The European Commission has announced that it has reached an agreement with the United States government for a new framework for transatlantic flows of personal data. This framework is to replace the Safe Harbor scheme which the Court of Justice of the European Union declared invalid in October last year.
The European Commission’s press release states that the EU-US Privacy Shield “reflects the requirements set by the European Court of Justice“.
However, at this stage only political agreement has been reached and Vice President Ansip and Commissioner Jourová have been mandated to take the necessary steps to put the arrangement in place. In particular, they will need to turn to the Article 29 Working Party to obtain their advice before publishing a formal “adequacy” decision. Both sides will then need to put the detailed framework in place.
The European Commission have, however, thrown some light on some of the features of the arrangement as follows:
We anticipate that the framework will be established within the next three or four months. So, in the short-term, businesses should continue to use the Commission’s model clauses or binding corporate rules for intra-group transfers to legitimise transatlantic transfer of data.
Undoubtedly questions will be raised about the strength of the features of the arrangement. For example, the legal strength of the written assurances regarding the surveillance activities of US enforcement and security agencies is unclear. Also, the rights of redress for consumers appear to be a complaints mechanism together with alternative dispute resolution; falling short of any right of action before any court or tribunal. There may, therefore, be a few bumps in the road for the Privacy Shield before it is established and, even then, there is always the possibility that the European Court of Justice will again hear a case which brings into question the adequacy of the arrangement.
We will, therefore, keep a keen eye on the area of transatlantic transfers of personal data, and we recommend that businesses do the same.