Issue Number 19: 23rd October 2015

Indonesia and Malaysia establish the Council of Palm Oil Producer Countries
The CJEU invalidates the EU-US Safe Harbour Agreement on the protection of personal data
MEPs support mandatory origin labelling for milk, minor meats, unprocessed foods, single ingredient products and ingredients that represent more than 50% of a food
Recently Adopted EU Legislation

Indonesia and Malaysia establish the Council of Palm Oil Producer Countries

Earlier this month, the Malaysian Prime Minister Najib Razak and the Indonesian President Joko Widodo agreed to establish the Council of Palm Oil Producer Countries (hereinafter, CPOPC), with the mandate to, inter alia, harmonise standards on environmentally sustainable palm oil in the two countries and improve the competitiveness of palm oil. This initiative has the potential to significantly affect palm oil standards and production conditions in both countries and, in turn, to combat negative perceptions against the industry.

Although there have been concerns regarding the environmental impact of palm oil production, the industry has made significant efforts in recent years to provide environmentally sustainable palm oil to consumers. Indeed, compared to other vegetable oil sources (e.g., maize, soybean, sunflower and rapeseed), palm oil plantations produce higher yields using less land and require fewer chemicals, such as fertilizers and pesticides. In addition, regulators, producers and traders have developed standards and adopted measures to help shift palm oil production to lands that are already degraded and turn a rapidly growing industry into a sustainable development model. Presently, there are a number of (voluntary or mandatory) national and international sustainability standards and certification schemes for palm oil. These schemes have become increasingly popular as a means of encouraging (or enforcing) the sustainable production of palm oil, but also a growing element of confusion and cost for producers and processors having to adapt to them and to meet all the requirements.

One of the schemes most commonly referred to is the voluntary certification scheme provided by the Roundtable on Sustainable Palm Oil (RSPO). In spite of its widespread use, the RSPO certification scheme appears particularly burdensome to comply with for producers, inter alia because the “Principles” and “Criteria” on which it is based are complex and change often. On the other hand, Indonesia and Malaysia, the two biggest palm-oil producing countries, which together account for 85% of global palm oil output, have their own national sustainability standards and certification schemes for palm oil: respectively, the Indonesian Sustainable Palm Oil (hereinafter, ISPO) and the Malaysian Sustainable Palm Oil (hereinafter, MSPO) standards. The ISPO is a mandatory standard designed to ensure that all Indonesian palm oil producers (and not just those exporting to foreign markets) conform to sustainable production practices. The MSPO, initially launched as a voluntary scheme, is intended to become mandatory in the future. The CPOPC aims at improving and harmonising these national standards and at supporting the implementation of sustainable practices throughout the two countries. Reportedly, as part of this initiative, the two countries have agreed to encourage private investors to build a green economic zone for palm oil production, and boost the socio-economic development of smallholders.

As mentioned, the current state-of-play with respect to sustainability standards and certification schemes appears overly-fragmented, confusing, costly for companies to comply with (especially those that operate in various countries) and insufficient to counter the concerns of the regulators in certain importing countries and respond to the denigrating campaigns put in place by competitors against palm oil-based products by reason of their environmental performance. The agreement between Indonesia and Malaysia is long overdue and its rationale is simple: it should be for the two countries that together account for 85% of world production in palm oil to define the applicable sustainability standard. After all, nobody more than the two countries themselves have at heart the destiny of their palm oil industry, the sustainability of their economic, industrial and employment practices, and the well-being of their forests and environmental assets.

Palm oil is a renewable, ‘green’ product in nature, and one of the major sources of feedstock for biofuels, whose use is being encouraged through various policies in a number of jurisdictions. Palm oil-based biofuels constitute a ‘green’ alternative to fossil fuel. However, trade in palm oil-based biofuels is the object of increased levels of regulation in certain countries like the EU and the US, driven, inter alia, by environmental concerns relating to palm oil’s production processes (see Trade Perspectives, Issue No. 10 of 21 May 2010 and Issue No. 17 of 20 September 2013). These policies rest on criteria and mechanisms that are scientifically questionable, do not appear to be trade-facilitating, are often the consequence of successful pressures exercised by domestic competitors, and result in a de facto discrimination of palm oil and palm oil-based products vis-à-vis competing products of domestic or foreign origin.

As a food ingredient, palm oil has increasingly been the object of initiatives and schemes, particularly in the EU, intended to restrict its use, if not openly discredit this commodity, on the basis of unsubstantiated claims that palm oil consumption is harmful to health and the environment. A notable example of such initiatives is provided by the ‘palm oil free’ campaigns effected by certain food retailers and manufacturers, particularly but not exclusively through negative labelling practices placed on foodstuffs that mislead consumers and denigrate palm oil to the benefit of competing domestic products, in violation of EU rules (see Trade Perspectives, Issue No. 4 of 20 February 2015).

Against this background, the CPOPC represents a platform and an opportunity to continue improving standards and support diffusion, implementation and enforcement of sustainable production practices in Indonesia and Malaysia, while decreasing the burden for the industry to try and comply with multiple standards. The creation of a harmonised sustainability standard between the two biggest palm oil producing countries would also set the basis for the definition of an international standard for palm oil sustainability, working towards recognition of palm oil-based products produced according to the standard as ‘green’ goods and increasing trade facilitation. Arguably this process of international standardisation and progressive harmonisation should first start within the ASEAN region and then be expanded globally.

The decision to create the CPOPC and to set a new, harmonised environmental sustainability standard for palm oil represents a positive development for the palm oil industry. Key industry stakeholders in Indonesia and Malaysia should partake in this standardisation process and support the work of the CPOPC to ensure that the standards developed deliver the expected degree of reliability, environmental protection and authority, while still being viable and cost-effective for the industry.

The CJEU invalidates the EU-US Safe Harbour Agreement on the protection of personal data

On 6 October 2015, the Court of Justice of the European Union (hereinafter, CJEU) released its judgement in Maximillian Schrems v Data Protection Commissioner (Case C-362/14), which in effect invalidated the EU-US Safe Harbour Agreement (hereinafter, the Safe Harbour Agreement) on the protection of personal data. The ruling affects thousands of companies doing business in the EU and the US, but also raises questions concerning data flows and local data storage requirements under international rules.

In 1998, the EU and the US began developing the principles found in the Safe Harbour Agreement. In effect, the Safe Harbour Agreement was a mutual recognition agreement, whereby certified US companies were deemed to comply with Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (hereinafter, Directive 95/46/EC). Article 25(1) of Directive 95/46/EC requires third countries, to which personal data is transferred from EU Member States, to be able to ensure that an adequate level of protection is provided. Article 25(2) provides that such adequacy of the level of protection must, in particular, consider the nature of the data, the purpose and duration of the proposed processing operation or operations, the country of origin and country of final destination, the rules of law, both general and sectoral, in force in the third country in question, and the professional rules and security measures that must be complied with in that country. Article 25(6) allows the EU Commission to find that a third country has ensured an adequate level of protection, by reason of its domestic law or of the international commitments to which it has undertaken. The EU Commission made such a finding with respect to the Safe Harbour Agreement in Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (hereinafter, Decision 2000/520/EC). To benefit from the Safe Harbour Agreement, US companies had to self-certify to the US Department of Commerce that they complied with Directive 95/46/EC. The US Federal Trade Commission was provided with the responsibility to enforce compliance with the Safe Harbour Agreement.

On 25 June 2013, Maximillian Schrems, an Austrian resident and national, filed a complaint with the Irish Data Protection Commissioner (hereinafter, the Commissioner) asking the Commissioner to prohibit Facebook Ireland Ltd from transferring his personal data to servers in the US. Mr. Schrems, citing revelations made by Edward Snowden concerning the activities of, inter alia, the US National Security Agency (hereinafter, NSA), argued that the US did not ensure adequate protection of the personal data held in its territory against the surveillance activities that were engaged in there by the public authorities. The Commissioner rejected Mr. Schrems’ complaint as unfounded, ruling that an investigation of Mr. Schrems’ claims was not required because there was no evidence that Mr. Schrems’ personal data had been accessed by the NSA. The Commissioner also stated that questions regarding the adequacy of the level of protection of personal data had to be determined in accordance with Decision 2000/520, where the EU Commission already found that the US ensured an adequate level of protection. Mr. Schrems then brought an action before the High Court of Ireland challenging the decision at issue in the main proceedings. The High Court of Ireland found that the electronic surveillance and interception of personal data transferred from the EU to the US served necessary and indispensable objectives in the public interest, but it agreed with Mr. Schrems, insomuch that the revelations made by Edward Snowden had demonstrated a “significant over-reach” on the part of, inter alia, the NSA.

However, the High Court of Ireland felt the need to refer certain questions to the CJEU, in particular whether the Commissioner is bound to the finding of Decision 2000/520, or whether the Commissioner must conduct an independent investigation of the matter in light of factual developments since the decision was first published. On 23 September 2015, Yves Bot, the Advocate General of the CJEU, delivered his Opinion on the request for a preliminary ruling from the High Court of Ireland in Maximillian Schrems v Data Protection Commissioner. The Opinion of the Advocate General found that Decision 2000/520 does not contain sufficient guarantees, and in particular that the derogations laid down in Annex I of Decision 2000/520 for national security concerns ought to have been accompanied by the putting in place of an independent control mechanism suitable for preventing the breaches of the right to privacy that have been found following revelations brought forward by Edward Snowden. The judgement of the CJEU echoed the concerns of the Advocate General, and held that Article 25(6) of Directive 95/46/EC does not bar a supervisory authority, such as the Commissioner, from examining a claim in light of Decision 2000/520, and that, nonetheless, Decision 2000/520 is invalid. The effect of the judgement is that recognised certifications of US companies under the Safe Harbour framework are no longer valid, and that companies wishing to transfer data to servers in the US must first be granted authorisation to do so by the supervisory authorities of each EU Member State in accordance with Article 26 of Directive 95/46/EC.

The judgement may create a de facto local data storage requirement for companies investing in the EU that had opted to establish data storage facilities in the US, insomuch as, given the findings by the CJEU, supervisory authorities in EU Member States are unlikely to authorise the transfer of personal data to the US until a significant change in circumstances occurs. Local data storage requirements arguably create unnecessary barriers to trade, insomuch as they add significant costs to doing business internationally. Accordingly, interesting questions with respect to localisation requirements and their consistency with international obligations are raised. As a WTO Member, the EU, and its individual Member States, have made commitments under the General Agreement on Trade in Services (hereinafter, GATS). According to Article VI:1 of the GATS, “where specific commitments are undertaken, each Member shall ensure that all measures of general application affecting trade in services are administered in a reasonable, objective and impartial manner”. Specific commitments under the GATS are made in reference to the ‘4 modes of supply’ for the delivery of services, including: 1) Cross-border supply; 2) Consumption abroad; 3) Commercial presence; and 4) Presence of natural persons. Such specific commitments may be relevant depending on the particular operations or sectors of some cross-border enterprises (e.g., Computer and Related Services), where, for the most part, the EU does not appear to have relevant limitations on market access for the first three modes of supply of services, and there do not appear to be any horizontal limitations on market access. However, the GATS also includes General Exceptions, including Article XIV(c)(ii), which allows measures “necessary to secure compliance with laws or regulations which are not inconsistent with the provisions of this Agreement including those relating to … the protection of the privacy of individuals in relation to the processing and dissemination of personal data and the protection of confidentiality of individual records and accounts”, as long as such measures are not applied in a manner constituting a means of arbitrary, unjustifiable discrimination or a disguised restriction on trade in services.

In general, the system devised under Directive 95/46/EC appears to be WTO-consistent, as long as decisions by the EU Commission or supervisory authorities in EU Member States are not arbitrary, unjustifiably discriminatory or disguised restrictions on trade in services. In this respect, questions could be raised regarding whether the judgement of the CJEU in Maximillian Schrems v Data Protection Commissioner could be found to be unjustifiably discriminatory, given that other countries, which the EU Commission has recognised as providing adequate protection (e.g., Canada), allegedly joined in the NSA’s practices, and that others were allegedly unable to protect their populations from the NSA’s surveillance. In addition, the judgement by the CJEU may create, at least, a de facto barrier to trade in services for the time being. Such a situation is not positive for relevant businesses, but in the context of international law, concerns have rightfully been more focused on de jure measures that outright prohibit the storage of data in foreign jurisdictions.

In November 2014, the US circulated a Communication to the WTO Committee on Trade in Services, relating to the Decision by WTO Members at the 9^th Ministerial Conference to reinvigorate the Work Programme on Electronic Commerce. In the Communication, the US stated that Governments should not limit the cross-border flow of information, nor require the use of local infrastructure. The US added that, in many cases, the protection of cross-border flow of data may be enhanced through storage in foreign jurisdictions, where economies of scale in specialised security, practiced by best-in-class data processors, may surpass what is available in storage facilities within one particular jurisdiction. Various WTO Members have implemented de jure local data storage requirements, including, inter alia, China and Brazil, but no disputes have been initiated before the WTO Dispute Settlement Body. Attaching the cross-border flow of data to a specific sector commitment under the GATS appears difficult, and some WTO Members appear to be more interested in updating bilateral, plurilateral and multilateral obligations so as to expressly prohibit local data storage requirements. Bilaterally, between the EU and the US, coordination, as well as the legal frameworks which apply, may encounter a significant evolution in the near future. Reports indicate that the EU and the US were already in negotiations to reform the Safe Harbour Agreement prior to the ruling by the CJEU, and thus could address the security issues in the pending agreement. In addition, the EU and the US are currently negotiating the Transatlantic Trade and Investment Partnership, which may include rules on the cross-border flow of data, and which currently plans to include an investor-to-state dispute settlement mechanism. Moreover, they are both parties to the Trade in Services Agreement, which is also currently under negotiation, and which reports indicate will likely include rules addressing the free flow of data across borders.

Accordingly, the legal frameworks regulating these issues under international law are evolving in a manner that will provide clarity to governments and businesses concerned with ensuring that data can flow reasonably between and among jurisdictions. Reports indicate that the judgement of the CJEU in Maximillian Schrems v Data Protection Commissioner invalidating Decision 2000/520 could negatively affect 4,400 companies that do business in both jurisdictions, many of which will need to reform their operations. However, pending agreements will take time to enter into effect, and companies may need to consider temporary solutions to their data storage needs if they are unable to be authorised by the supervisory authorities of individual EU Member States. Enterprises are encouraged to examine their business operations and seek counsel with respect to potential options. Requiring the use of multiple data storage centres can be costly, and businesses need to determine the least costly and burdensome way in which to comply with the relevant legal frameworks.

MEPs support mandatory origin labelling for milk, minor meats, unprocessed foods, single ingredient products and ingredients that represent more than 50% of a food

In a meeting of the European Parliament’s Committee on the Environment, Public Health and Food Safety (hereinafter, ENVI Committee), held on 15 September 2015, Members of the European Parliament (hereinafter, MEPs) supported mandatory origin labelling during their debate on two EU Commission’s (hereinafter, Commission) reports on mandatory origin labelling for a number of food categories. Currently, mandatory rules on origin labelling exist for several sectors, such as honey, fruit and vegetables, fish (not fish products such as prepared or preserved fish), beef and beef products, olive oil, wine, eggs, imported poultry and where failure to indicate the origin might mislead the consumer as to the true country of origin or place of provenance of the food. Regulation (EU) No. 1169/2011 of the European Parliament and of the Council on the provision of food information to consumers (hereinafter, the FIR) introduced mandatory origin labelling for fresh, chilled or frozen meats of swine, sheep, goat and poultry (the new requirements entered into effect on 1 April 2015). The FIR requires the Commission to work on possible extensions of mandatory origin labelling to other food categories and to adopt implementing acts setting out rules to prevent the misleading use of voluntary origin labelling of food.

Article 26(3) of the FIR provides that, where the country of origin or the place of provenance of a food is given, and where it is not the same as that of its primary ingredient: (a) the country of origin or place of provenance of the primary ingredient in question must also be given; or (b) the country of origin or place of provenance of the primary ingredient must be indicated as being different to that of the food. The application of this provision is subject to the adoption of an implementing act. The Commission has indicated that work on the expected implementing act setting out rules to prevent the misleading use of voluntary origin labelling of food is still on hold and that the expected draft measure will not be presented before 2016. This implementing act must be adopted in accordance with the examination procedure (referred to in Article 48(2) of the FIR) for implementing acts under the Lisbon Treaty.

In relation to new food categories, Articles 26(5) and (6) of the FIR require the Commission to submit a series of reports to the European Parliament and the Council concerning the possibility to extend mandatory origin labelling for the following food categories: (a) types of meat other than beef, swine, sheep, goat and poultry (i.e., minor meats); (b) milk; (c) milk used as an ingredient in dairy products; (d) unprocessed foods; (e) single ingredient products; and (f) ingredients that represent more than 50% of a food. At that meeting of the ENVI Committee on 15 September 2015, the EU Commission presented two reports of 20 May 2015 requested under the FIR (i.e., the Commission Report regarding the mandatory indication of the country of origin or place of provenance of unprocessed foods, single ingredient products and ingredients that represent more than 50% of a food, hereinafter, the first report; and the Commission Report regarding the mandatory indication of origin or place of provenance for milk, milk used as an ingredient in dairy products and types of meat other than beef, swine, sheep, goat and poultry meat, hereinafter, the second report).

Following Article 26(7) of the FIR, both reports had to take into account the need for the consumer to be informed, the feasibility of providing the mandatory indication of the country of origin or place of provenance and an analysis of the costs and benefits of the introduction of such measures, including the legal impact on the internal market and the impact on international trade. The Commission could have accompanied the two reports with proposals to modify the relevant EU provisions, but it chose not to do so. Both Commission reports build mainly on the results of external studies commissioned by the Commission, which included views of consumers, food business operators (hereinafter, FBOs) and the surveys and case studies of Competent Authorities in EU Member States, as well as on other available sources on these subjects.

According to the first report, consumers’ interest in origin labelling for unprocessed foods (for example, flour, rice, and cut green vegetable salads), single ingredient products (such as sugar, tomato purée, vegetable oils of a single vegetable origin, frozen potato fries when no additive or salt has been added to these products) and ingredients representing more than 50% of a food (e.g., the tomato of a tomato sauce, fruit in fruit juices, flour in bread) is lower than for food categories such as meat, meat products or dairy products. The report emphasises that mandatory origin labelling for those products would be very complex and would lead to substantial increases of costs of production, which would ultimately be passed on to consumers. FBOs opting for a single origin or a limited number of origins would have to face additional operating costs (one-off and recurrent) due to the necessary adaptations of sourcing practices, traceability systems, production process, packaging and marketing practices. In addition, the report highlights that this would create an additional burden for EU Member States’ Competent Authorities. The first report concludes, therefore, that a mandatory origin labelling system for single ingredient products and ingredients that represent more than 50% of a food would not be the most suitable option, and that maintaining the current possibility of voluntary origin labelling would be preferable.

In relation to drinking milk, the second report finds that indicating the place of milking would be challenging for processors sourcing milk from several origins and would result in additional operating costs. In addition, for milk used as an ingredient in dairy products, providing origin labelling would be difficult and expensive in practice, in particular for highly processed dairy products. In relation to minor meats (such as meat from horses, rabbits, deer, farmed and wild game and birds other than chicken, turkey, ducks, geese and guinea fowls), the second report finds that the additional costs would be relatively minor, but that the regulatory burden, in particular, for horse meat operators would increase. In light of these results, the second report concludes that the existing options for voluntary origin labelling would remain the most suitable to address some consumer demand without adding additional costs and burdens. Additional findings that emerge from the second report are that, in spite of a consumers’ interest for the origin of milk, milk used as an ingredient in dairy products and for meats under the remit of the report, consumers’ overall willingness to pay for this information appears to be modest. When mandatory origin labelling scenarios are considered, consumers seem to express preference for this indication to be made at EU Member States level. Although the cost of labelling the origin of milk could be generally modest, its impact among operators will be uneven with some of them having to introduce additional traceability systems with substantial increases of costs, particularly those located in border regions or in areas that are not self-sufficient in milk.

During the meeting of the ENVI Committee, the Commission’s representative emphasised that mandatory origin labelling at EU level is highly complex and that mandatory labelling for these type of products would lead to an increase in costs. Said representative also expressed concerns over the fact that a mandatory origin-labelling scheme would have an impact on the internal market and international trade. A number of MEPs did not share the views of the Commission. Some stated that the position of the Commission was not fully logical, since there are products for which origin labelling is mandatory. It was also noted that the environmental effect of transport must be taken into account. It was argued that the Commission’s conclusions were only cost-based and that a mandatory origin labelling would be feasible for simple products. Other MEPs supported the Commission’s report and agreed with the conclusions that mandatory origin labelling for this type of product would lead to an increase of costs and burdens. The Commission’s representative highlighted that the production of single-ingredient products is not as easy as it may appear, since manufacturers might have several supply chains and combine raw materials from different sources. It was also stated that the benefit of the origin labelling could be achieved with voluntary labelling schemes. In relation to the second report, similar arguments were made by MEPs and the Commission. However, it was stressed that, with respect to minor meats, a mandatory labelling could be feasible, since mandatory origin labelling is already applying to many types of meat. The Commission’s representative noted that, for dairy products, a mandatory origin labelling would have an impact on border regions.

Currently, for foods under the remit of the two reports, consumers may, if they so wish, opt for milk or meat products, unprocessed foods, single ingredient products and products with ingredients that represent more than 50% of a food, where food business operators voluntarily provide for the origin information. Reportedly, in September 2015, a German producer of deep-frozen meals started to voluntarily label information on the origin of its ingredients directly on its products. Voluntary indication of the origin can arguably be a suitable option without imposing additional burdens on the industry and the authorities. Mandatory origin labelling would entail a higher regulatory burden for most of the products and, therefore, the question at stake is whether the balance between costs and benefits is such that it would justify its mandatory indication. The European Parliament and the Council may decide to formally respond to either or both of the reports in the coming months. The next steps taken in the EU on origin labelling for food products should be monitored and FBOs should be prepared to participate in shaping potentially upcoming EU legislation by interacting with relevant EU Institutions, trade associations and affected stakeholders.