Data Protection: What's happening?
The beginning of October saw the European Court of Justice rule that US Safe Harbour provisions were invalid with immediate effect. At the time, there was much media frenzy regarding the effect of this decision.
A summary of the case and the immediate consequences can be found here.
So, one month on, is the picture any clearer?
Well, the issues remain the same. The Court has not changed its mind. Safe Harbour remains out of play for now. Whilst discussions are ongoing between the EU and the US, these are going to take some time to come to fruition. It is anticipated that the outcome will include measures to enforce boundaries on US government access to the data of EU citizens (which was one of the issues that led the downfall of Safe Harbour).
The EU Commission published the long awaited guidance for businesses affected by the Court's decision. Unfortunately it does little more than confirm that which was already known to any data protection expert.
Can I still transfer personal data to the US?
Yes you can, but see below.
Safe Harbour may be no more, at least until Safe Harbour 2.0 is in place. But there are other options that can be utilised; options that are not new. The first is to adopt what are known as model clauses in your contracts. The EU has published sets of contractual terms that manage the transfer of personal data within appropriate safeguards. Where data is transferred in between companies in the same group, binding corporate rules can be adopted within the group. Like model clauses, binding corporate rules set down appropriate safeguards that will apply as data is transferred between multi-national group companies.
Thirdly, personal data can be transferred if you have the unambiguous consent of the data subject to transfer that data. Practically, this is not without its issues, not least where you are seeking to transfer data that you already hold.
There are a number of other derogations that can also be relied on, but each is narrowly construed. Pending the outcome of Safe Harbour 2.0, we recommend that you revisit any arrangements that you have to transfer personal data to the US. Our data protection specialists will ensure that you have appropriate safeguards in place to ensure that any personal data is transferred legally.
For more information, contact Matthew Holman.