Privacy & Information Security Law Blog

On November 6, 2015, the European Commission published a communication and a Q&A document addressed to the European Parliament and European Council on the transfer of personal data from the EU to the U.S. under EU Data Protection Directive 95/46/EC (the “Directive”), following the decision by the Court of Justice of the European Union invalidating the European Commission’s Safe Harbor Decision.

In the communication, the European Commission stated that it has intensified its discussion with the U.S. Government and confirmed its objective to finish the discussions for an updated framework for transatlantic transfers of personal data “in 3 months.” According to the Commission, the updated framework must provide sufficient limitations and safeguards to ensure the continued protection of EU citizens’ personal data, including with respect to access by public authorities for law enforcement and national security purposes.

The European Commission also stated that alternative data transfer mechanisms can still be used by companies for lawful data transfers to countries outside of the EU, such as the United States. The European Commission provided guidance with respect to these alternative data transfer mechanisms. This guidance, however, does not restrict the powers and duties of data protection authorities (“DPAs”) to examine the lawfulness of cross-border transfers. The guidance states that transfers may be carried out using alternative data transfer mechanisms, including:

Contractual Solutions

Standard Contractual Clauses (“SCCs”), using the sets of model clauses provided by the European Commission. SCCs include obligations for the protection of personal data and allow data subjects to invoke the rights provided them in the contractual clauses before a DPA or a court of the EU Member State in which the data exporter is established. Model clauses are, in principle, automatically accepted by national authorities, with the exception of certain Member States that maintain a system of notification or pre-authorization of the clauses. In addition, companies can rely on ad hoc contractual agreements, subject to approval by DPAs on a case-by-case basis.

Intra-Group Transfers

Binding Corporate Rules (“BCRs”) provide a basis for intra-group transfers of personal data and ensure sufficient protection of personal data throughout a group of affiliated entities. BCRs are subject to an authorization procedure in each Member State from which the group of related entities intends to transfer data. These rules are binding for the group of related entities, but also enforceable in the EU, where third party beneficiaries can lodge complaints before a DPA or a national court to enforce compliance with the rules.

Derogations

Derogations are expressly listed in Article 26 (1) and (a) to (f) of the Directive, under which data can be transferred when one of the following derogations applies: (1) unambiguous consent of the data subject has been obtained; (2) conclusion or performance of a contract, including pre-contractual situations; and (3) establishment, exercise or defense of legal claims.

The communication stated that these derogations are strictly interpreted, and that for repeated, mass or structural transfers, companies should use a specific legal framework such as SCCs or BCRs. In addition, according to the communication, the derogation based on the data subject’s free and informed consent is an option of last resort.

The European Commission also identified two important conditions for the use of alternative data transfer mechanisms. First, the Commission stated that data must be originally collected and further processed by the data controller in accordance with national laws implementing the Directive, regardless of the legal basis for cross-border transfer on which the controller relies. Second, the Commission reaffirmed that when using alternative data transfer mechanisms, data exporters and importers still bear the responsibility to ensure that transfers comply with the safeguards set out in the Directive, which should be considered in the context of the transfer.

Although the scope of the judgment is limited to the Safe Harbor Decision, the European Commission will now prepare a decision to replace the provision included in all the other adequacy decisions that limits the powers of DPAs. Further, the Commission will regularly assess, together with the DPAs, existing and future adequacy decisions.

The European Commission also invited controllers to cooperate with the DPAs and stated that it will work closely with the Article 29 Working Party to ensure the harmonized application of EU data protection law.

Read the press release of the European Commission.