Today, the Court of Justice of the European Union
(CJEU) handed down its ruling in relation to the
Schrems case. As you will have heard, the Court decided that local
DPAs should be entitled to investigate matters (regardless of there
being a Commission Decision applicable) and, more importantly, that
the Commission Decision on Safe Harbor is, in fact, invalid.
DPA rights to investigate
We had all assumed that if a data transfer was subject to Safe
Harbor then that was it. You would not have expected a local DPA to
investigate Safe Harbor as that was an official decision and it
should be up to the Commission to investigate or upgrade it as
required. Then came Snowden. That put Safe Harbor under
the microscopic of course.
As a result of Snowden revelations, the Commission has been
negotiating with the US for an upgrade to the privacy principles
and FAQs. The Court, however, decided that if you read the Data
Protection Directive (the famous Article 25 in particular) together
with the EU Charter of Fundamental Rights, this must mean that DPAs
can investigate Safe Harbor data exports.
In one sense, this turns DPAs into quasi-judicial bodies. More
generally, it reflects the two key changes influencing the
Court's thinking here: (i) the Snowden revelations; and (ii)
the higher standards imposed by the Charter. Neither of these
factors were, presumably, in the Commission's "corporate
mind" when the Safe Harbor Decision was published, way back in
2000. The Charter, in particular, is featuring more frequently in
EU data protection case law.
Safe Harbor decision
The Court raised a number of criticisms of the Commission's
original Decision. The Court highlighted that:
no consideration had been given to domestic US law as to
whether it provided adequate protection for data;
the carve out for access to data for national security, crime
prevention and other purposes was too broad; and
there was no appropriate remedy for EU citizens.
In other words, there were architectural defects in the Safe
Harbor regime. These concerns were brought to light by the
surveillance revelations of Edward Snowden.
Should we panic?
No! However, it is time to think carefully about putting
alternatives to Safe Harbor in place (e.g. model contracts or
BCRs). The ICO accepts that this will take time.
Interestingly, the Commission was at pains to point out in their
press conference this afternoon that they value international trade
and that data flows with the US should continue. So this is
not about "pulling up the digital drawbridge". In
particular, they have indicated that there will be guidance
published to ensure business has certainty and clarity going
forward. They were also keen to point out that the "Safe
Harbor 2.0" currently being negotiated is well
advanced but that they need a little more time to sort out the
national security issue. Let's wait and see. The
sooner the better
We are publishing a fuller analysis of the decision
tomorrow. Please contact me if you would like a copy.
Dentons is a global firm driven to provide you with the
competitive edge in an increasingly complex and interconnected
marketplace. We were formed by the March 2013 combination of
international law firm Salans LLP, Canadian law firm Fraser Milner
Casgrain LLP (FMC) and international law firm SNR Denton.
Dentons is built on the solid foundations of three highly
regarded law firms. Each built its outstanding reputation and
valued clientele by responding to the local, regional and national
needs of a broad spectrum of clients of all sizes –
individuals; entrepreneurs; small businesses and start-ups; local,
regional and national governments and government agencies; and
mid-sized and larger private and public corporations, including
international and global entities.
Now clients benefit from more than 2,500 lawyers and
professionals in 79 locations in 52 countries across Africa, Asia
Pacific, Canada, Central Asia, Europe, the Middle East, Russia and
the CIS, the UK and the US who are committed to challenging the
status quo to offer creative, actionable business and legal
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances. Specific Questions relating to
this article should be addressed directly to the author.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).