On 16 July 2020 the Court of Justice of the European Union issued a preliminary ruling with significant importance regarding the instruments for transfer of personal data outside the EU to the so called “third countries”, in particular to the US.
.png)
On 16 July 2020 the Court of Justice of the European Union (CJEU) issued a preliminary ruling with significant importance regarding the instruments for transfer of personal data outside EU to so called “third countries”, in particular to the US.
Why it has come this far?
The request for a preliminary ruling was made in connection with the actions of Austrian privacy activist Mr. Maximillian Schrems who turned to the Irish Data Protection Commissioner asking for the suspension of the transfers of his data as Facebook’s user made by Facebook to the US, at this stage mainly based on the Standard Contractual Clauses (SCC). After the invalidation of Safe Harbour framework that was previously in place for EU-US data transfers (the Schrems I case), Mr. Schrems argued that the SCC do not provide a sufficient level of personal data protection in transfers from the EU to the US, since the rules in the US create conditions for disregard for the contractual obligations of legal persons (in this case of Facebook) in connection with the SCC concluded by them. In the meantime, a new framework – the EU-US Privacy Shield – was adopted and its validity was also put into question with the reference to the CJEU.
What are the key takeaways from the CJEU’s judgement?
(1) the US local laws enabling access and use of public authorities (via different surveillance programs) to personal data for national security, public interest and law enforcement purposes set limitations on personal data protection that are not proportionate and limited to what is strictly necessary as required by the EU law;
(2) the Ombudsperson mechanism in the Privacy-Shield framework does not provide data subjects with any cause of action before a body which offers guarantees substantially equivalent to those required by EU law, because the Ombudsperson:
(a) cannot be considered independent, as is appointed by the US Secretary of State and is an integral part of the US State Department, and
(b) is not empowered to adopt binding decisions on the US intelligence services.
According to CJEU, the Decision establishing the SCC contains effective mechanisms that make it practically possible to ensure compliance with the EU required level of protection and to suspend or prohibit the transfer in the event of the breach of the SCC or in case it becomes impossible to honour them. These mechanisms are:
(1) the obligation of the data exporter and the data recipient to verify, prior to any transfer, whether that level of protection is respected in the third country, and
(2) the requirement for the recipient to inform the data exporter of any inability to comply with the SCC, the latter then being, in turn, obliged to suspend the transfer of data and/or to terminate the contract with the former.
(1) in the light of all the circumstances of the case, they consider:
(a) the SCC are not or cannot be complied with in that third country, and
(b) the protection of the data transferred that is required by EU law cannot be ensured by other means, and
(2) the EU-data exporter has not itself suspended or put an end to this transfer.
Why this decision is important?
The CJEU’s decision is crucial, because it reaffirms the problems regarding the EU-US data transfers identified years ago with the invalidation of Safe Harbour mechanism. It means that the EU will maintain its policy to insist on ensuring the highest possible data protection standards in its relations with third countries. The CJEU’s decision is a strong message to US government calling for implementation of additional safeguards in terms of data protection-national security paradigm.
For the business it means future uncertainties on how to lawfully arrange data transfers to third countries, especially to US, because:
A probable solution could be a new privacy deal struck between EU and US, but in order to avoid the faith of Safe Harbour and the Privacy Shield, it needs to carefully address the issues identified by the CJEU that led to the invalidation of these tools.
Lastly, it seems likely to expect proactive approach from Member State supervisory authorities in terms of data transfers, especially in the light of their newly reaffirmed powers to suspend or prohibit a transfer based on SCCin certain cases where the effective compliance with the SCC in the third country or the level of data protection required by EU cannot be fully achieved.
Useful links:
