Christopher Cwalina is a Partner and Norma Krayem is a Senior Policy Advisor in the Washington D.C. office
Today, October 6, the Court of Justice of the European Union
(CJEU) decided to agree in large part with the
Advocate General's recommendation in the matter Schrems v.
Facebook (Ireland) and invalidated the U.S.-EU Safe Harbor
mechanism for transferring data. In response, the U.S. Department
of Commerce immediately issued a press
release.
The U.S. and the EU have been working together on addressing key
concerns raised by the EU, including 'initially' an
umbrella agreement that would allow both regimes to exchange data
in both criminal and terrorist investigations. One of the last
remaining components that the EU wanted to see was judicial redress
for its citizens in the U.S., which has been moving through
Congress just in the last month. The decision by the CJEU will most
certainly speed things up and there is no reason to panic or think
that EU Data Protection Authorities (DPAs) are going to immediately
start enforcement proceedings against over 4,000 companies. As
Commerce Secretary Pritzker stated, "The court's decision
necessitates release of the updated Safe Harbor Framework as soon
as possible." Even though, technically, since there is no
transition period, the transfer of EU personal data under the Safe
Harbor regime is no longer valid, this does not mean companies need
to immediately invoke another valid transfer method (i.e., Model
Contract Clauses, consent, and Binding Corporate Rules).
First, the recent decision suggests that these other data transfer
mechanisms could be impacted by the same inadequacies found to
exist with the Safe Harbor program. Second, it is not likely that
EU DPAs will start bringing enforcement actions against thousands
of companies. Third, it is evident that this is a clear priority
for both the U.S. and the EU to address quickly through a new
agreement, which will be expedited quickly by both sides. Finally,
the issues of judicial redress is a priority for the EU and
Congress has been working quickly on during the last two
months.
While it is prudent for companies to start thinking about the data
that is transferred out of the EU and consider whether, for
example, model contract clauses are appropriate, we do not think
this decision presents quite the urgency that we have seen
suggested in other opinions and articles on this topic. To discuss
strategies and to get more information about the current status of
the U.S.-EU negotiations and the status of key items like judicial
redress, please contact the authors to review the best approach for
your organization.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.