Brussels, 28/10/2015 (Agence Europe) - DIGITALEUROPE, which represents the digital technology industry in the EU, expressed its concern on Wednesday 28 October at the position adopted two days earlier by the German data protection authority prohibiting any new transfer of data to the US by means of alternative instruments, such as the Binding Corporate Rules (BCR), a sort of code of conduct for companies, in addition to the Safe Harbor framework that was invalidated by the Court of Justice of the EU on 6 October.
In a position paper published on 26 October, the German authority said that it would no longer be possible for US companies to negotiate new transfer clauses on this basis and that other ways of transferring data should be used. The German authorities will not permit companies to put “data export contracts” in place as the basis for data transfer to the US. They also reserve the right to challenge “model clauses” that are provided for under EU law. These standard contractual clauses are templates for transfer contracts adopted by the European Commission (governing data transfer between two data controllers or between a data controller and a processor).
The German data protection authority, which brings together the authorities of the Länder, says in its position paper that companies wishing to export data to the US may refer to a 2014 decision on respect for human rights in the electronic communications sector or to a recommendation, also dating from 2014, on cloud computing. It is also possible to transfer data on the basis of the personal consent of the user, an option provided for in the 1995 directive on personal data but one which has been deemed unworkable and very difficult to implement.
DIGITALEUROPE says that the restrictions imposed by the German regulator will hamper the commercial activities of thousands of small companies in Germany and increase their legal uncertainty. The German position is in direct contradiction with the approach being taken by the other national authorities, the association says, and also runs counter to the recommendations of the Article 29 Working Party. The Article 29 Working Party said that it would consider the impact of the “Schrems ruling” on these alternative transfer mechanisms and that, until its assessment was completed, they could still be used. The German authority's stance flies in the face of this. The European Commission, too, said in the wake of the Court ruling that, Safe Harbor having been invalidated, transfers between European and US companies could continue through these other instruments. (Original version in French by Solenn Paulic)