On Friday 16 October, the Article 29 Working Party (the advisory body composed of representatives from each Member State’s data protection authority, the European Data Protection Supervisor and the European Commission) (the “Working Party”) issued a statement clarifying certain implications of the ruling. The Working Party noted that it is absolutely essential for the national data protection authorities to have a common position on the implementation of the Schrems judgment.
The Working Party reiterated the CJEU’s ruling that massive and indiscriminate surveillance is incompatible with the EU legal framework and third countries including the US which go beyond what is necessary in a democratic society will not be considered safe destinations for personal data. The Working Party also reiterated the CJEU’s statement that transfers still taking place under Safe Harbour are unlawful.
In its statement, the Working Party called on Member States and European institutions to open discussions with US authorities urgently in order to find a long term solution which will enable the transfer of data to the US. Such solutions are likely to include a revised Safe Harbor framework (“Safe Harbour 2.0”) which is currently being negotiated, passing of the US Judicial Redress Act that would grant EU residents rights to bring actions in US courts if their data is misappropriated and signature of the EU-US “Umbrella Agreement” which contains a high-level data protection framework for EU-US law enforcement cooperation.
In the meantime, the Working Party suggests that businesses should consider putting legal and technical solutions in place in a timely manner. In this regard the Working Party still considers the model clauses and binding corporate rules as legitimate bases for transferring data (with oversight by the national data protection authorities) subject to the Working Party’s further review of these alternative transfer mechanisms in light of the Schrems judgment. The Working Party has suggested, however, that if no long term solution is found by the end of January 2016, the national authorities may take all necessary measures, including enforcement actions.