/>iThe article “Data Transfers” by of counsel Dr. Axel Spies provides some additional color on the hot topic of international data transfers. The Advocate General at the European Court of Justice (ECJ) recently ruled that suspending transfers of personal data to the United States by Safe Harbor-certified organizations would be justified under “exceptional circumstances.” Soon thereafter, the ECJ ruled that the Safe Harbor program is invalid (as we noted in an October 8 post).
In response to the ECJ’s ruling, some initial guidance has already begun to emerge. For example, the Article 29 Data Protection Working Party (which is made up of the representatives of the Data Protection Agencies of the EU member states and advises the EU Commission on data protection matters) recently issued a statement that included
|
(i) |
a call to action for member states of the European Union to negotiate data transfer solutions with the United States (one potential solution being a new Safe Harbor program), |
|
(ii) |
a statement that data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used (subject to justified data protection authority investigations), |
|
(iii) |
a deadline of January 2016 for finding such negotiated solutions, and |
|
(iv) |
a statement that data transfers under the existing Safe Harbor program are now unlawful. |
In addition, Israel’s Law, Information and Technology Authority recently announced that organizations can no longer rely on the Safe Harbor as a basis for transferring personal data from Israel to organizations in the United States. Whether other non-EU member states will follow Israel’s example with similar statements or prohibitions remains to be seen.
We expect that there is much more to come on this topic as businesses attempt to develop solutions to issues with personal data transfers the United States in light of the ECJ’s ruling against the Safe Harbor program. We will post on this subject as new issues and guidance emerge.
