minimum threshold of protection to interpret corresponding rights in the Charter, i.e. to the extent that the Charter, as interpreted by the CJEU, does not provide for a higher level of protection 75 . 151. The EDPB notes that, while prior (independent) approval of surveillance measures is deemed an important safeguard against arbitrariness, such approval cannot be derived from the jurisprudence of the CJEU as an absolute requirement for the proportionality of surveillance measures. However, the ECtHR has now explicitly established the requirement of ex ante independent authorisation for bulk interception76 . While the draft decision does not explicitly say so, the EDPB understands that the legal framework of the Republic of Korea does not provide for bulk interception but only for targeted interception of telecommunications77 . The European Commission has confirmed this understanding. 152. That being said, the above-mentioned decisions of the ECtHR, in line with the case law of the CJEU78 and previous case law of the ECtHR 79 , once again show the importance of comprehensive supervision by independent supervisory authorities. The EDPB emphasizes that independent oversight at all stages of the process of government access for law enforcement and national security purposes is an important safeguard against arbitrary surveillance measures and thus for the assessment of an adequate level of data protection. The guarantee of independence of the supervisory authorities within the meaning of Article 8(3) of the Charter is intended to ensure effective and reliable monitoring of compliance with the rules on the protection of individuals with regard to the processing of personal data. This applies in particular in circumstances where, due to the nature of secret surveillance, the individual is prevented from seeking review or from taking a direct part in any review proceedings prior or during the execution of the surveillance measure. 153. The lack of prior independent approval cannot in itself be considered as a substantial shortcoming in Korean law with respect to the assessment of an essentially equivalent level of data protection. The assessment of adequacy depends, again, on all the circumstances of the case, in particular on the effectiveness of ex post oversight and legal redress as provided for in the legal framework of Korea (see further sections 4.7 and 4.8).
4.4 Voluntary disclosures 154. According to Article 83(3) TBA, telecommunication service providers may voluntarily hand over socalled “subscriber data”80 to national security and law enforcement authorities upon request. While the EDPB notes that cases involving personal data that have been transferred from the EEA to Korea are likely to be rare, they still need to be analysed in order to assess the level of data protection, as already mentioned above.
75
See CJEU, joined cases C-511/18, C-512/18 and C-520/18, La Quadrature du Net and others, 6 October 2020, para. 124. 76 See ECtHR, Big Brother Watch and others v. UK, 25 May 2021, ECLI:CE:ECHR:2021:0525JUD005817013, para. 351: “Bulk interception should be subject to independent authorization at the outset”, “bulk interception should be authorized by an independent body; that is, a body which is independent of the executive”. 77 Only Annex II, section 3.2 contains an explicit declaration for national security purposes when it is specified that the limitations and safeguards “ensure that the collection and processing of information is limited to what is strictly necessary to achieve a legitimate objective. This excludes any mass and indiscriminate collection of personal information for national security purposes”. 78 See, for example, CJEU joined cases C-203/15 and C-698/15, Tele2 Sverige AB and others, ECLI:EU:C:2016:970. 79 See, for example, ECtHR, Case of Roman Zakharov v. Russia, 4 December 2015, ECLI:CE:ECHR:2015:1204JUD004714306. 80 Concerned datasets would be: the name, resident registration number, address and phone number of users, the dates on which users subscribe or terminate their subscription as well as user identification codes (used to identify the rightful user of computer systems or communication networks).
Adopted
32
