The European Union’s external competence in the data protection fieldIs mixity the only way out?

  1. Francesca Tassinari
Revista:
Revista de Derecho Comunitario Europeo

ISSN: 1138-4026

Año de publicación: 2023

Título del ejemplar: III Seminario Gil Carlos Rodríguez Iglesias «La Unión Europea ante la guerra de Ucrania»

Año: 27

Número: 75

Páginas: 247-292

Tipo: Artículo

Otras publicaciones en: Revista de Derecho Comunitario Europeo

Resumen

El presente estudio resume la jurisprudencia y las normas convencionales que sustentan el ejercicio de las competencias externas (implícitas) de la Unión Europea (UE) aplicadas al art. 16.2 del Tratado de Funcionamiento de la UE (TFUE). El art. 16.2 del TFUE faculta a la UE para adoptar normas sobre la protección de las personas cuyos datos personales son procesados y sobre la libre circulación de dichos datos. Las normas adoptadas sobre esta base jurídica podrían activar el criterio de afectación AETR/ERTA codificado en el art. 3.2 del TFUE, convirtiendo la competencia compartida interna de la UE en competencia exclusiva externa. Nuestro análisis sostiene que, a la luz de la legislación de la Unión vigente en materia de protección de datos, la UE posee una competencia externa (implícita) compartida/concurrente basada en el art. 16.2 del TFUE. Por este motivo, las negociaciones para acceder al Convenio 108+ del Consejo de Europa fueron mixtas.

Referencias bibliográficas

  • A. Bygrave, L. (2021). The «Strasbourg Effect» on data protection in light of the «Brussels Effect»: logic, mechanics and prospects. Computer Law and Security Review, 40, 105460. Available at: https://doi.org/10.1016/j.clsr.2020.105460.
  • A. Wessel, R. (2012). Cross-pillar mixity. In E. Cannizzaro, P. Palchetti and A. R. Wessel (eds.). International Law as Law of the European Union (pp. 30-54). Leiden: Martinus Nijhoff Publishers.
  • Adam, R. and Tizzano, A. (2022). Lineamenti di diritto dell’Unione Europea. Torino: Giappichelli.
  • Article 29 Data Protection Working Party (1998a). Transfers of personal data to third countries: Applying Articles 25 and 26 of the European Union data protection directive (Report DPWP. Bulletin DPWP; WP216). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (1998b). Second annual report (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2001). Draft Commission decision on standard contractual clauses for the transfer of personal data to third countries under art. 26-4 of Directive 95/46 (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2004). More harmonised information provisions (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2005). A common interpretation of art. 26-1 of Directive 95/46/EC of 24 october 1995 (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2007a). First joint enforcement action: evaluation and future steps (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2007b). The concept of personal data (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2009). The future of privacy: joint contribution to the consultation of the European Commission on the legal framework for the fundamental right to protection of personal data (Report DPWP.). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2013). Purpose limitation (Report DPWP. Bulletin WP; 203). Brussels: European Commission Public Information.
  • Article 29 Data Protection Working Party (2014). Surveillance of electronic communications for intelligence and national security purposes. (Report DPWP.). Brussels: European Commission Public Information.
  • B. Svantesson, D. J. (2015). Extraterritoriality and targeting in European Union data privacy law: the weak spot undermining the regulation. International Data Privacy Law, 5 (4), 226-234. Available at: https://doi.org/10.1093/idpl/ipv024.
  • Bigo, B., Carrera, S., González Fuster, G., Guild, E., De Hert, P., Jeandesboz, J. and Papakonstantinou, V. (2011). Towards a new European Union legal framework for data protection and privacy: challenges, principles and the role of the European Parliament. Brussels: Policy department C: Citizens’ rights and constitutional affairs civil liberties, justice and home affairs.
  • Blasi Casagran, C. (2017). Global data protection in the field of law enforcement: an European Union perspective. Abingdon: Routledge. Available at: https://doi. org/10.4324/9781315622521.
  • Boehm, F. (2012). Information sharing and data protection in the Area of Freedom, Security and Justice: towards harmonised data protection principles for information exchange at European Union-level. Luxembourg: Springer. Available at: https:// doi.org/10.1007/978-3-642-22392-1.
  • Bosse-Platière, I. and Cremona, M. (2020). Facultative mixity in the light of the principle of subsidiarity. In M. Chamon and I. Govaere (eds.). European Union external relations post-Lisbon: The law and practice of facultative mixity (pp. 48-85). Leiden: Brill. Available at: https://doi.org/10.1163/9789004421981_005.
  • Cannizzaro, E., Palchetti, P. and A. Wessel, R. (2012). International Law as Law of the European Union. Leiden: Martinus Nijhoff Publishers. Available at: https://doi. org/10.1163/9789004215528.
  • Cebada Romero, A. (2006). La peculiaridad de la acción exterior de la Unión Europea. In A. Remiro Brotóns and I. Blázquez Navarro (eds.). El futuro de la acción exterior de la Unión Europea (pp. 73-100). Valencia: Tirant Lo Blanch.
  • Chamon, M. (2021). Provisional Application’s Novel Rationale: Facilitating Mixity in the EU’s Treaty Practice. In Th. Douma, W. (ed.). The Evolving Nature of EU External Relations Law (131-163). Berlin-Heidelberg: Springer. Available at: https://doi.org/10.1007/978-94-6265-423-5_6.
  • Chamon, M and Govaere, I. (2020). Introduction: facultative mixity, more than just a childhood disease of European Union law? In M. Chamon and I. Govaere (eds.). European Union external relations post-Lisbon: The law and practice of facultative mixity (pp. 1-7). Leiden: Brill. Available at: https://doi.org/10.1163/9789004421981_002.
  • Clifford, D. and Ausloos, J. (2018). Data protection and the role of fairness. Yearbook of European Law, 37, 130-187. Available at: https://doi.org/10.1093/yel/ yey004.
  • Cremona, M. (2010a). Disconnection clauses in European Union law and practices. In C. Hillion and P. Koutrakos (eds.). Mixed agreements revisited: the European Union and its member states in the world (pp. 160-186). Oxford: Hart Publishing. Available at: https://doi.org/10.3726/978-3-0352-6107-3.
  • Cremona, M (2010b). The external dimension of the Area of Freedom, Security and Justice. In M. Cremona, J. Monar and S. Poli, (eds.). The external dimension of the European Union’s Area of Freedom, Security and Justice (pp. 3-30). Brussels: College of Europe Studies.
  • Cremona, M (2020). Structural principles and their role in European Union external relations law. In M. Cremona (ed.). Structural principles in European Union external relations law (pp. 3-30). Portland: Hart Publishing.
  • Dashwood, A. (2010) Mixity in the era of the treaty of Lisbon. In C. Hillion and P. Koutrakos (eds.). Mixed agreements revisited: The European Union and its member States in the world (pp. 351-366). Oxford: Hart Publishing.
  • Dashwood, A., Dougan, M., Rodger, B., Spaventa, E. and Wyatt, D. (2011). Wyatt and Dashwood’s European Union Law. Oregon: Hart Publishing.
  • De Baere, G. (2008) Constitutional Principles of European Union External Relations. Oxford: Studies in European Law. Available at: https://doi.org/10.1093/acprof:oso/9780199546688.001.0001.
  • De Baere, G. (2017). European Union external action. In C. Bernard and S. Peers (eds.). European Union Law (pp. 710-760). Oxford: Oxford University Press. Available at: https://doi.org/10.1093/he/9780198789130.003.0024.
  • De Baere, G. (2018). Subsidiarity as a structural principle governing the use of European Union external competences. In M. Cremona (ed.). Structural principles in European Union external relations law (pp. 71-92). Portland: Hart Publishing.
  • De Hert, P. (2021). European Union sanctioning powers and data protection: new tools for ensuring the effectiveness of the General Data Protection Regulation in the spirit of cooperative federalism. In S. Montaldo, F. Costamagna and A. Miglio (eds.). European Union law enforcement: the evolution of sanctioning powers (pp. 291-324). London: Routledge. Available at: https://doi.org/10.4324/9780429197819-14.
  • De Hert, P and Papakonstantinou, V. (2014). The Council of Europe data protection convention reform: analysis of the new text and critical comment on its global ambition. Computer Law and Security Review, 30 (6), 633-642. Available at: https://doi.org/10.1016/j.clsr.2014.09.002.
  • De Terwangne, C. (2022). Privacy and data protection in Europe: Council of Europe’s Convention+ and the European Union’s General Data Protection Regulation. In G. González Fuster, R. Van Berkel and P. De Hert (eds.). Research handbook on privacy and data protection law: values, norms, and global politics (pp. 10-35). Cheltenham: Edward Elgar Publishing. Available at: https://doi.org/10.4337/9781786438515.00007.
  • European Data Protection Supervisor (2007). Communication from the Commission to the European Parliament and the Council on the follow-up of the Work Programme for better implementation of the Data Protection Directive. (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2009). Final report by the European UnionU-United States High Level Contact Group on information sharing and privacy and personal data protection. (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2010). Contribution of the European Data Protection Supervisor to the consultation on the future European Union-United States international agreement on personal data protection and information sharing for law enforcement purposes. (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2011). Opinion of the European Data Protection Supervisor on the communication from the Commission to the European Parliament, the Council, the Economic and Social Committee and the Committee of the Regions «a comprehensive approach on personal data protection in the European Union». (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2012). The data protection reform package. (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2014a). Opinion of the European Data Protection Supervisor on the Commission Communication on Internet Policy and Governance: Europe’s role in shaping the future of Internet Governance. (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2014b). Opinion of the European Data Protection Supervisor on the communication from the Commission to the European Parliament and the Council on «Rebuilding Trust in European Union-United States data flows» and on the communication from the Commission to the European Parliament and the Council on «the Functioning of the safe harbour from the perspective of European Union citizens and companies established in the European Union». (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2014c). Surveillance of electronic communications for intelligence and national security purposes. (Report EDPS). Brussels: EDPS Public Information.
  • European Data Protection Supervisor (2015). Europe’s big opportunity. European Data Protection Supervisor recommendations on the European Union’s options for data protection reform. (Report EDPS). Brussels: EDPS Public Information.
  • Fajardo del Castillo, T. (2013). Avances y retrocesos en materia de acuerdos mixtos y de acceso a la justicia para la protección del medio ambiente a la luz de la sentencia del Tribunal de Justicia de 8 de marzo de 2011 en el asunto Oso Pardo. Revista General de Derecho Europeo, 29, 1-27.
  • Fajardo del Castillo, T. (2018). El acuerdo de París sobre el cambio climático: sus aportaciones al desarrollo progresivo del derecho internacional y las consecuencias de la retirada de los Estados Unidos. Revista Española de Derecho Internacional, 70 (1), 23-51. Available at: https://doi.org/10.17103/redi.70.1.2018.1.01.
  • Fajardo del Castillo, T. (2021). La diplomacia del clima de la Unión Europea: La acción exterior sobre cambio climático y el pacto verde mundial. Madrid: Reus.
  • García Andrade, P. (2015). La acción exterior de la Unión Europea en la materia migratoria: Un problema de reparto de competencias. Valencia: Tirant Lo Blanch.
  • García Andrade, P. (2017). La base jurídica de la celebración de acuerdos internacionales por parte de la Unión Europea: entre la Política Exterior y de Seguridad Común de la Unión Europea y la dimensión exterior del espacio de libertad, seguridad y justicia. Comentario a la sentencia del Tribunal de Justicia de 14 de junio de 2016, asunto C-263/14, Parlamento c. Consejo. Revista General de Derecho Europeo, 41, 128-160.
  • García Andrade, P. (2018). European Union external competences in the field of migration: how to act externally when thinking internally. Common Market Law Review, 55, 157-200. Available at: https://doi.org/10.54648/COLA2018006.
  • García Andrade, P. (2019). European Union external competences on migration: which role for mixed agreements? In S. Carrera, J. Santos Vara and T. Strik (eds.). Constitutionalising the external dimensions of European Union migration policies in times of crisis. legality, rule of law and fundamental rights reconsidered (pp. 39-56). Cheltenham: Edward Elgar Publishing. Available at: https://doi.org/10.4337/9781788972482.00010.
  • Gascón Marcén, A. (2023). La Unión Europea y los convenios internacionales elaborados en el marco del Consejo de Europa. In P. García Andrade (ed.). Interacciones entre el Derecho de la Unión Europea y el Derecho internacional público (pp. 227-242). Valencia: Tirant lo Blanch.
  • Gianelli, A. (2012). Customary international law in the European Union. In E. Cannizzaro, P. Palchetti and R. Wessel (eds.). International law as Law of the European Union (pp. 93-110). Leiden: Martinus Nijhoff Publishers.
  • González Fuster, G. (2014). The emergence of personal data protection as a fundamental right of the European Union. Switzerland: Springer International. Available at: https://doi.org/10.1007/978-3-319-05023-2.
  • Govaere, I. (2020). «Facultative» and «Functional» mixity consonant with the principle of partial and imperfect conferral. In M. Chamon and I. Govaere (eds.). European Union external relations post-Lisbon: The law and practice of facultative mixity (pp. 21-47). Leiden: Brill. Available at: https://doi.org/10.1163/9789004421981_004.
  • H. Weber, R. (2013). Transborder data transfers: concepts, regulatory approaches and new legislative initiatives. International Data Privacy Law, 3 (2), 117-130. Available at: https://doi.org/10.1093/idpl/ipt001.
  • Hijmans, H. (2016). The European Union as guardian of internet privacy. Switzerland: Springer. Available at: https://doi.org/10.1007/978-3-319-34090-6.
  • Hijmans, H. and Scirocco, A. (2009). Shortcomings in European Union data protection in the third and the second pillars. Can the Lisbon treaty be expected to help? Common Market Law Review, 46 (5), 1485-1525. Available at: https://doi.org/10.54648/COLA2009061.
  • Hillion, C. and Koutrakos, P. (2010). Mixed agreements revisited: The European Union and its Member States in the world. Oxford: Hart Publishing.
  • Hustinx, P. (2013). European Union data protection law: The review of Directive 95/46/EC and the proposed general data protection Regulation. Collected Courses of the European University Institute’s Academy of European Law: 24. Session on European Union Law, 1-52.
  • Jerker B Svantesson, O. D. (2015). Extraterritoriality and targeting in European Union data privacy law: the weak spot undermining the regulation. International Data Privacy Law, 4 (5), 226-234. Available at: https://doi.org/10.1093/idpl/ipv024.
  • Keukeleire, S. and Delreux, T. (2022), The foreign policy of the European Union. London: Bloomsbury Publishing Plc.
  • Klabbers, J. (2002). Restraints on the treatymaking powers of Member States deriving from European Union Law? Towards a framework for analysis. In E. Cannizzaro (ed.). The European Union as an actor in international relations (pp. 151-176). The Hague: Kluwer Law International.
  • Klamert, M. (2015). What we talk about when we talk about harmonisation. Cambridge Yearbook of European Legal Studies, 17, 360-379. Available at: https://doi.org/10.1017/cel.2015.12
  • Kokott, J. and Sobotta, Ch. (2013). The distinction between privacy and data protection in the jurisprudence of the CJEU and the ECtHR. International Data Privacy Law, 3(4), 222-228. Available at: https://doi.org/10.1093/idpl/ipt017.
  • Kuner, C. (2017) Reality and illusion in European Union data transfer regulation post Schrems. German Law Journal, 881-918. Available at: https://doi.org/10. 1017/S2071832200022197.
  • Kuner, C. (2019). International organizations and the Europan Union general data protection regulation. International Organizations Law Review, 16, 158-191. Available at: https://doi.org/10.1163/15723747-2019008.
  • Kuner, C. (2020a). Art. 44: General principles for transfer. In C. A. Kuner, L. Bygrave and C. Docksey (eds.). The European Union General Data Protection Regulation: a commentary (pp. 755-770). Oxford: Oxford University Press. Available at: https://doi.org/10.1093/oso/9780198826491.001.0001.
  • Kuner, C. (2020b). Art. 45: transfers on the basis of an adequacy decision. In C. A. Kuner, L. Bygrave and C. Docksey (eds.). The European Union General Data Protection Regulation: a commentary (pp. 771-766). Oxford: Oxford University Press. Available at: https://doi.org/10.1093/oso/9780198826491.003.0085.
  • Liñán Nogueras, D. J. (1996). Los derechos fundamentales en la Unión Europea. In A. Mangas Martín and D. J. Liñán Nogueras (eds.). Instituciones y Derecho de la Unión Europea (pp. 581-596). Madrid: McGraw-Hill.
  • Liñán Nogueras, D. J. (2001). Derechos Humanos y Unión Europea. In J. Cardona Llorens (ed.). Cursos Euromediterráneos Bancaja Derecho Internacional (pp. 363-440). Valencia: Tirant lo Blanch.
  • Liñán Nogueras, D. J. (2020). Derechos humanos y libertades fundamentales en la Unión Europea. In A. Mangas Martín and D. J. Liñán Nogueras (eds.). Instituciones y Derecho de la Unión Europea. Madrid: Tecnos.
  • Lynskey, O. (2015). The Foundations of European Union Data Protection Law. Oxford: Oxford Studies in European Law.
  • Maiani, F. (2002). Le cadre réglementaire des traitements de données personnelles effectués au sein de l’Union Européenne. Revue Trimestrielle de Droit Européenne, 2, 283-309.
  • Marin Aís, R. (2013). La participación de la Unión Europea en tratados internacionales para la protección de los derechos humanos. Madrid: Tecnos.
  • Martín y Pérez de Nanclares, J. (2008). Art. 8: protección de datos de cáracter personal. In A. Mangas Martín (ed.). Carta de Derechos Fundamentales de la Unión Europea: comentario artículo por artículo (pp. 223-243). Madrid: Fundación BBVA.
  • Martínez Capdevila, C. (2023). Los acuerdos internacionales de la Unión Europea en ámbitos de competencias compartidas: ¿mixidad facultativa o mixidad obligatoria? In P. García Andrade (ed.). Interacciones entre el Derecho de la Unión Europea y el Derecho internacional público (pp. 73-95). Valencia: Tirant lo Blanch.
  • Moerel, L. (2011). The long arm of European Union Data Protection Law: does the Data Protection Directive apply to processing of personal data of European Union citizens by websites worldwide? International Data Privacy Law, 46 (1), 28-46. Available at: https://doi.org/10.1093/idpl/ipq004.
  • Monar, J. (2012). The external dimension of the European Union’s Area of Freedom, Security and Justice: progress, potential and limitations after the treaty of Lisbon. Swedish: Swedish Institute for European Policy Studies.
  • Mori, P. (2019). Gli strumenti della codificazione nel diritto dell’Unione Europea. In A. Annoni, S. Forlati and F. Salerno (eds.). La codificazione nell’ ordinamento internazionale e dell’Unione europea (301-369). Napoli: Editoriale Scientifica.
  • O’Keeffe, D. and Schermers, G. H. (1983). Mixed agreements. Deventer: Kluwer.
  • Pearce, G. and Platten, N. (1998). Achieving personal data protection in the European Union. Journal of Common Market Studies, 36, 529-548. Available at: https://doi.org/10.1111/1468-5965.00138.
  • Polakiewicz, J. (2021). A Council of Europe perspective on the European Union: crucial and complex cooperation. Europe and the World: A Law Review, 5 (1), 1-19. Available at: https://doi.org/10.14324/111.444.ewlj.2021.30.
  • Quintel, T. (2022). Data protection, migration and border control. The General Data Protection Regulation, the Law Enforcement Directive and beyond. London: Bloomsbury Publishing. Available at: https://doi.org/10.5040/9781509959662.
  • Rosas, A. (1998). Mixed Union: mixed agreements. In Koskenniemi (ed.). International Law Aspects of the European Union (pp. 125-148). Leiden: Brill.
  • Rosas, A. (2020). Mixity past, present and future: some observations. In M. Chamon and I. Govaere (eds.). European Union external relations post-Lisbon: The law and practice of facultative mixity (pp. 8-20). Leiden: Brill. Available at: https://doi.org/10.1163/9789004421981_003.
  • Rotenberg, M. and Jacobs, D. (2013). Updating the law of information privacy: the new framework of the European Union. Harvard Journal of Law and Public Policy, 36, 605-652.
  • Ruiz Miguel, C. (2003). El derecho a la protección de datos personales en la carta de derechos fundamentales de la Unión Europea: Análisis crítico. Revista de Derecho Comunitario Europeo, 14, 7-43.
  • Saluzzo, S. (2019). The European Union as a global standard setting actor: the case of data transfers to third countries. In E. Carpanelli and N. Lazzerini. (eds.). Use and misuse of new technologies: contemporary challenges in international and European law (pp. 115-134). Switzerland: Springer. Available at: https://doi.org/10.1007/978-3-030-05648-3_6.
  • Scott, J. (2019). The global reach of European Union law. In M. Cremona and J. Scott (eds.). European Union Law beyond European Union borders: the extraterritorial reach of European Union Law (pp. 21-63). Oxford: Oxford University Press. Available at: https://doi.org/10.1093/oso/9780198842170.003.0002.
  • Sobrino García, I. (2021). Las decisiones de adecuación en las transferencias internacionales de datos. El caso del flujo de datos entre la Unión Europea y Estados Unidos. Revista de Derecho Comunitario Europeo, 68, 227-256. Available at: https://doi.org/10.18042/cepc/rdce.68.07.
  • Tassinari, F. (2021). La adopción de actos delegados y actos de ejecución comentario a los artículos 92 y 93 del General Data Protection Regulation. In A. Troncoso Reigada (ed.). Comentario al Reglamento general de protección de datos y la ley orgánica de protección de datos personales y garantía de los derechos digitales (pp. 4901-4920). Pamplona: Thomson Reuters Aranzadi.
  • Tassinari, F. (2022). The European Union adequacy standard in the field of data protection: a competence approach. Diritti Umani e Diritto Internazionale, 16 (1), 5-38. Timmermans, C. (2010). Opening remarks: evolution of mixity since the Leiden 1982 Conference. In C. Hillion, and P. Koutrakos (eds.). Mixed agreements revisited: The European Union and its Member States in the world (pp. 1-8). Oxford: Hart Publishing.
  • Wennerås, P. (2008). Towards an ever greener Union? Competence in the field of the environment and beyond. Common Market Law Review, 45 (6), 1645-1685. Available at: https://doi.org/10.54648/COLA2008116.
  • White, A. (1997). Control of transborder data flow: reactions to the european data protection Directive. International Journal of Law and Information Technology, 5 (2), 230-247. Available at: https://doi.org/10.1093/ijlit/5.2.230.