Commenting on news that the Irish Data Protection Authority consented yesterday to the application to quash the decision it had relied on and which led to the ECJ decision on Safe Harbor, Marie McGinley, Head of IP, DP and Technology at Eversheds Ireland, says:
"The Irish DPC is bowing to the inevitable today by completing the relevant court process and consenting to the application to quash the earlier decision. It now carries the burden of conducting this investigation into the adequacy of protection afforded to transfers to the US, against the backdrop of the ECJ ruling that Safe Harbor does not provide adequate protection.
"Meanwhile, for businesses trying to figure out what to do next in the wake of the ECJ ruling, there is little comfort to be found in the statement issued late Friday by the Article 29 Working Party DPAs. According to that statement, the adequacy of Model Clauses & BCRs (as alternative mechanisms to Safe Harbor for the protection of personal data transferred to the US) remain under review but they have said it is permissible to use unless a DPA is forced to act in response to a complaint. Or put another way, they are permissible until the DPAs tell you otherwise. It will be hard to then rely on this when we know some German DPAs don’t think those mechanisms can be relied on. According to the statement, the position is to be reviewed by the DPAs from Jan 2016 in relation to enforcement if a political fix is not forthcoming - not quite the grace period some had hoped for. This will certainly keep the pressure up on negotiations with the US on SH2.0 and passage of Judicial Redress Act in US. The statement wasn’t the salve to the uncertainty all had hoped for. Reaching agreement even between the DPAs is clearly proving to be difficult."