# Presentation: 944468

## Washington, DC, Dec. 7th, 2005  

**The Commission’s View On Safe Harbor ****and other Options for International Data Transfers**
- Workshop - Safe Harbor Framework
- Bridging Differences in Approaches to Data Protection
- Washington, DC, Dec.* *7th,* *2005
- Rosa Barcelo

## Overview

- Overview of the Legal Framework on International Data Transfers
- Issues perceived in the 2003 Commission Report on the Implementation of the Directive
- 2005: Assessing the Results of the 2003 Proposed Measures
- The Safe Harbor Scheme

- Prohibition of data transfers to non-EU countries (Art. 25)
- Prohibition does not apply to non-EU countries deemed “adequate”: (e.g. US-Safe Harbor, Canada, Switzerland, Argentina, Guernsey, Isle of Man)
- Exceptions to the prohibition (Art. 26.1)
- Data controller may adduce adequate safeguards (Art. 26.2) (ad hoc/model contracts and BCRs)

**Overview of the Legal Framework on International Data Transfers**

- Content with legal framework (Art. 25 and 26)
- Concerns regarding the _Control and Enforcement_ by DPAs of IDT:
-  Overly lax or too tight controls
- _Simplification_ of the conditions for international transfers desirable & recommended:
-  More extensive use of findings of adequate protection
-  Wider choice of standard contractual clauses
-  Definition and endorsement of binding corporate rules
-  More uniform interpretation of Article 26(1)

**Issues Perceived ****in the 2003 Commission ****Report**

## 2005: Assessing the Results of the 2003 Proposed Measures

**Concerns regarding the Control and Enforcement by DPAs of IDT**
- Concerns remain (see 2005 Commission report on the functioning of the standard contractual clauses)
- A few positive developments:
- Enhanced controls in the form of DPA’s new engagements towards auditing specific sectors (United Kingdom, Ireland)
- Perceived relaxed controls when standard contractual clauses are used

## 2005: Assessing the Results of the 2003 Proposed Measures

**Simplification of the Conditions for International Transfers Desirable: ** **a More Extensive Use of Findings of Adequate Protection**
- A few positive developments:
- Argentina, Guernsey, Isle of Man
- Australia:  under assessment
- Informal assessment of various legal frameworks on-going and to be started.  But, no real draft adequacy findings in the pipeline
- More could be done but inherent limits exist

**Wider choice of standard contractual clauses**
- New set of clauses put forward by industry have been adopted:
- Commission Decision C(_2004_/5271 (from controller to controller)
- Existing two Decisions (controller to controller and controller to processor)
- Other recent Developments:
- Commission’s report on the first two sets of Clauses

**2005: Assessing the Results of the 2003 Proposed Measures**

- Reveals need to clarify certain concepts  such as «onward transfers »
- Reveals that in some MS Notification of data transfers are almost « de facto authorisations»

**2005: Assessing the Results of the 2003 Proposed Measures**

## 2005: Assessing the Results of the 2003 Proposed MeasuresRole of Binding Corporate Rules in Providing Safeguards

| PAST
Some Member States’ legislation did not recognise BCRs as providing « adequate safeguards » (for a variety of legal reasons).
Each DPA: entitled to require changes to the content of the BCR in order to deem that it provides « adequate safeguards » and authorise the transfers. Defeating the purpose of having a single BCR governing the processing for the corporate group. | PRESENT 
Generally speaking, MS are moving towards recognising BCRs.

WP 29 Developments towards a single procedure to adopt pan-EU BCRs:  (i) Working Party 29 paper N. 74 (June 2003); (ii) Working Party 29 paper N. 108 (April 2005) and (iii) Working Party 29 paper N.107 (April 2005).
 |
| --- | --- |

## 2005: Assessing the Results of the 2003 Proposed Measures

**More uniform interpretation of Article 26(1)**
**Working Party 29 paper on exceptions:**
- Provide DAPs and data controllers with harmonised views on the exceptions
- Maintains the proper balance between protection of data and protection of international trade

## Safe Harbor Scheme

**Current views on SH, embodied in Commission’s SH report of October 2004**
-  Background**  **
- Report about implementation, not about the adequacy itself
- Written because:
- Article 4 of the SH Decision
- Political Commitment of Commissioner Bolkestein to report on Safe Harbour implementation

## Safe Harbor Scheme (II)

**Current views on SH, embodied in Commission’s SH report of October 2004:**
- 	Implementation of the Safe Harbor Decision in essence ensures the protection of individuals’ privacy rights, but improvements are necessary.  In particular:
- Regarding Harborites:
- Need to improve the understanding of some SH Principles
- Models of privacy policies drafted by WP 29 and DoC
- Regarding DoC’s role:
- Improvements of its website & Commitment to comply with EU panel advice
- Proper checks whether privacy policies are visible

## Safe Harbor Scheme (III)

**Current views on SH, embodied in Commission’s SH report of October 2004:**
- Regarding ADRs:
- Do not contemplate mandatory sanctions
- Lack of transparency
- Recommendations?
- Regarding FTC:
- Lack of *ex officio* investigations
- Request to self-initiate investigations

## Safe Harbor Scheme (III)

- Commission and Working Party 29 are currently working to address these concerns.
- Progress has already been made. We are moving in the right direction.

## Thank you for your attention.  Questions? 

**Rosa BARCELO**Data Protection UnitDG JLS
- 	European Commission
- Tel: 00/32/2-2986488
- Fax: 00/32/2-2998094
- E-mail: rosa.barcelo@cec.eu.int
- http://europa.eu.int/comm/justice_home/fsj/privacy/