Today, October 6, the Court of Justice of the European Union (CJEU) decided to agree in large part with the Advocate General’s recommendation in the matter Schrems v. Facebook (Ireland) and invalidated the U.S.-EU Safe Harbor mechanism for transferring data. In response, the U.S. Department of Commerce immediately issued a press release.
The U.S. and the EU have been working together on addressing key concerns raised by the EU, including ‘initially’ an umbrella agreement that would allow both regimes to exchange data in both criminal and terrorist investigations. One of the last remaining components that the EU wanted to see was judicial redress for its citizens in the U.S., which has been moving through Congress just in the last month. The decision by the CJEU will most certainly speed things up and there is no reason to panic or think that EU Data Protection Authorities (DPAs) are going to immediately start enforcement proceedings against over 4,000 companies. As Commerce Secretary Pritzker stated, “The court's decision necessitates release of the updated Safe Harbor Framework as soon as possible.” Even though, technically, since there is no transition period, the transfer of EU personal data under the Safe Harbor regime is no longer valid, this does not mean companies need to immediately invoke another valid transfer method (i.e., Model Contract Clauses, consent, and Binding Corporate Rules).
First, the recent decision suggests that these other data transfer mechanisms could be impacted by the same inadequacies found to exist with the Safe Harbor program. Second, it is not likely that EU DPAs will start bringing enforcement actions against thousands of companies. Third, it is evident that this is a clear priority for both the U.S. and the EU to address quickly through a new agreement, which will be expedited quickly by both sides. Finally, the issues of judicial redress is a priority for the EU and Congress has been working quickly on during the last two months.
While it is prudent for companies to start thinking about the data that is transferred out of the EU and consider whether, for example, model contract clauses are appropriate, we do not think this decision presents quite the urgency that we have seen suggested in other opinions and articles on this topic. To discuss strategies and to get more information about the current status of the U.S.-EU negotiations and the status of key items like judicial redress, please contact the authors to review the best approach for your organization.