Background

In 1998, the European Commission’s went into effect, which prohibited transferring personal data of EU citizens to jurisdictions outside the European Economic Area that did not have “adequate” levels of data protection. To ensure that data could be transmitted from Europe to the US, the US Department of Commerce and European Commission developed the , which allowed US companies to self-certify that they adhere to seven principles and fifteen frequently asked questions outlined in the Directive, and thus have adequate levels of data protection.

Only US companies that are subject to the Federal Trade Commission (FTC) or Department of Transportation (DOT) are eligible for the Safe Harbour program. Therefore, financial institutions, telecommunication common carriers, labour associations, and non-profit organizations are generally excluded, and are subject to other data protection requirements.

Court of Justice of the European Union’s Decision

The European Court of Justice (ECJ), the highest court in the European Union on matters of European law, that European Commission decision 2000/520, which approved the Safe Harbour framework, is invalid. The ECJ also found that national Data Protection Authorities have the ability to investigate whether countries outside the EU have sufficient levels of data protection, even after the European Commission has issued a decision.

Maximillian Schrems, an Austrian citizen, challenged Facebook’s transfer of his personal data from Facebook’s Irish subsidiary to the US before the Irish Data Protection Authority. He argued that because Facebook stored personal data in the US, that personal data could be accessed by the US intelligence services such as the National Security Agency (NSA), thus it was not afforded adequate protection as defined by the Directive on Data Protection.

After the Irish Data Protection Authority refused to hear the claim, Mr. Schrems brought the action to the Irish High Court. The High Court stayed the proceedings and referred the matter to the ECJ.

The ECJ that, despite the Safe Harbour program, “United States authorities were able to access the personal data transferred from the Member States to the United States and process it in a way incompatible, in particular, with the purposes for which it was transferred, beyond what was strictly necessary and proportionate to the protection of national security.” The ECJ also found that EU citizens do not have legal remedies to correct or delete their data. Therefore, the ECJ found that the Safe Habour program does not provide the level of protection of fundamental rights that are equivalent to those guaranteed by the .

What Now?

The Irish Data Protection Authority is now required to examine Mr. Schrems’ complaint and determine whether transfer of the data of Facebook’s European subscribers to the United States should be suspended.

The US Department of Commerce acknowledges the ECJ’s decision, but has indicated that it will US businesses that wish to participate in the Safe Harbour program in view of the “current rapidly changing environment”.

Companies such as have expressed that they will continue operating as usual, arguing that their privacy and data protection policies are compliant with the Directive on Data Protection. In addition to certifying with the Safe Harbour program, some companies have put in place additional safeguards such as to govern the transfer of data outside the European Economic Area.

Canada’s data protection laws provide adequate protection as defined by the Directive on Data Protection; Canadian businesses’ operations with the EU are not affected (See Cassels Brock ).

Analysis

Although protection of personal information is undeniably a laudable goal, invalidating frameworks that govern international transfer of data does not achieve that end. Without international frameworks, companies that collect, use, and transfer personal information will be pushed to store data within national borders to ensure compliance with domestic legislation. Although technically possible, this hampers the free and efficient flow of data and commerce. Citizens of every country should have easy access to the global economy and international flow of information.

International frameworks with stronger oversight and enforcement mechanisms should be enacted that create a balance between protection of personal information and the global nature of today’s economy. If courts are worried about protection of personal information, they should turn their minds to intelligence agencies or companies that misappropriate data about individuals, not frameworks that aim to protect personal information.

Lisa Hartman is a JD Candidate at Osgoode Hall Law School and is enrolled in Osgoode’s Intellectual Property Law Intensive Program. As part of the program requirements, students were asked to write a blog on a topic of their choice.

The post US: Safe Harbour No Longer appeared first on IPOsgoode.

On Friday, October 16, 2015, the Article 29 Working Party (“WP29”) released a on the decision of the Court of Justice of the European Union (“CJEU”) in the case , the landmark decision which invalidated the decision of the European Commission underpinning the Safe Harbour framework by which personal information was permitted to move from the EU to the United States.

Status of Model Contract Clauses and Binding Corporate Rules

The WP29 stated that it was still considering the Schrems decision and acknowledged the uncertainty that the decision had caused, emphasizing that “data protection authorities (“DPAs”) consider that it is absolutely essential to have a robust, collective and common position on the implementation of the judgment.”

During the WP29’s evaluation period, it suggests that certain similar mechanisms for rendering lawful a transfer of data from the EU to the United States remain valid. In particular, WP29 advises that during its evaluation period, “data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used”. Accordingly, while certain data protection commissioners have doubted the validity of these mechanisms, it appears that the majority of commissioners will accept them as legitimate at least for a transitional period. WP29 goes on to note, however, that this will not prevent DPAs from investigating individual cases.

Transfers Considered Unlawful – Enforcement by January 1, 2016

The WP29 also unequivocally stated its view that “it is clear that transfers from the European Union to the United States can no longer be framed on the basis of the European Commission adequacy decision 2000/520/EC (the so-called “Safe Harbour decision”).” It then goes on to say that (emphasis added) “transfers that are still taking place under the Safe Harbour decision after the CJEU judgment are unlawful.”

Businesses will have a short timeline in which to bring themselves into compliance. The WP 29 has set a 3-month deadline for the EU and United States to conclude negotiations and implement a new safe harbour regime. It has warned that “[i]f by the end of January 2016, no appropriate solution is found with U.S. authorities and depending on the assessment of the transfer tools by the Working Party, EU data protection authorities are committed to take all necessary and appropriate actions, which may include coordinated enforcement actions.”

Other Points in the WP29 Statement

In WP29’s view, the “the question of massive and indiscriminate surveillance is a key element of the Court’s analysis” in Schrems and warned that such surveillance is “is incompatible with the EU legal framework” and warned that the transfer of personal information to third countries “where the powers of state authorities to access information go beyond what is necessary in a democratic society will not be considered as safe destinations for transfers.”

This implies that any future adequacy decisions from DPAs will undertake a broad analysis of the third country’s domestic laws and international commitments. In this regard, there is a risk that Canada’s PIPEDA will be called into question in light of this country’s relationship (formal and otherwise) with the United States and Canada’s recent data legislation (in particular Bill C-51, introduced by the Canadian federal government and affording Canadian law enforcement officials greater access to data). It is an open question as to whether this constellation of factors could push Canada into the realm of “inadequate” safeguards insofar as the EU is concerned.

Likewise, there remains a risk that other bases for sending data from the EU to the United States will be threatened by this interpretation of Schrems. In particular, in a number of circumstances, it is unclear whether an importer of data in the United States can make the strong warranties required by the model contract clauses or the binding corporate rules, if similar guarantees were deemed inadequate under the now-invalidated Safe Harbour regime.

Businesses will want to pay close attention to the ongoing Safe Harbour negotiations between the EU and the United States, and in the interim, seriously consider rerouting data flows, evaluate the risks and benefits of model contract clauses and binding corporate rules, and re-evaluate their collection and transfer of personal information where possible.

© McCarthy Tétrault LLP

is Counsel in McCarthy Tétrault’s National Technology Group. is an IP Osgoode Advisory Board member and a senior partner with McCarthy Tétrault in the Toronto office. He is the former Co-Chair of the firm’s Technology Law Group and was the head of the firm’s Internet and Electronic Commerce Group.  is a partner in McCarthy Tétrault’s Intellectual Property Group and a member of the Privacy, Technology, Franchise & Distribution, and Appellate Groups. is the national leader of McCarthy Tétrault’s Information Technology Law Group and co-leader of the Firm’s national Cybersecurity, Privacy and Data Protection Group.

The post Data Transfers from EU to US “unlawful”; EU Signals Enforcement Actions Possible After January, 2016 appeared first on IPOsgoode.

The re-posting of this is part of a cross-posting collaboration with MediaLaws: Law and Policy of the Media in a Comparative Perspective.

The post The Court of Justice Declares that the Commission’s US Safe Harbour Decision is Invalid appeared first on IPOsgoode.