The balancing of rights and freedoms is one of the great innovations of the EU General Data Protection Regulation (GDPR) but one of the great challenges as well.  The Charter of Fundamental Rights of the European Union recognizes fifty political, social and economic rights for the people of Europe.   Recital 4 of the GDPR states that the right to the protection of personal data should be balanced against other fundamental rights, and the Court of Justice of the European Union (“CJEU”) has stated that national authorities and courts should consider a fuller range of rights. Past IAF publications have suggested processes that balance the numerous risks and benefits to people associated with a decision to process or not process personal data, and this balancing should weigh the risks and benefits against each other based on the likelihood of each of the risks taking place and the magnitude of each particular risk.  The same risk management approach should be used when a decision to transfer or not transfer data to a third-party jurisdiction takes place.  The decision by the CJEU in Schrems II and the EDPB draft Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data (Draft EDPB Guidance) provide an opportunity for the IAF to look at this balancing in detail as it relates to the full range of fundamental rights and freedoms.  Specifically, the IAF looked at the transfer of human resources data from the EU to a third country and the risk to employees if such data were not transferred.  More specifically, the IAF looked at the risk to the right to protection of personal data, Article 8 of the Charter of Fundamental Rights of the European Union, and to the freedom to choose an occupation and the right to engage in work, Article 15.  The team, Nancy Lowrance and Lynn Goldstein, interviewed a group of companies about their human resource processes and how they would be impacted if transfers from the EU were limited.  They then conducted a policy analysis where numerous individual rights and freedoms were balanced.  That research may be found in “Addressing Human Resources Data Flows in Light of European Data Protection Board Recommendations.”  

While the research paper focused on Schrems II and the Draft EDPB Guidance, the same analysis is relevant to other national and draft provincial laws that require adequacy.  This analysis also begins to illuminate that policy discussants need a new vocabulary for framing the balancing of rights and freedoms.  For example, the term proportionality suggests a balancing of two factors against each other.  Issues, such as vaccination passports, will involve numerous fundamental rights and freedoms across many different stakeholders, and the term proportionality will not work for that multi-factor analysis.  A future IAF paper will explore that issue. 

Please let us know what you think by email Martin Abrams at mabrams@informationaccountability.org.