The Commission’s Decision that declares that US ensures an adequate level of protection of personal data flow, has been found to be invalid by the Court of Justice of the European Union: the Art. 29 WP’s opinion and the Italian DPA’s decision.

In case C-362/14, the EU Commission’s Decision No. 2000/520 CE, that declares that United States ensures an adequate level of protection of personal data flow, has been found to be invalid by the Court of Justice of the European Union (the “CJEU”). In this respect, the CJEU has also pointed out that, even if the Commission has adopted a decision, the national supervisory authorities, when dealing with a claim, must be able to examine, with complete independence, whether the transfer of a person’s data to a third country complies with the requirements laid down by the Directive No. 95/46/EC.

In light of the judgment at issue, the Article 29 Working Party, in a statement published on last October 16, highlighted the need for the national supervisory authorities to adopt, whether by the end of January 2016 no suitable solution is found as an alternative to Safe Harbour, all the enforcement actions deemed necessary to ensure full compliance with the applicable data protection requirements, even imposing appropriate sanctions, where needed.

Furthermore, through the resolution issued on the last October 22, the Italian Data Protection Authority revoked the authorization issued on October 10, 2001 by means of which data transfer to the United States were allowed on the bases of the Safe Harbour. In order to lawfully transfer the personal data overseas, multinational companies, Italian organizations and companies will therefore have to use other tools, such as the express consent, the standard contractual clauses or the binding corporate rules (so-called BCR).

Finally, in its Communication to the European Parliament and to the Council of November 6, the European Commission also pointed out that alternatives tools to Safe Harbour could still be used to lawfully transfer personal data to the United States.