法律翻译 | 欧盟和美国就执法部门获取数据的谈判：分歧、挑战以及欧盟法律程序和选择（上）

公众号新闻

2023-06-09 04:06

译者 | 巩海璐华东政法大学硕士

审稿 | 左亦惟中南财经政法大学LL.B.

陈飞越爱丁堡LL.M.

编辑 | 李薇浙江工商大学本科

李建云湖南师范大学本科

责编 | 王有蓉中国政法大学硕士

CHINA AMERICA LAW REVIEW

欧盟和美国就执法部门获取数据的谈判：分歧、挑战以及欧盟法律程序和选择

作者：西奥多·克里斯塔基斯（Theodore Christakis）

法比恩·特潘（Fabien Terpan）

要点

①欧盟和美国于2019年9月开启一系列谈判，就执法机构（Law Enforcement Agents，简称LEAs）获取数据达成一项非常重要的协定。本文首次介绍了这些谈判的背景及谈判所涉的诸多挑战。

②欧盟和美国在协定范围和架构上存在很大分歧。按照《云法案》（Cloud Act）的要求，美国政府支持先与欧盟达成“框架性协定”，随后再与各欧盟成员国达成双边协定。欧盟则希望双方达成一项独立的、覆盖全欧的全面协定，反对可能导致欧盟成员国之间出现分裂和不平等待遇的解决方案。

③本文详细阐述了欧盟对所有这些问题的法律观点，并提到了关乎执法协定、数据相关协定等其他国际协定达成的相关先例。本文讨论了欧盟及其成员国之间关于电子证据的权限划分问题、欧盟法律下可能存在的协定架构和选择、以及各欧洲机构（欧盟委员会、欧盟理事会、欧洲议会）在谈判和缔结此类协定方面所发挥的作用。

④本文利用现有判例法，研究了欧盟法院（Court of Justice of the European Union，以下简称为CJEU）在该欧美电子证据协定缔结过程中可能会发挥的作用。

⑤本文附言部分探讨了欧盟法院在2020年7月16日对施雷姆斯II案所作判决【即数据保护专员诉脸书爱尔兰有限公司（Facebook Ireland Limited）和麦克斯·施姆雷斯（Max Schrems）案，以下简称“Schrems II 案”】对正在进行的欧美谈判所造成的影响，并探讨了欧盟法院对数据保留/收集所作判决（2020.10.6）的相关性。

⑥本文对任何关心跨大西洋数据流动和司法合作事项的人员都具有实用价值。此外，本文还可作为在国际数据相关协定缔结方面，欧盟法律程序、所作选择以及可遵循之先例的真正“指南”。

一、引言

二、背景介绍

三、管辖权限问题

四、可能的协定框架

五、欧盟对国际协定的通过：一个包含多阶段、多参与主体的过程

六、欧盟法院的最终作用

七、结论

引言

2019年9月25日。欧盟（European Union）和美国官员正式开启谈判，旨在就跨境获取电子证据用于刑事司法互助方面达成一项非常重要的跨大西洋协定[1] 迄今为止，双方已分别于2019年11月6日、2019年12月10日、2020年3月3日进行了三轮谈判。在之后，正式谈判虽然因新冠疫情危机暂时搁置，但预计会尽快得以恢复。

令人惊讶的是，尽管这些谈判很重要，但这方面的学术文章却为数不多。据我们所知，只有早在谈判开始前发布的那两篇文章。

第一篇是由珍妮弗·达斯卡尔（Jennifer Daskal）和皮特·史威尔（Peter Swire）于2018年5月在Lawfare[2]（译者注：布鲁金斯学会讨论国家安全议题的博客）上发表的短篇论文。该论文认为签订欧美协定这个想法不错，解释了《云法案》[3] 第二部分是如何推动电子证据行政协定缔结的，并提出要把“框架性协定（framework agreement）”的缔结作为欧美谈判的可能性解决方案和架构。

第二篇是皮特·史威尔在2019年4月跨境数据论坛[4]（Cross Border Data Forum）上发表的文章。史威尔试图在文中阐明，根据美国法律，申诉方在《云法案》框架内外的运作意味着什么，特别是对非美方的申诉方来说意味着什么？他从美国法律的角度，提出了欧美协定框架的不同可能。同时，他强调，写这篇文章并非为了说明“何种法律文件是合适的”，而是为了明确说明在《云法案》行政协定框架内外可以做些什么。

本研究目的在于，针对以上所有问题提出欧盟法律视角的观点，以更好地理解欧美执法机构数据获取协定的体系限制性和可能性。欧盟法律（包括欧盟对外关系法）十分复杂，且对于欧洲或国际申诉方来说，解开这些复杂难题进而提出针对欧美电子证据获取协定的欧盟机制、程序以及要求是有必要的。我们写这篇文章不是为了说明何种法律文件是合适的，而是为了从欧盟法律的角度，明确说明有哪些可能的框架选择，以及欧美电子证据协定可能会面临哪些挑战。

达斯卡尔和史威尔引发的这一讨论在本文中得以继续，且在本文占有重要部分。欧美协定在预期框架的选择上存在重大分歧。迄今为止，四次谈判会议集中讨论了实质性领域（严格来说，本文不会讨论这些领域）[5]，而非讨论了协定所采取的法律形式。如果谈判恢复，欧美双方打算继续讨论协定的实质性问题而非形式和框架。这一谈判策略无疑是明智的，但实质性问题与形式及框架问题密切相关。实际上，该数据协定在内容上是否会有很大不同，这取决于它所达成的形式是双边都要遵守的“框架性协定”，还是全面自主的协定。与这些方面有关的分歧偶尔会在新闻报导中出现。[6] 因此，我们认为有必要探讨欧美协定下的可能选择，进而我们需要明确欧美各自法律项下的程序、要求和可能性。

为此，我们要重新讨论欧盟作为外部参与主体[7]（译者注：外部参与主体，或外部行为者（external actor）的广义定义是：具有共同利益，为共同目标而行动的集体，主要位于该主体意在影响的领土之外）的具体权力。目前欧盟的确是国际关系上成熟的参与主体，但其确立该等地位并非易事。欧盟作为法律实体的特殊性会催生出法律问题。在对外关系领域，有三个主要特点来区分欧盟和国家主体。其一，与联邦政府享有绝大多数对外管辖权的联邦国家不同，欧盟对外管辖权由欧盟和成员国共同享有。其二，欧盟谈判和缔结国际协定的方式与国家主体不同，欧盟成员国在谈判和缔结协定过程中所起作用的性质是多变的。其三，欧盟司法体系也相当独特。其中，欧洲法院就像一个准宪法法院，试图在国际法的遵守和欧洲法律秩序的自主权之间取得平衡。这三大特点可以作为框架来分析有关欧美执法机构数据获取的谈判。

本文“背景介绍（Setting the Scene）”一节对之前的欧美执法协定进行了说明，介绍了当前欧美数据获取谈判的背景，解释了有必要缔结新跨大西洋协定的原因，展现了欧美双方在协定架构上存在的分歧。

本文“管辖权问题（Issues of Competence）”一节聚焦欧盟法律中的管辖权问题，解释了欧盟及其成员国之间在电子证据上的权限划分，以及跨大西洋谈判所带来的后果。

本文“可能的协定框架（Potential Agreement Structures）”一节提出了欧盟法律项下欧美执法部门数据获取协定的潜在性框架，该节基于先前对管辖权限共享的分析。

本文“欧盟通过国际协定：多阶段、多参与主体的过程（Adoption of International Agreements by the EU: A Multi-Stage/Multi-Actor Process）”一节解释了欧盟法律下该跨大西洋协定的谈判程序和缔结程序。该部分尤其关注欧盟各机构（欧盟委员会、欧盟理事会、欧洲议会）在该过程中所发挥的作用，尤其关注这些机构如何影响谈判过程以及缔结协定的投票权或决策权。

本文“欧盟法院的最终作用（The Eventual Role of the CJEU）”一节考查了欧盟法院在缔结该欧美数据协定方面可能会发挥的最终作用。事实上，有学者多次表示，欧美协定可能会面临欧盟法院的司法审查。这是怎么发生（或不发生）的？又有什么不同的先例和情况？

本文结尾提出了对欧美协定未来走向的设想。结尾附言部分简单讨论了本文发布之后，欧盟法院在2020年7月16日对施雷姆斯II案【数据保护专员诉脸书爱尔兰有限公司（Facebook Ireland Limited）和麦克斯·施姆雷斯（Maximillian Schrems）案C-311/18，以下简称“Schrems II 案”】作出的裁决。

背景介绍

迄今为止，欧美之间至少已经达成八项重要的执法协定。这表明过去20年里，在这些议题上的跨大西洋合作已取得丰硕成果。尽管已经有了重要的现存成果，但随着时间经过，新的需求已经出现；尽管谈判双方最初在该协定目标的精准确定和框架设计上存在分歧，但就跨境电子证据获取协定方面的谈判已被视为十分重要的事项。

（一）现存的欧美执法协定

2001年9·11恐怖袭击事件之后，欧盟和美国已就执法方面谈判多次。以下是其中达成的八项协定[9]：

1.美国和欧洲刑警组织（Europol）[10] 在2001年缔结了协定，旨在加强欧盟成员国和美国之间在预防、侦查、镇压、调查重大国际犯罪方面的合作，尤其是通过战略和技术信息的交换。

2.2002年美国和欧洲刑警组织达成了有关个人数据及相关信息交换的补充协定（Supplemental Agreement between Europol and the USA on the Exchange of Personal Data and Related Information），提出了许多之前美方未承认的数据保护措施。

3. 《欧盟和美国引渡协定》（Agreement on Extradition between the EU and the USA，以下简称“欧美引渡协定”）签署于2003年6月25日，2010年2月生效，旨在加强欧盟成员国和美国之间可适用的罪犯引渡关系的合作，以此取代“双重犯罪标准”（a dual criminality standard）下，被视为“可引渡的”罪行名单。

4. 《欧盟和美国双边法律互助协定》（Agreement on mutual legal assistance between the EU and the USA，以下简称“MLA”）签署和生效的日期和欧美引渡协定相同。MLA规定了欧美开展双边刑事法律互助合作的条件，进而补充欧盟各成员国和美国之间的双边条约。

5. 2006年11月6日，美国和欧检署（Eurojust）签订了协定，旨在加强欧检署和美国之间在打击包括恐怖主义在内的严重跨国犯罪方面的合作。

6. 为了开展恐怖主义融资追踪计划（Terrorist Finance Tracking Program，以下简称TFTP），2009年11月20日，美国和欧盟签订了金融信息数据处理和交换协定（Agreement between the EU and the USA on the processing and Transfer of Financial Messaging data from the EU to the US）。该协定下，通过国际资金清算系统SWIFT，欧盟对国际银行数据的交换进行整理，并将其传送给美国反恐机构。该协定同时还试图保护欧盟公民的隐私，尤其是通过评估在任何特定情况下所要求的数据是否会打击恐怖主义和恐怖主义融资。

7.2011年12月4日，美国和欧盟签订了乘客订座记录数据使用和交换协定（Agreement between the USA and the EU on the use and transfer of Passenger Name Record Data，以下简称EU-US PNR）。该协定规定，欧盟成员国需向美国国土安全部（the US Department of Homeland Security）传送航空公司的乘客订座记录信息（Passenger name records，以下简称PNR），以确保国土安全、保障公众生活和安全。

8.2016年6月2日，美国和欧盟签订了关于刑事犯罪的预防、调查、侦查和起诉有关的个人信息保护协定，也就是人们更为熟知的“伞协定（Umbrella Agreement）”。该协定旨在确保执法机构（警察和刑事司法机构）在传输个人数据时，可以做到对数据的高标准保护。该协定还旨在推动欧盟及其成员国和美国之间的执法合作。

（图片来源于网络）

欧美之间达成了众多重要的已生效协定，这促使有些学者注意到“该领域可以说是欧美合作最活跃的领域之一”。[11] 尽管关于执法议题上的跨大西洋合作已经相对成熟，但其中一些协定在达成方面耗时长或具有争议，致使学者、非政府组织（NGOs）[12]甚至以及欧洲数据保护专员（the European Data Protection Supervisor，以下简称EDPS）都对此表示批判。[13]

尽管如此，欧盟和美国一直认为有必要继续展开新的谈判，以扩大执法数据跨大西洋合作的范围并提高该等合作的质量。例如，2011年，欧盟和美国开始谈判，旨在为欧美执法合作建立一个全面且高级的数据保护框架。谈判的结果是2016年的“伞协定”，这一协定旨在为数据传输的合法性提供保障和保证，确保所有欧盟公民，无论是否居住在美国，都有权在美国法院行使数据保护权利。

就在最近，达成电子证据跨境获取方面的跨大西洋协定也被提上议程并且已刻不容缓。

（二）欧美电子证据跨境获取协定的需求

有学者指出，“对普通刑事调查至关重要的证据日益跨越领土边界而存在。云计算兴起之前，犯罪证据通常是在犯罪所在国的领土管辖范围内获得的。如今，邮件、社交网络帖子等内容通常储存在他国。[14] 欧盟委员会（the European Commission）2018年的报告[15]发现，约85%的刑事调查需要电子证据，其中2/3的调查需要从另一个司法管辖区的线上服务供应商处获取证据。

犯罪证据的全球化给执法部门带来了重大挑战。人们普遍认为，司法协助条约（Mutual Legal Assistance Treaties，以下简称MLAT）等传统的跨境机制过于缓慢且繁琐。为应对这一情况，世界各国正在签署新的法律和法律文件。

美国国会于2018年3月发布了《云法案》（Cloud Act）。法案第一部分表示待决的“美国最高法院诉微软”[16] 一案已无实际意义，无论案件所涉通信、记录还是其他信息在美国境内还是境外，该案所争议的强制性披露指令均可适用。法案第二部分创设了新机制使他国可从美国服务供应商处获取通信内容。这让美国能够与特定“适合的”外国政府达成“行政协定”，在符合一系列基本实质性和程序性的要求下，允许撤销《电子通信隐私法案》（Electronic Communications Privacy Act，以下简称ECPA）所推行的阻断条款（blocking provisions），使这些国家的执法机构能够直接从服务供应商处请求获取非美国公民和居民的通信内容。[17]

就在几周后即4月17日，欧盟委员会推出了“电子证据（E-Evidence）”这一立法计划[18]，旨在简化欧盟内部和服务供应商的合作，以向执法机构和司法机构提供获取电子证据的快速工具。欧洲理事会（European Council）于同年12月通过了该电子证据草案[19]，欧洲议会公民自由、司法与内政委员会（European Parliament's Committee on Civil Liberties, Justice, and Home Affairs，简称LIBE Committee）的特派调查员，比尔基特·西普尔（Birgit Sippel）于2019年11月把这项草案报告提交到欧洲议会。[20]由于新冠疫情和封闭管理政策，欧洲议会（European Parliament）对该草案的讨论暂缓，但很快就会恢复。我们将在2021年上半年见证上述三方会谈的进行。

与草案订立背景相违背的是，欧盟和美国认为可以直接启动对跨大西洋协定的谈判，不用等待“电子证据”通过。实际上，尽管欧盟委员会和理事会多次强调，只有在通过“电子证据”后才能实现欧美协定的定案和通过[21]，但他们认为节省时间，提前开始谈判同样重要。2019年6月，司法与内政委员会（Justice and Home Affairs Council）通过了授权谈判开始的决议[22]，并下达了谈判指令，认定欧盟委员会代表欧盟谈判[23]。

请求谈判授权的《欧盟委员会至理事会之备忘录》（the Commission’s Memorandum to the Council）详细解释了促使欧美双方在新跨大西洋协定发起谈判的原因[24]。显然，在所叙述的原因中，“避免欧美双方之间的义务冲突（conflicting obligations）”这一原因最重要[25]。

在（欧美电子证据跨境获取）领域的法律义务冲突所带来的风险有两方面。

一方面，正如之前所提到的，《储存通信法案》（Stored Communications Act，简称SCA）和《电子通信隐私法案》（ECPA）规定，美国公司禁止直接向外国政府泄漏内容数据（content data），但可自愿向其提供非内容数据（non-content data）。由于主要的美国通信服务供应商（US Communication Service Providers，简称CSPs）通常掌握欧洲刑事调查的大多关键性证据，因此这给欧洲执法机构造成了困难。已经提出的“电子证据”规章旨在授权欧洲执法机构直接从CSPs处请求获取内容和非内容数据，无论此类数据是否在欧洲境内。这只会加重法律冲突的风险。欧美协定（不管是否基于《云法案》）有可能会解决这个问题，通过允许美国服务供应商直接向欧洲执法机构提交内容数据，最小化甚至消除法律冲突。

另一方面，《云法案》第一部分内容授权美国执法机构从CSPs处请求获取相关的刑事调查数据，不管此类通信、记录或其他信息是否被定位在在美国境内，这一要求在一些情况下可能会与欧洲现行法律（包括《通用数据保护条例》，简称为GDPR[26]），以及“国家阻断法律（national blocking statutes）”）产生冲突，尤其是在请求关乎欧洲个人数据时。欧洲数据保护委员会（the European Data Protection Board，简称为EDPB）和欧洲数据保护专员（EDPS）对这一问题立场一致，法学学者[27]也已对这一问题进行了分析。[28]

（图片来源于网络）

因此，欧美协定的缔结似乎是解决欧盟及其成员国、美国和欧美通信服务供应商之间法律冲突问题的唯一办法。欧盟委员会指出[29]，欧美协定也会带来许多实际好处，例如，该协定改善了司法机构及时获取数据的情况，阐明了对服务供应商相互约束的属性及其执行指令，也明确了司法机构的义务。

（三）欧盟和美国在本协定架构上的分歧

尽管欧美双方均认可欧美协定的重要性，但两方对协定的范围[30]和框架仍存在严重分歧。

对美方来说，本协定的框架应考虑《云法案》中所列明的重要要求和限制。

首先，《云法案》仅授权与外国政府达成行政协定。对于美国是否可以和欧盟达成“云法案协定”，以及在何种情况下达成，还尚不清楚。

其次，最重要的是，《云法案》要求每个外国政府都要接受来自美国司法部长（the Attorney General）和美国国务卿（the Secretary of State）的一致确认，确定外国政府能够在其“国内法律”中为隐私和公民自由提供“强有力的实质性和程序性保护”，以及能够满足其他多项要求。正如达斯卡尔和史威尔所阐释的那样，“这一要求最起码表明美国必须要对与其缔结协定的每个成员国的国内法律体系或子体系进行审查、分析和调查。目前尚无可以绕过这一要求且令人信服的法律解读。”

为解决这一问题，达斯卡尔和史威尔设想了两种选择。其一，欧盟和美国缔结一项《云法案》之外的协定，但这需要考虑到美国宪法性法律[31]对条约规定的限制和批准过程。其二，欧盟和美国缔结一项“云法案行政协定”，该行政协定可能会极大促进和加快欧美协定的生效。但在此情况下，唯一的解决办法是缔结一项“框架性协定”，这一“框架性协定”会制定一系列适用于美国和欧盟成员国之间关系的规则和程序，但若未与特定成员国签订附加协定，这些规则和程序则不能独立存在。达斯卡尔和史威尔没有明确表明其所设想的欧美“框架性协定”是双边协定，比如“双边法律互助协定”或“引渡协定”，还是只包括欧盟及其（被美国鉴定为“合格的”）成员国在内的单一复杂文件。然而，他们似乎倾向于后一选择，因其表示，“‘框架性协定’的优点是让美国达成一项总协定，进而各欧盟成员国都可以各自遵守该总协定”[32]。这一观点还进一步得以强化，因为史威尔还提到“如果在欧盟一层进行谈判，则还需要经过其他步骤才能获得欧盟各成员国的批准”。[33] 对他们来说，建立能够让美国对各欧盟成员国进行单独资格认证的框架，这十分重要。

“框架性协定”这一方案已经被美国代表团所采用。2019年9月谈判开幕时，美国就明确表示，其目标是要与各欧盟成员国达成一项双边协定补充之下的“框架性协定”。[34]

就在最近，美国司法部副总检察长理查德·唐宁（Richard Downing）表示，他确实因为《云法案》的要求而质疑欧美协定的可行性。他强调，美国司法体系下，各外国合作方须事先遵守《云法案》所规定的标准和规则。他说：“这些标准很难达到。对世界上有些国家来说，我们并不期待其可以尽快签署其中一项协定，因为其对法治、隐私和公民自由的尊重水平与我们不等同”。他最后还提及一些欧洲国家的法治问题是美国所关切的。[35]他说：“我不确定是否可以达成一项对欧盟各成员国均有效的单一性协定，但我们或许可以先达成一项在欧盟层面的‘框架性协定’以解决部分问题，然后再和欧盟成员国各自达成协定以解决其他问题。”他还把欧美MLA和MLATs作为先例提及。[36]

在这一背景下，欧盟希望达成一项独立的、覆盖全欧洲的整体性协定。[37]在谈判开幕时，欧盟就强调了这一点，并称“欧盟拥有缔结一项全欧洲范围的协定的授权令”。欧盟委员会也多次强调，“为避免欧盟各成员国和美国之间出现分裂和不同程度的保护，美国、第三国和一些欧盟成员国之间应该采用一种通用的欧盟式方法，而非签订双边协定。[38]

作为政策问题，正如谈判授权令所表明的那样[39]，欧盟认为很难和第三国开展会产生法律制度的进程，因为该制度下，各欧盟成员国会遭到不平等的对待。欧盟担心，这会导致“无签证计划”（the Visa Waiver Program，简称为VWP）[40] 类似情况的再现，欧盟内部对该计划持反对态度。实际上，“签证互惠”（visa reciprocity）是欧盟通用签证政策的基本原则，也是欧盟和非欧盟国家积极追求的目标。这一原则意味着，欧盟在决定对非欧盟国家公民取消签证要求时，要考虑非欧盟国家是否也对各欧盟成员国的国民提供互惠性的免签证服务。2014年4月，欧盟委员会发现，美国、澳大利亚、文莱、加拿大和日本都没有像欧盟向他们的公民所提供的那样，实现欧盟成员国公民所应享有的免签证权利。于是，欧盟委员会为这些国家设定两年期限。若两年后无改进，欧盟委员会将采取严厉的应对措施。从此之后，澳大利亚、文莱、加拿大和日本均取消了对欧盟成员国公民的签证要求，但美国仍未实现。美国国务院领事事务局（State Department’s Bureau of Consular Affairs）之前曾说，保加利亚、克罗地亚、塞浦路斯、波兰和罗马尼亚也没有实现美国“免签证计划”所规定的安全要求。为此，2017欧洲议会[41] 决议要求不再对美国公民进行签证[42] 豁免。这一提议最终遭到拒绝[43] ，美欧之间仍未实现签证互惠。欧盟自然不想再现这一局面，也不想再依赖美国对电子证据的单一认证。这可能就是欧洲议会提议在《云法案》框架之外进行协定谈判的原因。[45]

因此，在双方提出各自的政策愿景之后，让我们立刻转向欧盟法律，讨论在其之下有哪些可能性，以及这些愿景是如何在实践中得以实现的。

管辖权限问题

正如达斯卡尔和史威尔所指出的，对于欧盟是否以及在何种程度上能够成为和美国谈判“云法案行政协定”的缔约方这一问题，欧盟法律有其自身的复杂性。[46] 实际上，欧盟尽管享有国际法律人格，但其成员国在一些领域上仍会自己作出国际承诺。因此，有必要先就欧盟及其成员国各自所承担的角色提出一些意见。尽管欧盟及其成员国共享在自由、安全和司法领域（Area of Freedom, Security and Justice，简称为AFSJ）上的管辖权，但除此之外，一旦欧盟行使其欧盟层面上的管辖权，各成员国本身所享有的权限，比如同时与美国签订双边协定的权力，则是有限的。

（一）共享管辖权限

在就电子证据问题达成国际协定这一领域，欧盟的法律行为能力可能直接源自《欧盟条约》（the European Union Union Treaty，简称为TEU）中的发展合作、商业政策、人道主义援助等领域，共同外交与安全政策（the Common Foreign and Security Policy）在欧盟基本法中有具体的法律依据。但在许多情况下，正如欧洲法院在其早期判例法中所主张的那样，欧盟对外的能力映射出了其对内的能力。[47]

电子证据是欧盟及其成员国共享管辖权的自由、安全和司法领域中的一部分。欧盟委员会2018年4月签发的与电子证据有关的法规提议是以《欧盟运作条约》（Treaty on the Functioning of the European Union，简称为TFEU[48] ）（司法合作）的第82条为基础的，据此，根据惯常的立法程序可采取措施来制定规则和程序，以确保在整个欧盟承认各种形式的判决和司法决定。因该提议关乎需要统一规定的跨境程序，也就没有必要赋予各成员国撤销此类规则的能力，故欧盟选择发布法规（regulation）而非指令（direcrtive）[49] 。因此，欧盟已经开始运用其在电子证据领域特有的管辖权，这相应也会对欧盟及其成员国在此领域进行外部干预的方式产生直接影响。

（二）但当欧盟开始着手这一问题时，其成员国采取行动的能力有限

欧盟对刑事问题无专属管辖权，故从理论上讲，美国和欧盟成员国之间的双边协定，甚至是混合协定，都是有可能实现的。然而，根据欧盟法律，成员国的对外管辖权会因一些原因受限。

首先，欧盟有资格派欧盟委员会代表其就电子证据和美国签署覆盖全欧的协定，无需各成员国直接参与。就像欧美MLA协定达成的方式一样[50] ，电子证据协定也将由欧盟以同样的方式来达成，且不应被视为混合协定[51] ，混合协定中，欧盟及其成员国（起码有部分成员国）都是缔约方。

欧盟委员会通过解决欧盟内外的法律冲突来处理电子证据。对欧盟来说，很有必要采取有关电子证据跨境获取的通用规则，也很有必要在欧盟内部以及第三国之间采用通用的手段和法律体系。由于多数通信服务供应商（CSPs）都在美国，美国是极为重要的合作方，所以欧盟选择先与美国达成一致。欧美谈判的关注点不仅仅在刑事问题合作，与此同时还有数据保护问题，当认识到这一点时，采取通用规则的意愿则尤为迫切。[52]

因此，通过对电子证据立法，欧盟已经提升了其在国际层面作出承诺的能力。正如TFEU第3(2)条所言，“如果国际协定的缔结是欧盟的立法法案所规定的，或者是欧盟行使其内部管辖权所必需的，或其缔结可能会影响通用规则或改变其范围，则欧盟在国际协定的缔结上应享有专属权。”既然欧盟法规有意涵盖关于电子证据的内容，那么这便意味着欧盟将利用其在该领域的专属管辖权，与美国签订电子证据协定，成员国的缔结权则受限。[53]

欧盟立法的另一个后果是，各欧盟成员国和美国谈判双边协定时会出现问题，且谈判只能在遵守欧洲法律的情况下进行。这一阶段，我们必须区分两个主要时期，即法规生效前后和欧盟协定达成前后。

若成员国在电子证据法规生效前以及欧美谈判结束之前就和美国展开双边协定的谈判，则其会被视为违反了诚信合作原则（《欧盟条约》第4(3)条），该原则表示，“欧盟成员国应推动欧盟整体任务的进行，阻止任何可能有损于欧盟目标达成的任何举措”。[54] 正如埃克豪特（Eeckhout）总结的那样，“不得容忍欧盟成员国在欧盟谈判期间采取单方面订立条约的行动，除非欧盟成员国与欧盟，特别是与欧盟委员会进行了磋商和合作”。[55]在就对外协定进行谈判的过程中，欧盟制定法和欧盟法律的未来走向都要被考虑在内。[56]这会阻止成员国在欧盟委员会代表欧盟谈判的过程中，采取危及谈判过程的行动。

2019年7月，欧盟司法专员维拉·朱罗娃（Vera Jourova）敦促美国当局机构禁止同各欧盟成员国就双边协定展开谈判。[57]因此，若欧盟成员国采取了单方面行动，欧盟委员会则可采取行动，首先会向相关成员国致函。这一问题也会在部长级会议（the Council of ministers）上被讨论，甚至会在国家元首或政府首脑一级会议上（Head of state or government level）被提及。

如若欧盟成员国和美国不管不顾地签署了这样一项双边协定，欧盟委员会可以对该协定是否遵守了欧盟法律进行评估，特别是评估该协定是否遵守了《通用数据保护条例》（GDPR）和《欧洲基本权利宪章》（European Charter of Fundamental Rights），甚至决定是否启动侵权程序。这一问题提出时，英国还未脱离欧盟，而当时英国也根据《云法案》同美国签订了协定。[58]如若该双边协定达成，欧盟新司法部长雷恩德斯（Reynders）同意欧盟委员会可对其采取恰当的措施。他对欧洲议会议员（MEPs）莫里茨·科纳（Moritz Korner）和索菲亚·伊恩特维尔德（and Sophia In’t Veld）所提交的书面问题做出了答复确认。[59]

一旦法规生效、欧美协定达成，则可认为欧盟成员国已丧失了单独与美国谈判协定的权力。欧盟和成员国之间的共享管辖权在不断演变：欧盟所拥有的管辖权越多，各成员国自行采取行动的权力（无论是立法还是缔结国际协定）就越少。欧盟成员国与美国之间达成的协定可能会因管辖权和违反欧盟层面的法律（包括“欧盟电子证据法规”）而遭到质疑。

（图片来源于网络）

欧美协定达成之后，管辖权限问题会获得更大的关注。如果欧盟成员国和美国在缔结协定时可以考虑到欧盟法规和欧美协定，则他们可以根据欧盟层面的法律达成协定。换言之，欧盟成员国仍能够和美国在以下两种情况下达成协定：(i) 欧盟法律均不涵盖任何一方所谈判的领域；(ii) 欧盟法律涵盖双方谈判的领域，但条件是欧美协定对谈判领域进行了授权，且双方在授权范围内进行谈判，例如，我们现在看到的“引渡协定”和“法律互助协定”就是这种情况。

- 原文引用文献------------------------------------

*Theodore Christakis, Professor of Law, University Grenoble Alpes, Grenoble, France

*Fabien Terpan, Senior Lecturer in Law, Sciences Po Grenoble, University Grenoble Alpes, Grenoble, France

We would like to express our gratitude to all the colleagues who contrib- uted useful comments on previous versions of this article: Karine Bannelier, Paul James Cardwell, Elaine Fahey, Kenneth Propp, Peter Swire, Juan Santos Vara, Ramses Wessel. We would also like to warmly thank warmly the members of the European Commission’s Negotiating Team Peter-Jozsef Csonka, Mark-Stephen Gray and Tania Schroeter for their helpful comments and insights. We would finally like to thank the anonymous reviewers of the International Data Privacy Law as well as the Editors for their very useful comments and for permitting to improve and updateenabling the improvement and updating of the article. All errors are ours. This article covers developments till the 17th June 2020. The two post-scriptum cover developments till the 6th October 2020.

[1]The US Delegation included Deputy Assistant Attorney Generals from the Department of Justice, as well as other representatives of the US Department of Justice’s Office for International Affairs, the State Department and the US Mission to the EU. The Commission was repre- sented by Chief Negotiator Alexandra Jour-Schroeder, Deputy Chief Negotiator Peter Csonka and other members of the negotiating team from DG JUST and DG HOME. Representatives from the European External Action Service and European Union Delegation in Washington were also present.

[2]Jennifer Daskal and Peter Swire, ‘A Possible EU-US Agreement on Law Enforcement Access to Data?’ (Lawfare, 21 May 2018)accessed 10 October 2020.

[3]Clarifying Lawful Overseas Use of Data Act, [hereinafter CLOUD Act], contained in Consolidated Appropriations Act, 2018, PL 115-141, div. V.accessed 10 October 2020.

[4]Peter Swire, ‘EU and U.S. Negotiations on Cross-Border Data, Within and Outside of the CLOUD Act Framework’ (Cross Border Data Forum, 13 April 2019)accessed 10 October 2020.

[5]There are a lot of extremely important and challenging issues of substance in the EU–US negotiations. These include: the procedural and fundamental rights safeguards that should be introduced in the agreement in order to comply with European Human Rights Law (for instance: ensuring that data may not be requested for use in criminal proceedings that could lead to the death penalty); the willingness of the EU to introduce clauses in order to complement the Umbrella Agreement (see below the subsection ‘Existing EU–US law enforcement agreements’ (8)) with additional data protection safeguards; the determination of the EU to conclude an agreement that will be entirely reciprocal in terms of the rights and obligations of the parties and the categories of people whose data must not be sought pursuant to the agreement; and other issues. In this article we will not discuss these substantive issues, which deserve a separate article and analysis. We will only focus on problems of form, architecture, and procedure.

[6]See for instance ‘US Department of Justice has reservations about transatlantic agreement on access to electronic evidence’, Agence Europe, 21 November 2019.

[7]译者注：外部参与主体，或外部行为者（external actor）的广义定义是：具有共同利益，为共同目标而行动的集体，主要位于该主体意在影响的领土之外。参见Schmitt C . From Colonialism to International Aid External Actors and Social Protection in the Global South: External Actors and Social Protection in the Global South[J]. 2020.

[8]We refer here to binding international agreements under International Law and art 2(1)(a) of the Vienna Convention on the Law of Treaties between States and International Organizations or between International Organizations, Vienna, 21 March 1986, UN Doc A/CONF. 129/15, 25 ILM 543 (1986).

[9]One famous transatlantic instrument on cross border data issues was the EU–US Privacy Shield. However, it must be emphasized that Privacy Shield was neither related to law enforcement nor an international agreement (as defined in n 7). It was not a law enforcement instrument but instead was intended to offer protections in relation to government access to personal data transferred by companies to the USA for commercial purposes. And it was not an international agreement but just a transatlantic arrangement constituted by an adequacy decision adopted by the Commission on 12 July 2016 (declaring that the US ensures an adequate level of protection as required by the Directive 95/46/EC) and a declaration and several letters is- sued by US authorities, and reproduced in the annexes. Whereas the ade- quacy decision was binding in the European Union, the documents issued by the US authorities were political engagements. cf Fabien Terpan, ‘EU-US Data Transfer from Safe Harbour to Privacy Shield: Back to the Square One?’, (2018) 3(3) European Papers 1045–59. The Privacy Shield arrange- ment has been invalidated by the CJEU in its Schrems II Judgment of 16 July 2020 (see Post-Scriptum).

[10]Agreement between the USA and The European Police Office signed on 6 December 2001.

[11]Elaine Fahey, ‘The Evolution of Transatlantic Legal Integration: Truly, Madly, Deeply? EU–US Justice and Home Affairs’ in A Ripoll Servent and F Trauner (eds), The Routledge Handbook of Justice and Home Affairs Research (Routledge, London 2017), at 587. See also: Elaine Fahey and Deirdre Curtin (eds), A Transatlantic Community of Law: Legal Perspectives on the Relationship between the EU and US Legal Orders (CUP, Cambridge 2014); Elaine Fahey, ‘Transatlantic Cooperation in Criminal Law’ in M Bergstrom, V Mitsilegas and T Konstadinides (eds), Research Handbook on EU Criminal law (Edward Elgar, Cheltenham 2015), at 11 (stating that: ‘An examination of contemporary practice reveals much “sophistication” in the evolution of transatlantic criminal law cooperation. It appears perhaps even disproportionately extensive, relative to the many limitations of mutual recognition in justice’).

[12]Fahey, ibid, at 537 has observed in relation to the 2003 extradition and MLA Agreements that‘the secrecy of the negotiation of the agreements and their limited review by parliaments in both jurisdictions gave rise to concerns about the democratic character of the agreements. Similarly, the omission of human rights protections from the scope of the agreements provoked concerns, as did the prospect of joint investigation teams working together as well as the place of personal data within the scope of the agreements’. The PNR and TFTP agreements have also gen- erated controversy especially on account of their limitations on redress and their uneven application of US law to EU citizens, not enabling the latter to fully realise their rights to redress and review. Even the more re- cent Umbrella Agreement, which intends inter alia to deal with these issues, has been criticized by NGOs (see for instance Fanny Hidvegi and Estelle Masse ́, ‘The Umbrella Agreement Just Isn’t Good Enough to Protect our Rights’ (24 November 2016) < https://www.accessnow.org/ umbrella-agreement-just-isnt-good-enough-protect-rights/> accessed 10 October 2020).

[13]For criticism of the Umbrella Agreement by the EDPS see Opinion 1/ 2016, Preliminary Opinion on the agreement between the US and the EU on the protection of personal information relating to the prevention, in- vestigation, detection and prosecution of criminal offences, 12 February 2016.

[14]Peter Swire, Theodore Christakis and Jennifer Daskal, ‘The Globalisation of Criminal Evidence’ (IAPP Privacy Tracker, 16 October 2018)accessed 10 October 2020.

[15]See European Commission Staff Working Document, Impact Assessment Accompanying the document Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters and Proposal for a Directive of the European Parliament and of the Council laying down harmonized rules on the appointment of legal representatives for the purpose of gathering evidence in criminal proceeding [2018]<https: eur-lex.europa.eu="" legal-content="" en="" txt="" pdf="" ?uri1<="" font="">⁄4 CELEX:52018SC0118&from1⁄4EN> accessed 10 October 2020.

[16]Theodore Christakis, ‘Data, Extraterritoriality and International Solutions to Transatlantic Problems of Access to Digital Evidence. Legal Opinion on the Microsoft Ireland Case (Supreme Court of the United States)’ (29 November 2017), The White Book: Lawful Access to Data: The US v. Microsoft Case, Sovereignty in the Cyber-Space and European Data Protection, CEIS & The Chertoff Group White Paper (December 2017).<https: ssrn.com="" abstract1<="" font="">⁄43086820> accessed 10 October 2020.

[17]A first such ‘CLOUD Act executive agreement’ was concluded between the US and the UK in October 2019 and entered into force on 8 July 2020 (Agreement between the Government of the United Kingdom of Great Britain and Northern Ireland and the Government of the United States of America on Access to Electronic Data for the Purpose of Countering Serious Crime, 3 October 2019). For an analysis of the UK– US Agreement see, eg Jennifer Daskal and Peter Swire,‘The UK-US CLOUD Act Agreement is Finally Here, Creating New Safeguards’ Lawfare and Just Security blogs, 8 October 2019,accessed 10 October 2020; Theodore Christakis, ‘21 Thoughts and Questions about the UK-US CLOUD Act Agreement’ European Law Blog, 17 October 2019accessed 10 October 2020; Theodore Christakis and Kenneth Propp, ‘The Legal Nature of the UK-US CLOUD Agreement’ (Cross Border Data Forum, 20 April 2020)accessed 10 October 2020. The US is about to negoti- ate another CLOUD Act executive agreement with Australia.

[18]See European Commission, ‘E-Evidence’ accessed 10 October 2020.

[19]See Theodore Christakis, ‘E-Evidence in a Nutshell: Developments in 2018, Relations with the CLOUD Act and the Bumpy Road Ahead’ (Cross Border Data Forum, 14 January 2019)accessed 10 October 2020.

[20]See Theodore Christakis, ‘Lost in Notification? Protective Logic as Compared to Efficiency in the European Parliament’s E-Evidence Draft Report’ (Cross Border Data Forum, 7 January 2020)accessed 10 October 2020.

[21]A point reiterated once again on 4 June 2020 by the European Commissioner for Justice, Didier Reynders. See ‘“Real” negotiations with United States over E-evidence will only take place when agreement is reached on European side according to Didier Reynders’, Europe Daily Bulletin No12499, Agence Europe.

[22]Council of European Union’s Decision of 6 June 2019 authorizing the opening of negotiations in view of an agreement between the EU and the USA on cross-border access to electronic evidence for judicial coopera- tion in criminal matters, accessed 10 October 2020.

[23]Addendum to the 6 June 2019 Council Decision,accessed 10 October 2020. These directives set a series of conditions on the nature and scope of the Agreement that the Commission should follow as well as a series of procedural and other fundamental rights safeguards that should be introduced in the agreement to comply with EU Law (see n 5).

[24]Recmmendation for a Council decision authorizing the opening of negotiations in view of an agreement between the EU and the USA on cross-border access to electronic evidence for judicial cooperation in criminal matters, COM/2019/70 final, Brussels, 5 February 2019. See also European Commission, ‘Questions and Answers: Mandate for the EU- U.S. Cooperation on Electronic Evidence’ (5 February 2019)accessed 10 October 2020.

[25]Other reasons include the necessity of putting some order in the practice of ‘voluntary cooperation’ with service providers for LEAs access to non- content data. The Commission notes that the scale of direct cooperation requests on a voluntary basis has rapidly increased with more than 124 000 in 2017. However, direct cooperation on a voluntary basis for non- content data ‘can be unreliable, it may not ensure respect of the appropriate procedural safeguards, is only possible with a limited num- ber of service providers which all apply different policies, is not transpar- ent and lacks accountability’. The resulting fragmentation ‘may generate legal uncertainty, raise questions on the legality of prosecution as well as concerns on the protection of fundamental rights and procedural safe- guards for the persons related to such requests’. See Recommendation for a Council decision . . . (ibid). An EU–US Agreement could permit these issues to be addressed.

[26]European Parliament and Council Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L119/1.

[27]Theodore Christakis, ‘Transfer of EU Personal Data to U.S. Law Enforcement Authorities After the CLOUD Act: Is There a Conflict with the GDPR?’ in Randal Milch, Sebastian Benthall and Alexander Potcovaru (eds), Cybersecurity and Privacy in a Globalized World - Building Common Approaches (New York University School of Law, e- book, 2019) 60–76.<https: ssrn.com="" abstract1<="" font="">⁄43397047> accessed 10 October 2020.

[28]Cloud Act on the European legal framework for personal data protection’ (10 July 2019)accessed 10 October 2020.

[29]ecommendation for a Council decision . . . (n 23).

[30]Beyond the elements discussed in this section, a very important challenge

related to the scope of the EU–US agreement concerns the relationship between the two parts of the CLOUD Act and whether the US would still be able to use the first part of the CLOUD Act after the conclusion of an EU–US agreement. This problem has been discussed in two articles re- lated to the US–UK CLOUD Act Agreement that allows such unilateral access (see studies by T Christakis and K Propp (n 16)). The EU is op- posed to the idea that the US might be able to use the first part of the CLOUD Act to access European data after the conclusion of an EU–US Agreement. On 15 June 2020, the EDPB stressed in a letter to Members of the European Parliament ‘that any future agreement between the EU and the US must prevail over US domestic laws’. Letter from EDPB to MEPs Sophie in ‘t Veld and Moritz Ko ̈rner on the US-UK agreement un- der the US CLOUD Act’ (15 June 2020). accessed 10 October 2020.

[31]Discussed by Swire (n 4).

[32]Daskal and Swire (n 2).

[33]Swire (n 4).

[34]Report from the Commission on the opening of negotiations in view of an agreement between the EU and the US on cross-border access to elec- tronic evidence for judicial cooperation in criminal matters, 12524/19, 25 September 2019, at 3.

[35]See below the subsection ‘A comprehensive self-standing EU agreement’.

[36]‘US Department of Justice has reservations about transatlantic agreement

[37]on access to electronic evidence’, Agence Europe, Europe Daily Bulletin No 12374 (21 November 2019).

[38]Report from the Commission. . . (n 33), at 2.

[39]European Commission, ‘Questions and Answers’ (n 23).

[40]The mandate (n 21, at 6) requires from the Commission to refrain from

any solution that would ‘discriminate between persons from different

Member States’.It is interesting to note that the US law setting out the VWP requires,

among other things, that a participating country should enter into an agreement with the US on police information-sharing—the so-called Enhancing Cooperation in Preventing and Combating Serious Crime Agreements (PCSC Agreements). The US began entering into PCSC Agreements in 2008, primarily with countries that participate or seek to participate in the VWP, and as of today there are 38 of them worldwide in force including bilateral agreements with 22 EU Member States. It would not be surprising if the US Government invoked the PCSC ap- proach for LEA’s access to data if the negotiations with the EU do not succeed in a reasonable time frame, with the hope that a number of Member States might be tempted to break ranks and negotiate directly with the US. However, it is far from certain that an analogy could be drawn between the PCSC Agreements and LEA’s access to data. From a legal point of view, ‘break the ranks’ in order to negotiate a bilateral data access agreement with the US would expose the EU Member State to in- fringement procedures (see our discussion below in the section ‘Issues of competence’). From a political point of view the situation with the VWP and the bilateral PCSC Agreements created a lot of frustrations at the EU: on the one hand Member States that are not yet part of the VWP are unhappy because of the unequal treatment and the lack of reciprocity; on the one hand some Member States that are part of the VWP consider that they went too far into their concessions to the US in the PCSC Agreements especially in terms of information sharing. Both categories of States seem to feel that the EU, as a bloc, is in a much stronger position and has much more important bargaining power than individual Member States in order to negotiate with the US such an important data agreement.

[41]See the press release on 2 March 2017: Parliament asks EU Commission to press for full US–EU visa reciprocity,accessed 10 October 2020.

[42]See ‘EU escalates “visa war” with US with Americans set to lose visa-free travel to Europe’ (The Telegraph, 2 March 2017)accessed 10 October 2020.

[43]See ‘Americans won’t need a visa to Europe, but rather an ETIAS – which is not a visa’ (Schengen Visa Info, 10 March 2019)accessed 10 October 2020.

[44]See ‘EU visa reciprocity mechanism - Questions and Answers’ 19 December 2018,accessed 10 October 2020.

[45]4th WORKING DOCUMENT (B) on the Proposal for a Regulation on European Production and Preservation Orders for electronic evidence in criminal matters (2018/0108 (COD))—Relation with third country law, Committee on Civil Liberties, Justice and Home Affairs, 11.3.2019, at 5.

[46]Daskal and Swire (n 2).

[47]European Court of Justice, ERTA (1971), Case 22/70. Lo ̈ıc Azoulai, ‘The Question of Competence in the European Union’ Oxford University Scholarship, 2014.

[48]Commission Proposal for a Regulation of the European Parliament and of the Council on European Production and Preservation Orders for electronic evidence in criminal matters, COM(2018) 225 final.

[49]Although a directive has also been proposed by the Commission on the issue of appointment of legal representatives: Proposal for a Directive of the European Parliament and of the Council laying down harmonized rules on the appointment of legal representatives for the purpose of gath- ering evidence in criminal proceedings, COM/2018/226 final.

[50]Elaine Fahey, ‘The Evolution of Transatlantic Legal Integration: Truly, Madly, Deeply? EU–US Justice and Home Affairs’ in Florian Trauner and Ariadna Ripoll Servent (eds.), The Routledge Handbook of Justice and Home Affairs Research (Routledge International Oxford 2017) 336–45.

[51]Christophe Hillion and Panos Koutrakos, Mixed Agreements Revisited (Hart Publishing 2010).

[52]This is why the relevant substantive legal basis for the EU–US Agreement is not only art 82(1) TFEU on judicial cooperation in criminal matters but also art 16 TFEU on data protection safeguards. For the parallel pro- cedural legal basis of art 218 TFEU (which applies to all negotiations, sig- natures and conclusions of international agreements entered into by the EU) see below the section ‘Adoption of international agreements by the EU: a multi-stage/multi-actor process’.

[53]According to the CJEU case-law, ‘[t]here is a risk that common EU rules may be adversely affected by international commitments undertaken by the Member States, or that the scope of those rules may be altered, which is such as to justify an exclusive external competence of the European Union, where those commitments fall within the scope of those rules’. Opinion 3/15 (Marrakesh Treaty to Facilitate Access to Published Works for Persons who are Blind, Visually Impaired or Otherwise Print Disabled), EU:C:2017:114, para 105).

[54]In Case C-246/07, Commission v Sweden, the Court examined in detail the duty of sincere cooperation in relation to Member State action in international fora. See Marise Cremona, ‘Case C-246/ 07, Commission v. Sweden (PFOS), Judgment of the Court of Justice (Grand Chamber) of 20 April 2010’ (2011) 43 Common Market Law Review 1639–65.

[55]Piet Eeckhout, EU External Relations Law (2nd edn, OUP, Oxford 2011), at 248.

[56]To assess whether an area is largely covered by common rules, account must be taken not only of EU law as it currently stands, but also of its fu- ture development, in so far as that is foreseeable (Case C-66/13 Green Network, EU:C:2014:2399, paras 61–64; Opinion 1/03 (New Lugano Convention), EU:C:2004:490, para 126).

[57]Hearing before the LIBE Committee, 25 July 2019, Agence Europe, no 12304.

[58]See n 16.

[59]See Question reference E-003136-19, date of the parliamentary question 7 October 2019, date of the written answer: 10 January 2020;accessed 10 October 2020.

原文链接：https://academic.oup.com/idpl/article/11/2/81/6133744

微信扫码关注该文公众号作者

戳这里提交新闻线索和高质量文章给我们。

来源: qq

点击查看作者最近其他文章