Brussels, 19/10/2015 (Agence Europe) - The Article 29 working party (Art. 29 WP), which brings together the 28 EU member states' national data protection authorities, has given the European institutions and governments concerned three months, until 31 January, to find legal and technical solutions to the “Schrems ruling” by the Court of Justice on the Safe Harbor arrangements for the transfer of European citizens' data to the US (see EUROPE 11404).
In adopting an opinion on the issue on 16 October, the national authorities underline that “the question of massive and indiscriminate surveillance is a key element” of the Court's decision to invalidate the Safe Harbor decision of 26 July 2000. The Art. 29 WP points out in a press release that it “has consistently stated that such surveillance is incompatible with the EU legal framework and that existing transfer tools are not the solution to this issue”.
“Furthermore, as already stated, transfers to third countries where the powers of state authorities to access information go beyond what is necessary in a democratic society will not be considered as safe destinations for transfers. In this regard, the Court's judgment requires that any adequacy decision implies a broad analysis of the third country domestic laws and international commitments”, the Art. 29 WP continues.
It calls on the member states and European institutions urgently to open discussions with US authorities in order to find political, legal and technical solutions enabling data transfers to the territory of the US that respect fundamental rights. The current negotiations on a new intergovernmental agreement could be “a part of the solution”, the Art 29 WP suggests. In any case, these solutions “should always be assisted by clear and binding mechanisms and include at least obligations on the necessary oversight of access by public authorities, on transparency, on proportionality, on redress mechanisms and on data protection rights”, it states.
In the meantime, the Art. 29 WP will continue its assessment of the impact of the Court of Justice ruling on other transfer tools (compulsory provisions for businesses, standard contractual clauses) but is of the view that, during this period, these tools may still be used by companies. The data protection authorities say, however, that this will not prevent them from investigating particular cases, for instance, on the basis of complaints. The Art. 29 WP reserves the right to take coordinated enforcement action if no appropriate solution is found by the end of January. (Original version in French by Solenn Paulic)