Brussels, 08/10/2015 (Agence Europe) - The Article 29 Working Party, which brings together the national data protection authorities of the 28 member states, welcomed the ruling delivered by the Court of Justice of the EU in the Schrems/Safe Harbor case on Tuesday 6 October (see EUROPE 11404). This ruling reaffirms that “data protection rights are an inherent part of the EU fundamental rights regime”, it said in a press release on Tuesday evening.
The national data protection authorities also point out that the Court concluded that their powers were not reduced by the existence of the Safe Harbor decision by the European Commission. As a consequence, data protection authorities must always have the possibility to investigate, with complete independence, a complaint alleging that a third country does not ensure an adequate level of protection of the personal data transferred, the Article 29 Working Party states.
It says that, for several years, the Working Party has been studying the impact of mass surveillance on international transfers and has on several occasions presented its concerns. The 6 October ruling confirms that due, in particular, to the existence of mass surveillance and the absence of possibility for an individual to pursue legal remedies in order to have access and to obtain rectification or erasure, “serious questions exist regarding the continuity of the level of data protection when data are transferred to the United States”, the press release continues. The United States has pledged in talks on the general transatlantic framework agreement on data protection to allow European citizens the right of redress in the US. The Judicial Redress Act has not yet been passed by Congress, however.
A technical meeting was arranged in Brussels on Thursday 8 October to assess the initial consequences of the ruling and a second is expected to follow next week. On 6 October, the Commission said it would publish guidance on the ruling for companies affected. On 7 October, Commission experts confirmed that the annulment of the Safe Harbor agreement was retrospective, thus making illegal all Safe Harbor transfers of data to the United States over the last 15 years. The data flow will not, however, be illegal if conducted under other instruments such as, for example, special business clauses or on the basis of derogations contained in the 1995 data protection directive. Companies will have to demonstrate that the use of these alternative data transfer instruments also comply with European data protection standards. They will also be required to provide retrospective evidence if complaints are lodged against them. Facebook, which is directly concerned in this case, has indicated that it will continue to transfer European citizens' data to the United States by means of the alternative instruments.
The ALDE Group in the European Parliament wrote to the Commission on Thursday 8 October asking it swiftly to draw the conclusions of this ruling which creates a void and it calls for legal clarity. (Original version in French by Solenn Paulic)