As reported in a previous article featured in our October 2015 White & Case Technology Newsflash, the Court of Justice of the European Union ("CJEU") recently handed down its ruling in case C-362/14 Maximillian Schrems v Data Protection Commissioner.
The CJEU held that national supervisory authorities have the power to examine with complete independence whether the transfer of a person's data to a third country complies with the requirements laid down by the Data Protection Directive, and also declared Commission decision 2000/520/EC on the adequacy of the EU-US safe harbor arrangement invalid.
Statement from the Article 29 Working Party
On 16 October 2015, the Article 29 Working Party ("the WP29"), an independent advisory body on data protection and privacy composed of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor and the Commission, released its highly anticipated statement on the Schrems case.
According to the statement, the WP29 is "urgently calling on the Member States and European institutions to open discussions with U.S. authorities in order to find legal and technical solutions" that would enable data transfers while respecting fundamental rights. The WP29 considers that the “current negotiations around a new Safe Harbor could be part of the solution."
The WP29 has advised that while it considers the scope of the CJEU decision, "During this period, data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used"; however, this will not prevent national data protection authorities from investigating individual cases. The statement notes that "If by the end of January 2016, no appropriate solution is found with U.S. authorities and depending on the assessment of the transfer tools by the WP29, EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions."
In response to the CJEU ruling, White & Case has put together a Safe Harbor Action Plan to help guide businesses with the assessment of their data transfer mechanisms.