The EU’s Article 29 Working Party (Art. 29 WP) has now provided guidance on alternative mechanisms for transferring data from the EU to the U.S. after the popular U.S.-EU Safe Harbor mechanism was invalidated by the European Court of Justice (ECJ). The Art. 29 WP guidance, like the ECJ decision, focuses on “massive and indiscriminate surveillance” by the U.S. government, an issue that cannot easily be resolved by any current EU-U.S. data transfer mechanism.
Nevertheless, the Art. 29 WP guidance reassures companies that Standard Contractual Clauses and Binding Corporate Rules are viable data transfer mechanisms for at least the next few months. Unfortunately, the guidance also makes clear that those alternative mechanisms will be subject to investigation and invalidation by individual member states, and that all data transfers from the E.U. to the U.S., regardless of mechanism, are subject to scrutiny by member states and challenges by affected individuals.
The Art. 29 WP guidance gives the EU and U.S. institutions until the end of January 2016 to hammer out an arrangement that adequately protects the fundamental privacy rights of EU citizens. If no solution emerges, the “EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions.”
For more information, please see our Client Alert on the Art. 29 WP statement.