Calling on Member States and EU institutions to open discussions with US authorities in order to find political, legal and technical solutions to transfer data to the US, the G29 states that Model Clauses and BCRs can be used while G29 is analyzing transfer mechanisms; enforcement may begin in February 2016.
On October 16, 2015, the EU data protection authorities assembled in the Article 29 Working Party (“G29?) issued their first statement following the European Court of Justice’s October 6, 2015 decision invalidating the EU-US Safe Harbor.
The G29, after stating that it is absolutely essential to have a robust, collective and common position on the implementation of Schrems, has stated that the “question of massive and indiscriminate surveillance is a key element of the Court’s analysis” and urgently calls on “the Member States and the European institutions to open discussions with US authorities in order to find political, legal and technical solutions enabling data transfers to the territory of the United States that respect fundamental rights.”
The G29 has stated that in the meantime it will continue its analysis on the impact of Schrems on other transfer mechanisms, and “[d]uring this period, data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used.” Data protection authorities will still be able “to investigate particular cases, for instance on the basis of complaints, and to exercise their powers in order to protect individuals.”
The G29 also states that if “by the end of January 2016, no appropriate solution is found with the US authorities and depending on the assessment of the transfer tools by the Working Party, EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions”. The G29 has also reiterated the Schrems holding by stating that“transfers that are still taking place under the Safe Harbour decision after the CJEU judgment are unlawful.”
The full text of the statement can be found at http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/2015/20151016_wp29_statement_on_schrems_judgement.pdf