Brussels, 27/10/2015 (Agence Europe) - Addressing the European Parliament's civil liberties committee in Strasbourg on Monday 26 October, Justice and Consumers Commissioner Vera Jourova said that agreement in principle had been reached with the US on the outlines of the new Safe Harbor framework, the initial version of which, dating from 2000, was invalidated by the Court of Justice of the EU on 6 October. At times to the great chagrin of some MEPs who oppose any new Safe Harbor, the commissioner repeated her desire to see a robust framework for the transfer of data to the United States finalised and she has been stepping up talks before travelling to the US in November. She asked MEPs to support her in what she is doing.
She said that technical-level discussions with the US had begun as soon as the ruling was delivered, as indeed did cooperation with the Article 29 Working Party, which brings together the national data protection authorities of all 28 member states. The Article 29 Working Party set a deadline of three months for the parties concerned to find a solution. The commissioner also assured MEPs that, long before the ruling, the Commission had identified shortcomings in Safe Harbor, shortcomings which it decided, in 2013, to address, calling on the US authorities to implement 13 recommendations.
Jourova also highlighted several points in the ruling that could form the basis of a new agreement with the US. The Court did not challenge the power of the Commission adequacy decisions but stated that national authorities could intervene. The Court also established that the level of data protection provided by a third country did not have to be identical but had to be of a level equivalent to that provided by the EU. “Secondly, the Court says that a system based on 'self-certification' such as the Safe Harbor is acceptable provided there are 'effective detection and supervision mechanisms'”, Jourova went on, stating that this is one of the 13 recommendations put to the Americans and that they have made a commitment to stronger oversight and to increased cooperation with European authorities. The European authorities will also have to play their part in the oversight of the new system, she said, noting that it was precisely on these points that agreement in principle had been reached with the US Department of Trade. “There is agreement on these matters in principle, but we are still discussing how to ensure that these commitments are binding enough to fully meet the requirements of the Court”, she stated.
Commissioner Jourova also announced that an annual review would be carried out of the adequacy decision with the US. The two parties are working on an annual joint review mechanism “that will cover all aspects of the functioning of the new framework, including the use of exemptions for law enforcement and national security grounds”. These national security exemptions, that would allow public authorities access to Safe Harbor data which are theoretically strictly commercial in nature, remain a stumbling block. “We are working hard with the US to do just that: to ensure that there are sufficient limitations and safeguards in place to prevent access or use of personal data on a 'generalised basis' and to ensure that there is sufficient judicial control over such activities.” This, the commissioner acknowledged, is the biggest challenge posed by the Court of Justice, it having required that access by public authorities be subject to clear conditions and restrictions. Max Schrems, the Austrian student who brought the case in the first place, accused US national security agencies, such as the NSA, of having access to data he had given to Facebook.
Jourova's position certainly did not please all of the committee: Jan-Philipp Albrecht (Greens/EFA, Germany) described the hearing as ridiculous when the commissioner confirmed that a new Safe Harbor was being prepared. Albrecht, the Parliament rapporteur on data protection, felt the commissioner had merely listened to American and European business when making her decision before taking any account of the Parliament and the Article 29 Working Party. (Original version in French by Solenn Paulic)