On October 6th, the Court of Justice of the European Union (CJEU) issued its judgment in response to a request made by the Irish High Court in July 2014 for a preliminary ruling in the case of Maximillian Schrems v Data Protection Commissioner, and in doing so, declared the Commission’s July 2000 Decision “on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce” to be invalid.
In principle, under the Data Protection Directive, one of the ways that the transfer of personal data to a third country outside the European Economic Area may take place is if that third country ensures an adequate level of protection for the personal data. Under this clause, over 4,000 companies which had signed up to the “Safe Harbour” principles, the majority of which are SMEs, were able to self-certify that they abided by EU-strength data protection standards and so demonstrate entitlement to receive personal data from the EEA.
The CJEU decision was not unexpected. Apart from Advocate-General Bot’s opinion, published last week, which also recommended the invalidation of the Commission’s 2000 vintage Safe Harbour decision, EU and US negotiators are also said to have been working on a new, updated version of the current Safe Harbour framework. The decision of the CJEU is bound to generate further uncertainty for providers of a wide range of services, as well as for their users.
“Everyone loses out from a lack of legal certainty on data transfers”, said Maël Brunet, Director of OpenForum Europe. “Now, more than ever, we need clear, predictable rules that allow ICT companies on both sides of the Atlantic to continue to provide their services. The Commission and DPAs urgently need to provide guidance. Europe cannot isolate itself from the rest of the world.”
For more information, please contact OFE’s CEO Graham Taylor at graham@openforumeurope.org or OFE’s Director in charge of European Policy & Government Relations Maël Brunet at +32 2 210 02 80 or mael@openforumeurope.org.
About OpenForum Europe
(OFE) is an independent, not-for-profit organisation, supported by major IT suppliers including Google, IBM, Oracle and Red Hat, as well as SMEs, user and consumer organisations, and national partners across Europe. It focuses on delivering an open, competitive ICT market. Views expressed by OFE do not necessarily reflect those held by all its supporters.