European data protection authorities have given the European Commission and national governments three months to come up with an alternative to the Safe Harbour agreement swept away two weeks ago by a ruling of the Court of Justice of the European Union.
Any new agreement, however, must protect the personal data of European citizens from massive and indiscriminate surveillance, which is incompatible with EU law, the data protection authorities making up the Article 29 Working Party said.
Since the CJEU ruled on 6 October that the Safe Harbour agreement between the Commission and US authorities did not offer necessary legal guarantees, businesses that relied on it for the transfer of their customers’ or employees’ private personal information from the EU to the US have been doing so in something of a legal vacuum.
The High Court triggered the CJEU’s ruling by referring some matters of law to it in a case pitting an Austrian Facebook user, Max Schrems (pictured), against the Irish Data Protection Commissioner. Schrems had complained that, in the light of the revelations of Edward Snowden about the US National Security Agency’s surveillance of data held by US companies, Facebook’s handling of his personal information did not meet EU legal requirements. Schrems appealed to the High Court after the DPC dismissed his initial complaint as “vexatious”. With the CJEU’s ruling now in, that case is set to continue today, according to Schrems.
EU law allows such information to be exported only if it can be guaranteed the same privacy protections as the data enjoys within the EU, and provides for a number of ways to provide those legal guarantees. The Safe Harbour agreement was one such, covering all transfers of data by companies that certified they met its requirements. However, the CJEU determined that the agreement, while binding on the activities of companies, imposed no such restraints on the behaviour of US law enforcers or intelligence agencies.
For the authorities making up the working party, countries where state authorities have powers to access information beyond what is necessary in a democratic society are not safe destinations for the export of personal data.
In the absence of a replacement agreement, companies must resort to time-consuming and potentially expensive ad-hoc legal arrangements, such as model contract clauses or binding corporate rules, or refrain from transferring personal data. The working party members consider that those arrangements may still be used while they complete their legal analysis of the CJEU’s decision.
In the wake of Snowden’s revelations, the Commission had already recognised that the Safe Harbour agreement did not offer sufficient protection from surveillance, and had begun negotiating new terms with US authorities.
Those negotiations could form the basis of a new agreement, the working party said, as long as it includes obligations on the necessary oversight of access by public authorities, on transparency, on proportionality, on redress mechanisms and on data protection rights
If no new agreement has been reached by the end of January, the working party warned, its members would consider coordinated enforcement actions to ensure companies complied with EU data protection requirements.
Companies still relying on the old Safe Harbour agreement are now acting unlawfully, it said, adding that they should consider what technical or legal steps they need to take to protect the personal data they handle.
IDG News Service
Subscribers 0
Fans 0
Followers 0
Followers