Follow-up reply from the European Ombudsman to Commissioner Jourová on the use of the title 'Ombudsperson' in the EU-US Privacy Shield agreement
Correspondence - Date Monday | 02 May 2016
Case SI/4/2016/EA - Opened on Monday | 22 February 2016 - Decision on Thursday | 06 October 2016 - Institution concerned European Commission
Ms Vĕra Jourová
Commissioner responsible for Justice, Consumers and Gender Equality
Re: Use of the title 'Ombudsperson' in the EU-US Privacy Shield agreement
Dear Commissioner Jourová,
Thank you for your response of 11 April 2016 to my letter of 22 February 2016, the purpose of which was to obtain information on the proposed use of the term 'Ombudsman' in the EU-US Privacy Shield agreement. Specifically, I asked how the impartiality and independence which form an essential part of an Ombudsman institution can be reconciled with the fact that the office foreseen in the agreement would be part of a government department that supervises government agencies.
Please note that my primary concern is to seek to ensure that the term 'Ombudsman' is not used by bodies that do not enjoy the requisite standard of independence for fear that this would jeopardise the public’s trust in the institution. While it is not yet the case at the EU level, you may be aware that the term 'ombudsman' enjoys legal protection in certain EU Member States, such as Denmark and Ireland, as well as in other countries such as New Zealand.
I note from your response that the Commission acknowledges that the Ombudsperson mechanism foreseen in the agreement may differ in a number of aspects from an Ombudsman as defined by the International Ombudsman Institute. In your view “this is explained by the specific purposes of the mechanism, and the particularly sensitive context of national security“. Be that as it may, it calls for further reflection on the appropriateness of using the term 'Ombudsperson'.
My services have now examined the Commission’s draft adequacy decision (hereafter, the Decision) and, in particular, Annex III containing details on the 'Ombudsperson Mechanism Regarding Signals Intelligence'. The new complaint-handling position within the Department of State will be assumed by the Under Secretary of State, who also serves as Senior Coordinator for International Information Technology Diplomacy. According to Article 1 of Annex III, the Senior Coordinator will serve as the Privacy Shield Ombudsperson and designate additional State Department officials, as appropriate, to assist her in the performance of her responsibilities. It is further specified that the Under Secretary is independent from the US intelligence community and reports directly to the Secretary of State.
Article 8 of the EU Charter identifies the essential elements of the fundamental right to the protection of one's personal data and, in its third paragraph, stipulates that "[c]ompliance with these rules shall be subject to control by an independent authority." The Court of Justice of the European Union has held in relation to national data protection authorities established under Directive 95/46/EC that: “In relation to a public body, the term ‘independence’ normally means a status which ensures that the body concerned can act completely freely, without taking any instructions or being put under any pressure”. In its recent opinion on the Decision, the Article 29 Data Protection Working Party (WP29) expressed concern that this new institution is not “sufficiently independent and is not vested with adequate power to effectively exercise its duty and does not guarantee a satisfactory remedy in case of disagreement”. Against this background, please allow me to make some additional remarks in relation to the features of the Ombudsperson Mechanism, drawing in part on the recent WP29 Opinion:
First, the proposed Ombudsperson serves as both Senior Coordinator and Under Secretary of State. From the wording of the Decision, it is not clear whether it is always the case that the two positions coincide. If not, it is unclear by which of the two designated officials the Ombudsperson position will be assumed in the future if either of them.
Second, the experience and qualifications required to be considered for appointment as Under Secretary/Senior Coordinator may not necessarily align with those required to serve as Ombudsperson. The Decision does not contain any procedural rules aimed at preventing conflicts of interest as regards selecting and appointing the Ombudsperson. It would be useful to provide for the necessary safeguards in this regard, notably that an assessment of conflict of interest be carried out prior to nominating officials to the position of Ombudsperson.
Third, the Decision does not contain specific provisions on the Ombudsperson's dismissal. As outlined in the aforementioned WP29 Opinion, it might thus be understood that the Ombudsperson can be dismissed from his/her role in the same way that (s)he can be dismissed in his/her role of Under Secretary, thus potentially undermining the body's independence.
Fourth, Article 3 of the Decision notes that the Ombudsperson will work closely with other US Government officials, including appropriate independent oversight bodies, to ensure that requests are processed and resolved in accordance with applicable laws and policies. In particular, the Ombudsperson will coordinate closely with the Office of the Director of National Intelligence, the Department of Justice, and other departments and agencies involved in US national security as appropriate, as well as Inspectors General, Freedom of Information Act Officers, and Civil Liberties and Privacy Officers. This provision does not outline in any detail under which framework and for which purposes this close coordination will take place. For example, there is no clarity as regards sharing of responsibilities and of the investigative powers in the context of that coordination.
Finally, despite the fact that the Ombudsperson will be functionally independent from the US intelligence community, the Department of State, within which it will operate, is an executive department responsible for US foreign policy. This department makes use of intelligence provided by the US intelligence community. Given that fact and the Ombudsperson’s obligation to report to the Secretary of State, it could be argued that this does not provide for the necessary distance from the intelligence community that is required for the body to act in an independent manner.
The above points reflect my concerns on this matter, specifically as regards the use of the term Ombudsman/Ombudsperson and I thank you once again for considering them.
 Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, OJ L 281 , 23/11/1995 p. 31.
 Judgment of the Court of 9 March 2010 in case C‑518/07, Commission v Germany, (2010) ECR I-1885, para 18.
 Article 29 Data Protection Working Party, Opinion 01/2016 on the EU-US Privacy Shield draft adequacy decision, adopted on 13 April 2016, http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2016/wp238_en.pdf