Following the announcement of the European Court of Justice ("ECJ") decision on October 6, 2015 invalidating the U.S.-EU Safe Harbor ("Safe Harbor"), U.S. government stakeholders continue to urge action, starting with Department of Commerce Secretary Penny Pritzker. In recent remarks at the AmCham Germany Annual Transatlantic Business Conference in Frankfurt, Secretary Pritzker asserted that the Safe Harbor issue is an "urgent problem." She noted that the improved Safe Harbor Framework that the U.S. has negotiated with the European Commission ("EC") over the past two years is the sensible solution. In addition, on November 3, 2015, the U.S. House Committee on Energy and Commerce Subcommittee on Commerce, Manufacturing, and Trade and the Subcommittee on Communications and Technology held a joint hearing to draw congressional attention to the impact of the Safe Harbor decision. Members of the subcommittees and panelists discussed the economic impact of cross-border data flows, the trade relationship between the United States and the EU, and the legal challenges of renegotiating the U.S.-EU Safe Harbor Agreement.
On November 6, 2015, the EC issued its long-awaited guidance describing how companies should address compliance challenges in the immediate interim of the ECJ decision.17 The guidance provided an overview of alternative tools for transatlantic data transfer. Specifically, the guidance addressed the implementation of model contract clauses and binding corporate rules. Additionally, the guidance outlined alternative "derogations" to the 1995 Directive that provide exceptions
from the general prohibition against data transfers without an adequacy determination. The guidance noted that the burden to comply with the directive is on the data controllers. Moreover, EU data protection authorities will maintain the power to investigate individual cases. The EC guidance concluded by stating that a new Safe Harbor Framework is a key priority. The EC has "intensified" talks with the U.S. government, and the Commission plans to conclude negotiations within three months.
In other updates from the EU, German authorities issued a position paper stating that they will not approve any new transfers of data to the United States. The German ban on data transfers includes transfers based on alternative arrangements, such as those outlined in the EC guidance.