Policy Observatory

In the weeks since the October 6, 2015, Court of Justice of the European Union decision that invalidated the EU-U.S. Safe Harbor framework, companies have been faced with the quandary of establishing legal alternatives for transferring personal data from Europe to the U.S.

Alternative data transfer mechanisms such as standard contractual clauses (SCCs, also called model clauses) and binding corporate rules (BCRs) were implicitly endorsed by the European Commission, but not all European countries, however, have taken this position.

On Monday, October 26, a group of German data protection authorities representing the federal government and 16 German states issued a 14-point position paper (available in German here) following the CJEU Decision.

Read about the most significant findings here.

The US government has asked to be joined as a party in the Irish High Court case between the Austrian privacy activist and lawyer Max Schrems, and the social network Facebook. The American Chamber of Commerce, Business Software Alliance, and the Irish Business and Employers Confederation also asked to join the procedure, as these organisations’ members also use standard contractual clauses to transfer data to the United States.

The Irish High Court refers Facebook privacy case to the Court of Justice of the European Unionin order to determine the legal status of data transfers under Standard Contractual Clauses. Therefore, Facebook could face questions from the CJEU about the validity of the model clauses it uses to transfer data outside of the 28-member-state bloc.