Non-discriminatory and even-handed implementation of Articles 25 and 26 of the Directive and decisions taken on the basis of these provisions

The working party is mindful of the interest which third countries are showing in the implementation of Articles 25 and 26 of the Directive and in particular in the effects of findings of "adequacy" under Article 25(6). It recognises that concerns exist in some third countries that enforcement actions in the EU may be more severe vis-à-vis third country entities than they are vis-à-vis EU data controllers and that there may also be discrimination among the entities from different third countries.

The working party is confident that these concerns will prove to be unfounded. The data protection supervisory authorities themselves work in the framework of legal and judicial systems that are impartial and the emphasis that is placed on their independence by the Directive and by national law serves to reinforce this. The general principle of equality, of which the prohibition of discrimination on grounds of nationality is a specific enunciation, is one of the fundamental principles of Community law and requires that similar situations shall not be treated differently unless differentiation is objectively justified⁽¹⁾. The members of the working party also recall that one of the purposes of the working party's deliberations is to help ensure the harmonious and thus even-handed implementation of the directive.

The working party fully recognises the necessity to be even-handed in dealing with third countries. The working party notes the commitment of its members to a non-discriminatory and even-handed approach in any actions they may take involving third country recipients covered by Article 25(6) decisions, both among such recipients and between such recipients and data controllers in the EU. The working party wishes to discuss and to contribute to resolving any issues relating to possible discrimination which are drawn to their attention, consulting as necessary with enforcement bodies in the third country or countries concerned.

In the context of ensuring impartial enforcement, the working party recalls that complaints handling is a major part of the enforcement of data protection rules, including the Directive. Member States authorities, as well as the third countries which benefit from an Article 25.6 decision, are subject to an obligation to respond to complaints in an appropriate manner and in respect of the applicable law or rules. Fulfilling this obligation cannot be held to be incompatible with an undertaking to enforce Articles 25 and 26 in an even-handed manner. It is also useful to recall in this regard that under Community law non-compliance with the law by one entity cannot be accepted as legitimate defence for non-compliance by another entity⁽²⁾.
 

¹ ECJ ruling …./.. Überschär
² Cases 52/75, 78/76, 232/78, 325/82 and 38/89