The highly anticipated statement from the Article 29 Working Party (“Art. 29 WP”) on the invalidation of Safe Harbor was released late on 16 October 2015.
The Art. 29 WP is an independent data protection advisory board for the EU composed of representatives from the Member State’s national data protection authorities, the European Data Protection Supervisor and the EU Commission.
The members of the Art. 29 WP are "urgently calling on the Member States and European institutions to open discussions with U.S. authorities in order to find legal and technical solutions" that would allow data transfers while respecting EU fundamental rights. They consider that the “current negotiations around a new Safe Harbor could be part of the solution."
The Art. 29 WP stated that in the meantime, they are still in the process of assessing the impact and further scope of the Safe Harbor ruling on data transfers, e.g., under the Standard Contractual Clauses and also Binding Corporate Rules.
"During this period, data protection authorities consider that Standard Contractual Clauses (SCC) and Binding Corporate Rules can still be used". However, data protection authorities could be led to investigate specific cases following individual complaints.
“If by the end of January 2016, no appropriate solution is found with U.S. authorities and depending on the results from the Art. 29 WP’s assessment of the other transfer tools, EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions."
This means that companies that are safe-harbor certified or transfer data to safe-harbor certified companies have a three month grace period to become compliant and find another solution to protect data transfers outside the EU.
The complete statement can be accessed here.