Brexit: Limiting the Damage

It is one of the ironies of history that the EU as it is today, starting with the single market, was largely made in Britain, the achievement, above all, of former prime minister Margaret Thatcher and her right-hand man in Brussels, the then Commissioner (Lord) Arthur Cockfield. The single market has long been viewed by observers in countries with less of a free market tradition as a typically British liberal invention. And yet it is this market, as well as the EU itself, that another Conservative government is now seeking to leave.

Britain has also left its stamp on key EU initiatives from regional policy to development assistance and fisheries. The EU’s interest in a common foreign and security policy originally stemmed from Britain. The EU’s comparatively transparent and accountable administrative rules date from the reforms introduced by former British Labour Party leader Neil Kinnock when he was Vice-President of the European Commission from 1999 to 2004. Thus, representatives of Britain’s two major parties have helped to make the EU what it is today.

If British prime ministers had explained to public opinion earlier the extent of their country’s influence on the EU, something that other Europeans never doubted, the referendum of 23 June 2016 might never have occurred.

A “Smooth and Sensible” Brexit

Be that as it may, Europeans on both sides of the English Channel are now grappling with the consequences of that vote. If reason and economic interest prevail, a “smooth and sensible” Brexit, as evoked by the British prime minister in Florence in September, might yet emerge.

This would involve a broad agreement, in 2017, on the principal aspects of the divorce settlement. This concerns mainly Britain’s financial commitments to the EU, the residence, professional and health rights of citizens living on both sides of the Channel after Brexit, and the need to maintain the Common Travel Area between Britain and Ireland and to avoid a hard border across the island of Ireland after Brexit. While Brussels, London and Dublin have affirmed their intention of achieving these goals, there are many practical and political issues to resolve.

If sufficient confidence and trust between EU and UK negotiators is established, it should also be possible to agree to the general terms of a future political and economic agreement between London and Brussels by the end of the year and to broach the question of transitional arrangements to smooth the way for government and business. The British government wishes to ensure that business need adjust to Brexit only once, hence the need for a smooth transition to a well-defined future relationship.

If good progress is made next year, the separation agreement and transitional arrangements could be drawn up by October 2018, allowing enough time for approval by EU and British institutions ahead of Britain’s exit from the EU at midnight between 29 and 30 October 2019. Little, except Britain’s lost vote in EU institutions, would then change for the next two to three years, as the UK continued to make payments to the EU budget, respect judgements of the European Court of Justice and accept the free movement of labour.

The breathing space would be used to negotiate, sign and ratify a two-part long-term agreement. The first part would cover trade and economic issues; it could take effect provisionally relatively quickly after agreement had been reached. The second part, though, would be a wide-ranging political agreement, involving security and even aspects of defence. Both sides have an interest in cooperation on armaments production and unconventional forms of conflict, as well as police and judicial affairs. This would involve the member states’ legal responsibilities and require ratification by all twenty-eight countries concerned. It might not come into effect before the mid-late 2020s.

This relatively benign sequence of events assumes that the British government is unified behind its negotiator, David Davies, and that the political situation in Britain and the EU remains generally stable. It also assumes that the EU can move beyond its rigid two-stage sequencing of the negotiations.

However, there may well be political upsets, involving a leadership competition in the Conservative Party and, perhaps, an early general election. The opposition Labour Party may come to power bringing a change in priorities but also differences of opinion in its own ranks. The British economy will be damaged by Brexit, according to leading economists, and public opinion is likely to react when this is widely felt.[1]Until now, the main impact has been a decline in sterling and rising inflation, raising the prospect of higher interest rates.

The “Cliff Edge” Scenario

Such uncertainties, as well as the divergent political agendas of London and Brussels, may make the smooth and sensible Brexit impossible to achieve during the limited time available. This opens the way to a second scenario, widely described in Britain as the cliff edge. Under this hypothesis, the December 2017 goal for achieving a breakthrough in the separation talks is missed. This further postpones discussion of transitional arrangements and a future long-term agreement.

Negotiations continue fitfully during 2018 but the two sides are too far apart to reach agreement by October 2018, which the EU chief negotiator, Michel Barnier, has designated as the effective deadline. If October passes without an overall agreement, it will probably be too late to secure the agreement of the European Parliament before 29 March 2019, when the two-year negotiating period initiated by the British government’s notification of withdrawal expires. Nonetheless, negotiations might well go down to the wire.

Unless all twenty-eight countries “stop the clock” at midnight, an old Brussels ruse, the UK would then leave the EU without an agreement. Business leaders have warned of the chaos this will bring. There will be an unmanageable fivefold increase in work at British, Irish and mainland European ports checking consignments, the suspension of air travel between the UK and the EU, pending the conclusion of a new air transport agreement, and other major disruptions.

Health, safety, veterinary and phytosanitary inspections, as well as the assessment of customs duties, would lead to long queues of lorries at ports on both sides of the channel. Neither side can build the necessary infrastructure and linked IT systems or recruit sufficient qualified staff in time to cope with dramatically increased requirements after a hard Brexit. Supply chains would be disrupted and many foreign-owned companies, which had not already relocated to remaining EU countries, would seek to do so rapidly.

The political and economic damage of going over the cliff edge would last for years and embitter the UK’s relations with the EU and third countries. Many would question the value of Britain’s WTO commitments in the absence of appropriate trading arrangements between Britain and the EU.

This then is a sketch of the cliff edge. Those who admire Britain for its pragmatism, fairness and common sense find it hard to believe that such a scenario might become reality. Surely, they say, Britain and the EU are involved in preliminary skirmishing of the type that precedes any negotiation. They are sure to come to their senses as the decisive deadlines approach. Nothing is less than certain.

A Tale of “Downside” Risks

The outcome may well diverge from either the optimistic or the pessimistic scenarios delineated above. However, the risks are mainly “downside” as the economists put it. British negotiators have not yet grasped the fundamentally asymmetric nature of negotiations between twenty-seven countries backed by European institutions on the one side and a single country seeking to leave the club on the other. It would be better for government, business and the public, if this reality were more widely recognized, leading to realistic negotiating targets. Indeed, Brexit is not really a negotiation at all in the usual sense. It is rather an effort by the leaving country to secure some exceptions from the club’s rules at the time of its departure. This is much akin to the efforts of a candidate (joining) country to achieve some, temporary, transitional exceptions to the EU’s rules.

The Brexit talks are essentially an exercise in damage limitation, mainly through transitional arrangements. When the divorce and transitional arrangements have been agreed, Britain and the EU can concentrate on negotiating a long-term partnership which will be in their mutual interest.

This post was written by Michael Leigh of Covington & Burling LLP., © 2017
For more Global legal analysis, go to The National Law Review

Positive Developments – EUTM

Trademark owners should take note of two new types of trademark protection available in the European Community as of October 1, 2017.

1. Certification Marks – although it has always been possible to register certification marks in a few individual EU member states, it was previously not possible to register a certification mark, for certification services, with the EUIPO.  This will change as of October 1, 2017 when it will now it will be possible to register certification with the EUIPO, covering all EU member states.  European Union certification marks are defined as marks that are “capable of distinguishing goods or services which are certified by the proprietor of the mark in respect of material, mode of manufacture of goods or performance of services, quality, accuracy or other characteristics, with the exception of geographical origin, from goods and services which are not so certified.”

2. Marks no Longer Need Graphic Representation – it will now be possible to file for sound, hologram, motion, and multimedia marks; marks can now be represented in any form using generally available technologies.  Unfortunately, it is still not possible to file for tactile, smell, and taste marks in the EU.

This post was written by Monica Riva Talley of Sterne Kessler © 2017
For more legal analysis go to The National Law Review

Brexit – Squaring Circle and involving European Court of Justice

Clash of Philosophies

There is a potentially irreconcilable clash of constitutional philosophies between the UK and the EU which results in certain “no go” areas on the EU side for the forthcoming Brexit negotiations.

Perspective of the EU27

EU UK FlagsThe EU27’s approach is driven by the perception that the European Union is not merely representative of a negotiable bundle of international trade treaties but is a supranational entity based on and subject to a constitution created by the Treaty on European Union (TEU) and the Treaty on the Functioning of the European Union (TFEU). From the perspective of the EU and the EU27 , the constitution of the EU goes well beyond international treaties.  The Treaties establish a Union which is based on principles similar to those in Federal States.

Any of the member states of the EU (including the UK) accordingly is, from the perspective of the EU, not only a counterparty to an international treaty but an integral part of an autonomous Union. The driving principle of the European Union – which was correctly identified and repeated by Leave campaigners – is the supremacy of the EU’s legal order over the legal order of its member states, including the supremacy of the EU’s legal order over the constitutions of the member states.

One of the most important principles of the EU is laid down in Article 3 (2) TEU.  This provides that the EU is an area within which its citizens are free and can freely move. This is a general principle which is not restricted to trade but applies in all areas of life. In addition to such general principle Article 3 (3) TEU states that, inter alia, one of the consequences of this area of freedom and free movement is the internal market.

That is the context of the European Union placing the future rights of EU citizens in the UK at the forefront of any of the forthcoming Brexit negotiations.

Since the EU is bound to such constitutional order, any agreement with the UK pursuant to Article 50 TEU needs, from the perspective of the EU, to comply with such constitutional principles. “Constitutionality” is a major issue for the continental European member states since governments and politicians on the continent are used to be bound by constitutions which cannot be overridden by domestic governments or parliaments by simple act of parliament or government. Constitutions can only be amended or overridden if a qualified majority in Parliament and, in some member states, a referendum so approves. In some member states, such as Germany, there are even some constitutional principles which cannotbe changed by Parliament at all.

Perspective of the UK

The UK approach is driven by its perspective that the EU is simply the creation of a bundle of international treaties which establish a common market in which various different principles of free trade and free movement apply, and the contents of which can be freely negotiated between the various parties to such international treaties. Accordingly the UK takes the point of view that the agreements to be entered into pursuant to Article 50 TEU upon Brexit can be freely negotiated and that such negotiations are not subject to or restricted by overriding constitutional principles which are binding on the EU during such exit negotiations.

How to reconcile the differing points of view and how to involve the European Court of Justice

The two above described perspectives of the UK and the EU would appear to be legally irreconcilable, but there is a potential avenue out of such dead-lock by making use of:

(a) the fact that Article 50 (3) TEU does not conclusively state that the UK ceases to be a member state of the EU two years after the Article 50 Notice has been given, but in principle refers to the date on which the relevant withdrawal agreement becomes effective, which effective date can either fall on a date occurring after the two years or on a date occurring prior to the two years.

Accordingly, a simple withdrawal agreement could provide that Brexit becomes effective only once certain specified additional agreements have been finalized and entered into.

(b) the Commission, the European Parliament, the European Council and/or any member state (including the UK) being entitled to request from the European Court of Justice (ECJ) pursuant to Article 218 (11) TFEU legal opinions on any draft agreement – like the agreements between the UK and the EU on their future relationships – to be entered into with a third country (which the UK would be once the withdrawal agreement becomes effective) in order to avoid and/or mitigate concerns relating to the constitutionality of the future relationship agreement with the UK.

It is likely that the EU27 will at some stage call upon the European Court of Justice to opine on the constitutionality of the future relationship agreement(s) with the UK because of the fundamental nature of the agreement(s).

Samples of constitutionally important legal opinions rendered by the European Court of Justice in relation to Agreements which the EU had entered into in the past under Article 218 (11) TFEU (and its predecessors) include, for example:

– ECJ opinions 1/91 and 1/92 on the European Economic Area Agreement and the system of judicial review thereunder,

– ECJ opinion 1/94 relating to the EU agreeing to accede to WTO, GATS and TRIPs

– ECJ opinion 2/13 relating to the accession of the EU to the European Convention on Human Rights

– ECJ opinion 2/15 relating to the Free Trade Agreement with Singapore.

In relation to the Free Trade Agreement with Singapore the ECJ held on 16 May 2017 that such Free Trade Agreement is, because of its far reaching comprehensive content, a so-called “mixed-agreement” and therefore requires the consent of all 28 Member States of the European Union. Depending on the contents of the future relationship agreement between the UK and the EU, such agreement will also need to be ratified by the Parliaments of the EU27 Member States.

Agreements to be negotiated between the UK and the EU

The minimum number of agreements to be negotiated in the context of the UK leaving the EU pursuant to Article 50 is two:

(i) the withdrawal agreement on the details of the withdrawal “taking account of the framework for its future relationship with the Union” and

(ii) an agreement on the details of the future relationship between the EU and the UK.

Even though the minimum number of agreements to be entered into is two, it is likely that there will be more than two agreements since there are areas which need to be dealt with instantaneously (like aviation between the UK and EU27 and a potential accession of the UK to the ECAA Agreement in order to enable the flow of air traffic between the UK and the EU to continue as normal) irrespective of whether other areas may be dealt with at a later stage.

Whereas the withdrawal agreement can be adopted by the EU pursuant to a qualified majority decision pursuant to Article 50 TEU, any agreement on the details of the future relationship will require the “normal” majority contemplated in the TEU and TFEU for the relevant matters concerned, because Article 50 does not apply to such agreements on the details of the future relationship.

From the EU27 perspective, the principal items of the withdrawal agreement are those set out in the Brexit Negotiation Guidelines adopted by the European Council on 29 April 2017, the European Parliament on 5 April 2017 and the Non-Paper of the European Commission of 20 April 2017 and the Commission Recommendation for a Council Decision of 3 May 2017.

Withdrawal Agreement and the date at which it comes into force

The EU and the UK could agree that the withdrawal agreement is ratified in accordance with Article 50 TEU before the lapse of the two-year period but provides that it comes into force only after the agreement on principles for the future relationship has been (i) agreed on working level; (ii) submitted to and reviewed by the European Court of Justice pursuant to Article 218 (11) TFEU, and (iii) been ratified by the UK and the EU – or after the ratification process has been declared by the UK to be defunct.

That would mean that the UK would not cease to be a member state of the EU until there is an agreement on the principles for the future relationship without having to achieve this within the tight two years period.

The UK would also continue to enjoy all rights as a member state under existing international trade and other agreements entered into by the EU with countries around the world, like free trade agreements, air transportation agreements etc. until the ECJ has determined that the principles agreed between the UK and the EU in the agreement on principles for the future relationship are compliant with TEU and TFEU. Once this has been determined, the details of the future relationship could be negotiated in detail between the UK and the EU.

If the UK ceased to be a Member State on 30 March 2019 and “only” some transitory period or implementation period thereafter was agreed on during which certain specified EU rules continue to apply, this would not prevent the UK from losing its rights under existing International Agreements which had been entered into by the EU.

There is clarity in the approach of the EU27. The approach that the UK will take should become clearer after the General Election on 8 June, and later in the year as the UK government begins to identify its Brexit strategy in more detail, and identifies the trade offs it is prepared to make.  The historical and current political climate, as well as the sheer complexity of Brexit, is such that the UK cannot necessarily be expected the trade offs which history will regard as the “right” ones.

By Jens Rinze and Jeremy Cape of Squire Patton Boggs.

“WannaCry” Ransomware Attack Causes Disruption Globally – With Worst Yet to Come

A ransomware known as “WannaCry” affected 200,000 people in 150 countries over the weekend, locking computer files and demanding payment to release them. As of this morning, Australia and New Zealand users seem to have avoided the brunt of the attack, with the Federal Government only confirming three reports of Australian companies being affected.  Not that ransomware attacks tend to be the subject of reporting – there is quite a high rate of payment of affected users as the pricing is deliberately cheaper than most alternatives unless your back-up process is very good.

The ransomware utilises vulnerabilities in out-of-date, unpatched versions of Microsoft Windows to infect devices. It spreads from computer for computer as it finds exposed targets, without the user having to open an e-mail attachment or click a link as is commonplace in most attacks. Ransom demands start at US$300 and doubles after three days.

The U.K. National Health Service (NHS) was among the worst hit organisations, forcing hospitals to cancel appointments and delay operations as they could not access their patients’ medical records. The Telegraph suggested that 90 percent of NHS trusts were using a 16 year old version of Windows XP which was particularly vulnerable to the attack. More attacks are anticipated throughout the working week as companies and organisations turn on their devices.

The U.K. National Cyber Security Center has released guidance to help both home users and organisations limit the impact of the attacks. It can be read here.

Edwin Tan is co-author of this article. 

European Union Adopts Brexit Negotiation Guidelines

Brexit Bull HornOn April 29, a Special European Council, meeting as 27 member states (as opposed to the full 28 member states, as would usually be present), adopted the Article 50 guidelines (Guidelines) to formally define the EU’s position in Brexit negotiations with the United Kingdom. This follows the resolution of the European Parliament on key principles and conditions for the negotiations, adopted on April 5 (for further information, see the April 7 issue of Corporate & Financial Weekly Digest).

The Guidelines are set out under six headings covering:

  • core principles;
  • a phased approach to the negotiations;
  • agreement on arrangements for an orderly withdrawal;
  • preliminary and preparatory discussions on a framework for the EU-UK future relationship;
  • the principle of sincere cooperation; and
  • the procedural arrangements for negotiations under Article 50.

On May 22, the EU General Affairs Council is expected to authorize the opening of the negotiations, nominate the European Commission as the EU negotiator and adopt negotiating directives.

The Guidelines are available here.

Department of Commerce Releases Fact Sheet on EU-U.S. Privacy Shield

As we reported yesterday, the United States and the European Commission have reached a political agreement on a new framework for transatlantic data flows, referred to as the EU-U.S. Privacy Shield.  The U.S. Department of Commerce (“Commerce”) released a fact sheet yesterday to coincide with the announcement of the agreement.

The fact sheet includes a series of bullet points listing ways in which the Privacy Shield (1) “significantly improves commercial oversight and enhances privacy protections,” and (2) “demonstrates the U.S. Commitments to limitations and safeguards on national security.”  On the first point, Commerce states that “EU individuals will have access to multiple avenues to resolve concerns,” including alternative dispute resolution at no cost to individuals.  In addition, Commerce “will step in directly and use best efforts to resolve referred complaints” using a “special team with significant new resources.”  On the second point, the fact sheet references President Obama’s executive actions to enhance privacy protections and oversight relating to U.S. government surveillance activities.  Finally, Commerce states that “the United States is making the commitment to respond to appropriate requests” regarding U.S. intelligence activity, in a manner that is consistent with national security obligations.

ECJ Rules EU-US Safe Harbor Programme Is Invalid

The powers of EU data protection authorities are significantly strengthened by the decision, allowing them to suspend some or all personal data flows into the United States in certain circumstances.

In Maximillian Schrems v. Data Protection Commissioner (case C-362/14), the European Court of Justice (ECJ) has ruled[1] that the European Commission decision approving the Safe Harbor programme is invalid. Further, the ECJ ruled that EU data protection authorities do have powers to investigate complaints about the transfer of personal data outside Europe (whether by Safe Harbor-certified organisations or otherwise, but excluding countries deemed as having “adequate” data protection laws according to the EU). Finally, the ECJ ruled that data protection authorities can, where justified, suspend data transfers outside Europe until their investigations are completed.

Safe Harbor Programme

According to the European Commission, the United States is a country with “inadequate” data protection laws. The European Commission and the US Department of Commerce, therefore, agreed in 2000 to a self-certification programme for US organisations that receive personal data from Europe. Pursuant to the self-certification programme, a US organisation receiving personal data from Europe must certify that it adhered to certain standards of data processing comparable with EU data protection laws such that the EU citizens’ personal data was treated as adequately as if their personal data had remained in Europe. The Safe Harbor programme is operated by the US Department of Commerce and enforced by the Federal Trade Commission. Over 4,000 organisations have current self-certifications of adherence to Safe Harbor principles.[2]

The Schrems Case

Mr. Schrems complained in Irish legal proceedings that the Irish Data Protection Commissioner refused to investigate his complaint that the Safe Harbor programme failed to protect adequately personal data after its transfer to the US in light of revelations about the National Security Agency’s (NSA’s) PRISM programme. The question of whether EU data protection authorities have the power to investigate complaints about the Safe Harbor programme was referred to the ECJ. Yves Bot, Advocate General at the ECJ, said in an opinion released on 23 September 2015 that the Safe Harbor programme  does not currently do enough to protect EU citizens’ personal data because such data was transferred to US authorities in the course of “mass and indiscriminate surveillance and interception of such data” from Safe Harbor-certified organisations. Mr. Bot was of the opinion that the Irish Data Protection Commissioner, therefore, had the power to investigate complaints about Safe Harbor-certified organisations and, if there were “exceptional circumstances in which the suspension of specific data flows should be justified”, to suspend the data transfers pending the outcome of its investigation.

The ECJ followed Mr. Bot’s opinion and, further, declared that the European Commission’s decision to approve the Safe Harbor programme in 2000 was “invalid” on the basis that US laws fail to protect personal data transferred to US state authorities pursuant to derogations of “national security, public law or law enforcement requirements”. Furthermore, EU citizens do not have adequate rights of redress when their personal data protection rights are breached by US authorities.

The EU-US Data Protection Umbrella Agreement

In the last two years, the European Commission and various data protection working parties have discussed ways to improve the Safe Harbor programme and strengthen rights for EU citizens in cases where their personal data is transferred to the United States. Recently, the United States and European Union finalised a data protection umbrella agreement to provide minimum privacy protections for personal data transferred between EU and US authorities for law enforcement purposes. The umbrella agreement will provide certain protections to ensure that personal data is protected when exchanged between police and criminal justice authorities of the United States and the European Union. The umbrella agreement, however, does not apply to personal data shared with national security agencies.

The umbrella agreement also provides that EU citizens will have the right to seek judicial redress before US courts where US authorities deny access or rectification or unlawfully disclose their personal data. Currently, US citizens have the right to seek judicial redress in the European Union if their data—transferred for law enforcement purposes—is misused by EU law enforcement authorities. EU citizens, however, do not have corresponding rights of redress in the United States. A judicial redress bill has been introduced in the US House of Representatives; adoption of the bill would allow the United States and European Union to finalise the umbrella agreement.

Key Findings of the ECJ Decision

The key findings of the ECJ decision are as follows (quotes indicate excerpts from the ruling itself):

“The guarantee of independence of national supervisory authorities is intended to ensure the effectiveness and reliability of the monitoring of compliance with the provisions concerning protection of individuals”.

The powers of supervisory authorities include “effective powers of intervention, such as that of imposing a temporary or definitive ban on processing of data, and the power to engage in legal proceedings”.

The Safe Harbor programme “cannot prevent persons whose personal data has been or could be transferred to a third country from lodging with the national supervisory authorities a claim. . .concerning the protection of their rights and freedoms”.

National courts can consider the validity of the Safe Harbor programme, but only the ECJ can declare that it is invalid.

Where the national data protection authorities find that complaints regarding the protection of personal data by Safe Harbor-certified companies are well-founded, they “must. . .be able to engage in legal proceedings”.

Organisations self-certified under the Safe Harbor programme are permitted to “disregard” the Safe Harbor principles to comply with US national security, public interest, or law enforcement requirements.

There is no provision in the Safe Harbor programme for protection for EU citizens against US authorities who gain access to their personal data transferred to the United States pursuant to the Safe Harbor programme. There is only a provision for commercial dispute resolution.

The EU Data Protection Directive[3] “requires derogations and limitations in relation to the protection of personal data to apply only in so far as is strictly necessary”, but there is no such requirement applicable in the United States following the transfer of personal data pursuant to the Safe Harbor programme.

The Safe Harbor programme “fails to comply with the requirements” to protect personal data to the “adequate” standard required by the EU Data Protection Directive and is “accordingly invalid”.

Other Options to Transfer Personal Data to the United States

Safe Harbor-certified organisations should note that there are other options to transfer personal data to the United States, including express consent and the use of Binding Corporate Rules or EU-approved model clause agreements. Organisations using Safe Harbor-certified vendors may wish to discuss these other options with their vendors. There is, however, a risk that this decision could affect these other options, as national security derogations are likely to override the protection of personal data regardless of how it is transferred, with the only exception being the specific and informed consent of an individual to the transfer of his or her personal data to governmental authorities for national security purposes.

Conclusion

The ECJ decision is likely to take the European Commission by surprise.

The powers of national data protection authorities are significantly strengthened by this decision. They could allow data protection authorities to suspend some or all personal data flows into the United States in serious circumstances and where there is a justifiable reason to do so. There is a risk that a data protection authority could order that the data transfers by an international organisation outside of Europe be suspended from that jurisdiction, whereas data transfers in other European jurisdictions are permitted. To mitigate this risk, the European Commission is entitled to issue EU-wide “adequacy decisions” for consistency purposes.

The European Commission has today announced that it intends to release guidance for Safe Harbor-certified companies within the next two weeks.

Article By Stephanie A. “Tess” BlairDr. Axel Spies & Pulina Whitaker of Morgan, Lewis & Bockius LLP
Copyright © 2015 by Morgan, Lewis & Bockius LLP. All Rights Reserved.

[1] See Judgment of the Court (Grand Chamber) (6 October 2015)

[2] See Safe Harbor List.

[3] Directive 95/46/EC