For more information, please contact:
Tel: + 49 (0) 89 55 23 8 200
Tel: 49 (0) 69 29 908 180
European Parliament votes to approve EU Data Protection Regulation and to suspend Safe Harbor
1. European Parliament Vote
On March 12, 2014, the European Parliament voted in a plenary session to fully endorse the revised draft EU Data Protection Regulation (“Regulation”) and the draft EU resolution (“Resolution”) which, among others, call for the suspension of Commission Decision 520/2000 which approves the Safe Harbor privacy principles and the related FAQs issued by the U.S. Department of Commerce (“Safe Harbor”). Both the Regulation and the Resolution had been debated and adopted by the European Parliament’s Civil Liberties Committee, the “LIBE” Committee, just a few months before.
2. EU Data Protection Regulation
The Regulation will replace the existing EU Data Protection Directive 95/46/EC and aims at harmonizing and renewing the rules on the collection, processing and use of personal data on an EU-wide level.
Some of the most important changes are the introduction of:
· Severe fines of up to 5% of a company’s annual global turnover or EUR 100 million whichever is greater;
· Broader, extra-territorial scope of application to businesses established in the EU and also to businesses outside the EU that offer goods or services to European customers and process their personal data;
· Requirement for businesses to adopt all reasonable measures to implement compliance procedures that respect the choices of data subjects which should be reviewed every two years, and to implement privacy by design, keep detailed documentation, carry out privacy impact assessments as well as to appoint data protection officers.
The Regulation was originally presented by the European Commission in January 2012 and its adoption has been postponed various times due to difficulties of the Member States and the
Tel: + 49 (0) 89 55 238 155
Dr. Holger Lutz, LL.M.
Tel: + 49 (0) 69 29 908 638
Tel: + 49 (0) 89 55 238 156
European Parliament in adopting a common position, numerous amendments and severe lobbying activity. The recent vote of the European Parliament now paves the way for the European Parliament to enter into negotiations on the final text of the Regulation with the EU Council. Given the previous course of the adoption process however, negotiations with the EU Council will no doubt be lengthy and the EU institutions’ aim of finalizing the Regulation by the end of 2014 seems rather ambitious.
3. Suspension of Safe Harbor
The Resolution was adopted as a response to the U.S. NSA surveillance scandal and to the calls of, above all, the German data protection authorities to suspend Safe Harbor and suspend or no longer authorize transfers of personal data from the EU to the U.S. It comprises several rather drastic recommendations, the most important of which is a call for suspension of Safe Harbor.
However, negotiations on the Resolution with the European Commission will once again be tough: The European Commission has already implemented its own EU-U.S. working group to assess the impact of the NSA surveillance program on European citizens and to present recommendations in order to strengthen Safe Harbor and to restore trust in the framework by creating more transparency. According to the working group, measures to achieve this are in particular:
· Use of existing mutual legal assistance agreements for obtaining personal data (e.g., EU-U.S. Agreement of 2010)
· Strengthening data protection safeguards in the law enforcement area;
· Ex officio investigations of Safe Harbor-certified companies.
In November 2013, the European Commission presented the working group’s report and called on the U.S. to implement the recommended measures until summer 2014. After that, the European Commission plans to reassess Safe Harbor in light of the possible changes implemented by the U.S.
Therefore, it is rather unlikely that the European Commission will endorse the Resolution – at least not before summer 2014 or even later. The Commission’s actions show that it has a certain interest in maintaining Safe Harbor. Even if it decides to suspend Safe Harbor – which it could do if it deems that the framework no longer ensures sufficient data protection, the decision would be subject to a Council vote which would require a qualified majority of the Member States.
Tel: + 49 (0) 89 55 238 242
Tel: + 49 (0) 89 55 238 217
Baker & McKenzie - Partnerschaft von Rechtsanwälten, Wirtschaftsprüfern, Steuerberatern und Solicitors is a professional partnership under German law with its registered offices in Frankfurt/Main, registered with the Local Court of Frankfurt/Main at PR No. 1602. It is associated with Baker & McKenzie International, a Verein organized under the laws of Switzerland. Members of Baker & McKenzie International are Baker & McKenzie law firms around the world. In common with terminology used in professional service organizations, reference to a "partner" means a professional who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm.