Means, Other Than Safe Harbor, of Transferring Personal Data to the U.S. Potentially Vitiated?

McGuireWoods LLP
Contact

After the decision of October 6, 2015, of the Court of Justice of the EU (CJEU) invalidating the decision from the EU Commission (Decision 2000/520) on the Safe Harbor, transfer of personal data to the U.S. based on Standard Contractual Clauses and other means provided by article 26 of the Directive 95/46 are in principle still valid.  Will this remain? The Schleswig-Holstein (Germany) Data Protection Authority (DPA) is the first DPA to officially express in a position paper that it could use its power to suspend or prohibit these transfers. The argument of this DPA is in line with the issues that the CJEU pointed out in its decision of October 6, 2015; the U.S. does not offer the required level of protection for two main reasons:

1) The U.S. authorizes, on a general basis, storage of all personal data of all persons whose data are transferred from the EU without differentiation, limitation or exception being made in light of the objective pursued and without objective criteria to limit the access of public authorities to the data and its subsequent use.

2)  The U.S. does not provide legal avenues for individuals to access their personal data or to obtain rectification or erasure of such data; this compromises the essence of the fundamental right to effective judicial protection, such protection being inherent in the existence of the rule of law.

Since these shortcomings can be solved only by a modification of the U.S. legal landscape, this DPA considers that it could suspend or prohibit personal data to the U.S. based on Standard Contractual Clauses and other means of transfer.  

For more information on the EU-US transfers, please also refer to the following prior Password Protected blog posts:

CJEU Declares the EU Commission Safe Harbor Decision Invalid

Advocate General Bot Proposes That CJEU Declare the Safe Harbor Invalid

European Hearing on the Future of Safe Harbor

FTC Serious About Safe Harbor Framework Enforcement

EU and U.S. Reach “Umbrella Agreement” on Data Transfers

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations. Attorney Advertising.

© McGuireWoods LLP

Written by:

McGuireWoods LLP
Contact
more
less

PUBLISH YOUR CONTENT ON JD SUPRA NOW

  • Increased visibility
  • Actionable analytics
  • Ongoing guidance

McGuireWoods LLP on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide