcement authorities in the Isle of Man impose specific limitations and safeguards as to the use and further dissemination of the information obtained in exercising the powers they grant.

As regards the powers of search and seizure under the PPP Act, the police officer who seizes anything must, if requested by the occupier of premises, provide in reasonable time that person with a record of what he has seized. The police officer must also grant access to or supply a photograph or a copy of the seized or retained item at the request of the person who had custody of the item before it was seized 1322 . Importantly, anything that has been seized by the police may not be retained longer than necessary in the circumstances 1323 .

With respect to the interception of communications, Section 6 of the IOCA sets out the safeguards that need to be applied to intercepted material. Notably, when issuing an interception warrant, the Chief Minister is required to make arrangements to limit the dissemination of the material to the minimum necessary for the purposes authorised by the warrant. In particular, the Chief Minister must limit the extent to which the material is disclosed, the number of persons to whom any of the material is disclosed, the extent to which the material is copied as well as the number of copies made of any of the material 1324 . In addition, the IOCA explicitly provides that the material may not be retained for longer than necessary to fulfil the purpose for which it was obtained 1325 .

In terms of investigative measures carried out in the context of terrorism offenses and money laundering, the ATCA allows the sharing of information with any of the British intelligence services for the purpose of the exercise by that service of any of its functions, but only if such sharing is not in violation of the data protection legislation or prohibited by the IOCA 1326 .

Finally, the Criminal Justice Act 1991 provides the rules on mutual legal assistance in criminal matter 1327 . The Attorney General may provide evidence located on the Isle of Man to a third country’s court or prosecuting authority if there are reasonable grounds to suspect that an offence according to that third country’s law has been committed, and if proceedings or an investigation are ongoing about that offence 1328 . The Attorney General must request a warrant to a Deemster before granting access to the evidence 1329 . For the warrant to be granted, the offense in the third country would need to also be recognised as such under Isle of Man law had it taken place on the Island, and there needs to be reasonable grounds to suspect that the evidence is located on premises on the Island 1330 .

2.2.3.Oversight

Different bodies have oversight over the processing of personal data by criminal law enforcement authorities in the Isle of Man.

First, the Information Commissioner, whose independence is enshrined in law 1331 , oversees the application of the Applied LED and the Implementing Regulations 1332 . The tasks and powers of the Information Commissioner mirror those set out in Article 46 and 47 of the Law Enforcement Directive. To perform those tasks, the Information Commission may issue several types of notices and orders and has the power to bring court proceedings for non-compliance with such notices or orders 1333 . Information notices require a controller or processor to disclose the information the Commissioner needs for the discharge of his or her functions under the data protection legislation 1334 . Assessment notices permit to verify a controller or processor’s compliance with data protection legislation, for instance by allowing on-site investigations and access to any data processing equipment, any document, material or information 1335 . Enforcement orders permit to compel a person to take or refrain from taking certain actions, for example in relation to the data protection principles, data subjects’ rights, or the obligation to notify data breaches 1336 . According to information provided by the Isle of Man authorities, since the entry into force of the Applied LED and the Implementing Regulations, the Information Commissioner has investigated several complaints that concerned the Isle of Man Constabulary. In two cases, minor compliance issues were detected, such as non-compliance with a data subject’s request for access to personal data. Those issues were rectified further to the Commissioner’s advice. The Information Commissioner also regularly engages with law enforcement authorities by providing guidance and advice, notably to the authorities’ data protection officers.

Second, the Interception of Communications Commissioner oversees the application of the IOCA, i.e., the interception of communications for the purposes of national security and of detecting and preventing serious crime 1337 . The functions of the Commissioner are to keep under review the activities of the Chief Minister relating to his functions under the IOCA and the adequacy of the safeguards implemented in connection with interception under the IOCA. The Interception of Communications Commissioner must also assist the Interception of Communications Tribunal (see section 2.2.4) for the purpose of enabling it to carry out its functions under the IOCA 1338 .

Every person holding office under the Crown, a person engaged in the business of the Post Office or a person in the running of a courier service or a public telecommunications system is required to disclose to the Interception of Communication Commissioner all documents or information that the Commissioner may require for the purpose of enabling him to carry out his functions 1339 .

The Interception of Communication Commissioner is required to prepare an annual report to the Governor in Council 1340 . A copy of every annual report must be submitted to the Isle of Man parliament (Tynwald) and made public 1341 .

If it appears to the Interception of Communication Commissioner that there has been a contravention of rules governing the issuance of interception warrants which has not been the subject of a report made by the Tribunal under the IOCA (see section 2.2.4), or that the safeguards that have been put in place in relation to the retention and disclosure of the intercepted material are inadequate, (s)he must report to the Governor in Council 1342 .

Pursuant to the Commissioner’s recent annual reports, interception warrants in the Isle of Man have been issued for the purposes of the detection and prevention of serious crimes. The Commissioner found that the warrants had been issued in respect of the principles of necessity and proportionality and in compliance with procedural requirements, notably the need to consult the Attorney General before the issuing of a warrant. Finally, she found that the safeguards required by Section 6 IOCA had been implemented in a satisfactory manner, while noting in her latest annual report of 2020 that the related policies and procedures had been recently updated by the Cabinet Office in cooperation with the Constabulary, leading to an improvement in the practical aspects of the procedure 1343 .

2.2.4.Redress

As regards the processing of personal data by law enforcement authorities in the Isle of Man, redress mechanisms are available under the data protection legislation, the Human Rights Act 2001 and under the IOCA.

This series of mechanisms provide data subjects with effective administrative and judicial means of redress, enabling them in particular to ensure their rights, including the right to have access to their personal data, or to obtain the rectification or erasure of such data.

First, pursuant to Regulation 122 of the Implementing Regulations, data subjects have the right to lodge a complaint with the Information Commissioner if the data subject considers that, in connection with personal data relating to him or her, there is an infringement of the data protection legislation. The Information Commissioner has the power to assess the compliance of the controller and processor with the Applied LED and the Implementing Regulations and require them to take necessary steps in case of non-compliance 1344 .

Second, the Implementing Regulations provide the right to a remedy against the Information Commissioner if it fails to take appropriate steps 1345 to respond to a complaint made by the data subject. More specifically, the complainant can apply to the Data Protection Tribunal, which can issue an order requiring the Information Commissioner to take any steps specified in the order or to provide the requested information to the data subject 1346 .

Third, data subjects can also invoke violations of the data protection rules by criminal law enforcement authorities directly before the courts 1347 . If, on an application by a data subject, a court is satisfied that there has been an infringement of the data subject's rights under the data protection legislation, the court may order the controller or processor to take or refrain from taking steps specified in the order. Moreover, a person who suffers damage by reason of a contravention of a requirement of the data protection legislation is entitled to compensation for that damage from the competent authority. A controller or processor is not liable if it proves that it is not in any way responsible for the event giving rise to the damage 1348 .

Fourth, as far as any person considers that their rights, including rights to privacy and data protection, have been violated by public authorities, individuals can obtain redress before the courts of the Isle of Man under the Human Rights Act 2001 1349 . If the court finds any act of a public authority to be unlawful, it can grant such relief or remedy, or make such order, within its powers as it considers just and appropriate 1350 . The court can also declare a provision of primary legislation to be incompatible with a right provided by the Human Rights Act 1351 . Finally, after having exhausted national remedies, a person, non-governmental organisation or groups of individuals can obtain redress before the European Court of Human Rights for violations of the rights guaranteed under the European Convention of Human Rights 1352 .

For violations of the IOCA, individuals can obtain redress before the Interception of Communications Tribunal. This redress avenue is described in section 2.2.4 below.

2.3.Access and use by Isle of Man public authorities for national security purposes

In the Isle of Man, access to information transferred under the adequacy decision for purposes of national security takes place in the form of the interception of communications on the basis of the IOCA 1353 . It is the Isle of Man Constabulary that carries out such interception.

2.3.1.Legal bases and applicable limitations/safeguards

The IOCA provides the legal framework for the interception of communications in the course of transmission by post, by means of a courier service or a public telecommunication system. The IOCA introduces a general principle of confidentiality of communications and makes it a criminal offence to intentionally intercept communications 1354 . This is reflected in the fact that interception is lawful only when carried out on the basis of a warrant 1355 . An interception warrant is issued by the Chief Minister and requires the person to whom it is addressed to intercept the communications described in the warrant or to disclose the intercepted material to such persons and in such manner as are described in the warrant 1356 . An interception warrant can only be issued if the Chief Minister considers that the information sought to be obtained could not reasonably be acquired by other, less intrusive means 1357 . Before issuing or renewing a warrant the Chief Minister is required to consult the Attorney General, i.e., obtain legal advice from the Government’s principal legal adviser on whether the conditions for issuing a warrant are fulfilled. A register of warrants must be maintained, including details of every warrant, and of every amendment, renewal and cancellation thereof, and details of every consultation of the Attorney General 1358 .

In accordance with Section 3 IOCA, the warrant must require the interception of communications in relation to one particular person named or described in the warrant or in relation to a single set of premises named or described in the warrant. The warrant must also describe the communications for which interception is required by references to addresses, numbers, apparatus or other factors to be used for identifying those communications 1359 .

Unless it is renewed, a warrant ceases to have effect two months after its issuance. The Chief Minister may, at any time before the end of the relevant period, renew the warrant if he considers that the warrant continues to be necessary (on the same grounds for which it was issued) 1360 . If the Chief Minister considers that any factor specified in a warrant is no longer relevant for identifying the communications authorised to intercept, he must amend the warrant by deleting that factor 1361 .

2.3.2.Further use of the information collected

The further use of personal data obtained in the interests of national security is governed by the provisions of the Applied GDPR and the Implementing Regulations as described in sections 2.1 and 1 1362 . In particular, pursuant to Articles 5(1)(a) and (b) of the Applied GDPR, such processing must be lawful, and data must not be processed in a manner that is incompatible with the purpose for which it was collected. The controller can process the data for another purpose, different from that for which the data was collected, when it is compatible with the original one and provided that the controller is authorised by law to process the data.

In addition, the IOCA sets out specific safeguards for the further use and sharing of data obtained through the interception of communications, including for the sharing of such data with third countries. Section 6 IOCA specifies that the Chief Minister has the duty to make arrangements to limit the dissemination of the material obtained to the minimum necessary for the purposes authorised by the warrant. In particular, the Chief Minister must limit the extent to which the material is disclosed, the number of persons to whom any of the material is disclosed, the extent to which the material is copied as well as the number of copies made of any of the material 1363 . In addition, the IOCA explicitly provides that the material may not be retained for longer than necessary to fulfil the purpose for which it was obtained 1364 .

2.3.3.Oversight

Government access for national security purposes in the Isle of Man is overseen by different bodies. The Information Commissioner oversees the processing of personal data in light of the Applied GDPR and the Implementing Regulations, while specific oversight on the use of the interception powers under the IOCA is provided by the Interception of Communications Commissioner, which oversees interception both for law enforcement and for national security purposes.

The processing of personal data carried out for national security purposes is governed by the Applied GDPR and the Implementing Regulations. The general functions and powers of the Information Commissioner are laid down in Articles 57 and 58 of the Applied GDPR. The tasks include, but are not limited to, monitoring and enforcement, promoting public awareness, advising Tynwald, the government and other institutions on legislative and administrative measures, promote the awareness of controllers and processors of their obligations, provide information to a data subject concerning the exercise of the data subject’s rights, handle complaints, conduct investigations etc. The Commissioner has the powers to notify controllers of an alleged infringement and to issue warnings that a processing is likely to infringe the rules, issue reprimands, ban processing or order the controller to take certain actions. While Regulation 22 of the Implementing Regulations provides an exception to certain tasks and powers of the Commissioner if this is required for the purposes of safeguarding national security, these exceptions apply only if necessary and proportionate and on a case-by-case basis (as explained in section 2.1).

Furthermore, as described in section 2.1.3 above, the Interception of Communications Commissioner oversees the application of the IOCA, i.e., the interception of communications for the purposes of national security and for detecting and preventing serious crime 1365 . (S)he reviews the activities of the Chief Minister relating to his functions under the IOCA and the adequacy of the safeguards implemented in connection with interception under the IOCA and assists the Interceptions of Communications Tribunal (see section 2.2.4) 1366 . The Commissioner prepares an annual report to the Governor in Council 1367 , a copy of which must be submitted to the Isle of Man parliament and made public 1368 . If it appears to the Commissioner that there has been a contravention of rules governing the issuance of interception warrants or that safeguards that have been put in place in relation to the retention and disclosure of the intercepted material are inadequate, (s)he must report to the Governor in Council 1369 .

Pursuant to the Commissioner’s recent annual reports, no interception warrants since 2016 have been issued in the interest of national security 1370 .

2.3.4.Redress

Individuals can obtain redress for violations of the IOCA before the Interception of Communications Tribunal.

Any person, including any individual in the EU, who believes 1371 that communications sent to or by him have been intercepted, can apply to the Interception of Communications Tribunal for an investigation. The Tribunal has been established in accordance with Section 8 IOCA and it is independent from the executive 1372 . When receiving an application, the Interception of Communications Tribunal must investigate whether there is or has been a relevant 1373 warrant or certificate, and where this is the case, whether there has been any violation of the rules under the IOCA in relation to that warrant or certificate. The Tribunal may only reject applications that appear to be frivolous or vexatious.

If the Interception of Communications Tribunal concludes that there has been a violation of the rules of the IOCA, it must notify the applicant about its conclusions, report its findings to the Governor in Council and, if appropriate, make an order to (1) quash the relevant warrant or the relevant certificate; (2) delete copies of the intercepted material; (3) direct the Treasury to pay to the applicant a compensation 1374 . The Interception of Communications Tribunal must also notify the applicant in case it comes to the conclusion that there has been no contravention of the rules of the IOCA. According to Section 8(8) IOCA the decision of the Tribunal is not subject to appeal.

Finally, as also described in section 2.1.4 above, as far as individuals consider that their rights, including rights to privacy and data protection, have been violated by public authorities, they can obtain redress before the courts of the Isle of Man under the Human Rights Act 2001. In addition, any individual may obtain judicial redress before the European Court of Human Rights against the unlawful collection of his/her data for national security purposes, provided that all available domestic remedies have been exhausted.

VII. STATE OF ISRAEL

1.RULES APPLYING TO THE PROCESSING OF PERSONAL DATA

1.1.Relevant developments in the data protection framework of Israel

On 31 January 2011 the European Commission adopted a decision in which the State of Israel, as defined in accordance with international law, was considered as providing an adequate level of protection for personal data 1375 . The Article 29 Working Party had provided its opinion on the level of protection for personal data in Israel on 1 November 2009 1376 . At the time, the legal framework for the protection of personal data in Israel was set out in the Privacy Protection Law 5741 - 1981 (PPL) and Regulations. The PPL was first passed in 1981 and applies to both the public and the private sector.

Since the adoption of the Commission’s adequacy decision, Israel’s framework for the protection of privacy and personal data has been significantly strengthened through a number of developments at legislative, regulatory and enforcement level. In particular, as described in more detail below, Israel adopted Privacy Protection (Data Security) Regulations, 5777-2017 (Data Security Regulations) which apply to the public and to the private sector and are aimed at improving the level of data security across all sectors by setting general legally binding standards 1377 . In addition, Israel introduced specific safeguards to reinforce the protection of personal data transferred from the European Economic Area by adopting Privacy Protection Regulations (Instructions for Data that was Transferred to Israel from the European Economic Area), 5783-2023 (Privacy Protection Regulations) 1378 . Moreover, Israeli Courts have clarified and further reinforced the existing framework in several judgments that interpret the right to privacy set out in the Basic Law 1379 and the provisions of the PPL. Finally, Israel’s Privacy Protection Authority (PPA) 1380 has clarified important elements of the data protection system in Israel through the adoption of guidelines, opinions and directives, for instance on the interpretation of the term ‘data’ and on the right of access.

While the developments in terms of guidance, interpretation and case law that are described in more detail below contribute to an increased level of data protection in Israel, codifying these developments in legislation would be important to enhance legal certainty and solidify the protection for personal data. The ongoing debate on a draft bill that would amend the PPL 1381 seems to offer such an opportunity.

More specifically, since the adoption of the adequacy decision, the PPL’s scope of application has been further clarified in various judgments, government resolutions and opinions of the PPA.

In the Israeli system, personal data is protected in accordance with Chapters A and B of the PPL. Chapter A protects the right to privacy more generally, while Chapter B specifically regulates the protection of data in databases.

Chapter A of the PPL prohibits certain infringements of privacy 1382 by reference to categories such as “information on a person’s private affairs” 1383 , as well as “a matter that relates to a persons’ intimate life” 1384 and “other data obtained in a way which infringes privacy under the provisions of the Article” 1385 . Since the adoption of the adequacy decision, the categories used in Chapter A of the PPL have been further clarified by Israeli courts. For example, courts have confirmed that data such as residential address and telephone number also constitute “information of a person's private affairs” and are protected under the law 1386 . Moreover, a person’s bank account number 1387 , credit card number 1388 , personal calls log 1389 , and a person's application to the authorities for filing a complaint 1390 were considered as information on a person’s private affairs.