Schrems decision by the European Court of Justice today has had a strong impact everywhere. Even more so in Spain. Conversely to other jurisdictions, Spain traditionally rejected that EU Standard Model Clauses could entitled by themselves data controllers to export data to the US and/or other “non-equivalent” territories. They where rather regarded as a basis for an export permit that should be granted after careful examination by the Spanish Data Protection Commissioner. Such procedures are strict and exhaustive and can take several months to be completed. The Spanish narrow interpretation of the exceptions granted by the EU Directive for free transfer makes things even more difficult.
Consent from the data subjects has been the usual emergency exit in the Spanish market, but this may be not practical in the case of very large databases. A recent decision by the Spanish Supreme Court has made the resort to consent more difficult than before. This makes that a flexibilization of the export permits procedures remains as the best option to avoid damaging EU/US business flows.
The Spanish Data Protection Commissioner has convened an urgent meeting to handle the situation and has issued a public statement that can be found here.