Policy Observatory

On Monday, October 26, 2015, EU Commissioner for Justice, Consumers and Gender Equality, Věra Jourová, gave a speech before the European Parliament’s Committee on Civil Liberties, Justice and Home Affairs on the recent ruling by the Court of Justice of the European Union that invalidated the European Commission’s Safe Harbor Decision. The EU Commissioner welcomed the Article 29 Working Party’s statement and, in particular, its support for a new Safe Harbor framework by January 31, 2016. However, the EU Commissioner called for more clarity in the meantime. Accordingly, she announced that the European Commission will soon issue an explanatory document on the consequences of the CJEU’s ruling to provide guidance for businesses on international data transfers.

The Court of Justice of the European Union recently held that personal data cannot be transferred between two public bodies, and subject to further processing, without the data subjects concerned having been informed in advance (Smaranda Bara and Others v Președintele Casei Naționale de Asigurări de Sănătate, Casa Națională de Asigurări de Sănătate, Agenția Națională de Administrare Fiscală (ANAF), Case C-201/14).

The European Union on Monday said it had agreed in principle with the US on a new trans-Atlantic data-transfer agreement. The negotiations between the EU and U.S. became more urgent after the court’s ruling, which raises questions about how much legal certainty a new version could bring businesses because it enshrines the power for national data protection authorities to independently review, and potentially suspend, data transfers to the U.S.

Following the announcement on the 6th October, the Article 29 Working Party issued a statement regarding the Safe Harbor Decision (Schrems v. Data Protection Commissioner (C-362- 14). Article 29 Working Party calls for a robust, collective and common position on the implementation of the judgment urging Member States and the European institutions to open discussions with US authorities in order to find political, legal and  technical solutions enabling data transfers to the territory of the United States that respect fundamental rights.

Read the statement from the Article 29 Working Party.

By a decision published this morning, the Court of Justice of the European Union (CJEU), the highest European jurisdiction, repealed the Safe Harbor agreement. This agreement in effect since 2000, allows data transfers between Europe and the United States under different versions, authorised the processing of European citizens' data by US companies, with fewer guarantees than those existing in Europe.

Max Schrems, an Austrian citizen, has put Facebook on trial since the monitoring by the NSA of his data hosted by Facebook had an impact on his freedom and privacy. The CJEU today confirmed his viewpoint by invalidating the Safe Harbor and held that the European Commission abused its power by approving it. The CJEU also affirmed that a local data protection authority may dissent a European agreement if guarantees granted to citizens were modified.

Negotiators in the European Union and the United States have agreed on a stop-gap measure to allow companies to transfer private data overseas. But the “EU-US Privacy Shield” is not likely to withstand legal challenge. To protect privacy, we need reform, not rebranding.