L4D Learning for Democracy

The European data protection authorities assembled in the Article 29 Working Party take note of the milestone decision of the Court of Justice of the European Union (CJEU) of 6 October 2015 in the Maximilian Schrems v Data Protection Commissioner ruling and that the European Commission decision 2000/250 (the so-called “Safe Harbor decision”) is invalid. 
The Working Party welcomes the fact that the Court’s decision reaffirms that data protection rights are an inherent part of the EU fundamental rights regime.
The EU data protection authorities also acknowledge the fact that the Court concluded that the powers of data protection authorities are not reduced by the existence of the Safe Harbor decision by the European Commission. As a consequence, data protection authorities, empowered as described in Article 28 of Directive 95/46 must always have the possibility to investigate, with complete independence, a complaint alleging that a third country does not ensure an adequate level of protection of the personal data transferred. 
For several years, the Working Party has been studying the impact of mass surveillance on international transfers and has on several occasions presented its concerns. 
Today’s Court judgment confirms that due to in particular the existence of mass surveillance and the absence of possibility for an individual to pursue legal remedies in order to have access and to obtain rectification or erasure, serious questions exist regarding the continuity of the level of data protection when data are transferred to the United-States. 
The Working party is aware that this decision, taken in the context of the negotiation on the European Regulation and the discussions on the Safe Harbour between the European Commission and the US authorities, has major consequences on all stakeholders. 
For these reasons, in order to provide a coordinated analysis of the Court’s decision and to determine the consequences on transfers, a first round of discussions between experts is organized this week in Brussels. Moreover, an extraordinary plenary meeting of the Working Party will be shortly scheduled. 

For more information
•    Article 29 Working Party
•    Press release by the CJUE  PDF
•    Press release by the European Commission
•    International transfers of personal data to the US for commercial purposes

International transfers of personal data to the US for commercial purposes
13-10-2015
 
On 6 October 2015, the European Court of Justice (ECJ) ruled that the Commission's adequacy decision on the EU-US Safe Harbour arrangement is invalid. (see judgment  )
The Commission's key priorities are now:
•    The protection of personal data transferred across the Atlantic;
•    The continuation of transatlantic data flows with adequate safeguards;
•    And the uniform application of EU law in the internal market.
(See speaking points First Vice-President Timmermans and Commissioner Jourová)
The Commission is working closely with national data protection authorities in the Article 29 Working Party to ensure guidance for business and a uniform implementation of the ruling. (See press release of the Article 29 Working Party )
For more information:
•    General information - EU rules on international transfers of personal data
•    Binding corporate rules
•    Model contracts for the transfer of personal data to third countries
•    Contact details - The national data protection authorities