EUROPEAN COMMISSION Brussels, 6.11.2015 COM(2015) 566 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the Transfer of Personal Data from the EU to the United States of America under Directive 95/46/EC following the Judgment by the Court of Justice in Case C-362/14 (Schrems)



COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the Transfer of Personal Data from the EU to the United States of America under Directive 95/46/EC following the Judgment by the Court of Justice in Case C-362/14 (Schrems) 1. Introduction: The Annulment of the Safe Harbour Decision The Court of Justice of the European Union (hereafter: "the Court of Justice" or "the Court") ruling of 6 October 2015 in Case C-362/14 (Schrems) reaffirms the importance of the fundamental right to protection of personal data, as enshrined in the Charter of Fundamental Rights of the EU, including when such data are transferred outside the EU. Transfers of personal data are an essential element of the transatlantic relationship. The EU and the United States are each other's most important trading partners, and data transfers, increasingly, form an integral part of their commercial exchanges. In order to facilitate these data flows, while ensuring a high level of protection of personal data, the Commission recognised the adequacy of the Safe Harbour framework through the adoption of Commission Decision 2000/520/EC of 20 July 2000 (hereafter: "the Safe Harbour Decision"). In this decision, based on Article 25(6) of Directive 95/46/EC, the Commission had recognised the Safe Harbour Privacy Principles and accompanying Frequently Asked Questions (FAQs) issued by the Department of Commerce of the United States as providing adequate protection for the purposes of personal data transfers from the EU. As a result, personal data could be freely transferred from EU Member States to companies in the United States which signed up to the Principles, despite the absence of a general data protection law in the United States. The functioning of the Safe Harbour arrangement relied on commitments and self-certification of adhering companies. While signing up to Safe Harbour Privacy Principles and FAQs is voluntary, these rules are binding under U.S. law for those entities that have signed up to them and enforceable by the U.S. Federal Trade Commission. In its judgment of 6 October 2015, the Court declared the Safe Harbour Decision invalid. It is against this background that the present Communication aims to provide an overview of the alternative tools for transatlantic data transfers under Directive 95/46/EC in the absence of an adequacy decision. It also briefly describes consequences of the judgment for other Commission adequacy decisions. In the judgment, the Court clarified that an adequacy decision under Article 25(6) of Directive 95/46/EC is conditional on a finding by the Commission that in the third country concerned there is a level of protection of personal data which, while not necessarily identical, is "essentially equivalent" to that guaranteed within the EU by virtue of the Directive read in the light of the Charter of Fundamental Rights. Regarding specifically the Safe Harbour Decision the Court held that it did not contain sufficient findings by the Commission on the limitations as regards access by U.S. public authorities to data transferred under that decision and on the existence of effective legal protection against such interference. In particular, the Court clarified that legislation permitting public authorities to have access on a generalised basis to the content of electronic communications must be regarded as compromising the essence of the fundamental right to respect for private life. Furthermore, the Court confirmed that even where there is an adequacy decision under Article 25(6) of Directive 95/46/EC, the Member States' Data Protection Authorities (DPAs) remain empowered and obliged to examine, with complete independence, whether data transfers to a third country comply with the requirements laid down by Directive 95/46/EC, read in the light of Articles 7, 8 and 47 of the Charter of Fundamental Rights. However, the Court also affirmed that only the Court of Justice can declare an EU act, such as a Commission adequacy decision, invalid. The Court's judgment draws on the Commission's 2013 Communication on the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU, in which the Commission identified a number of shortcomings and set out 13 recommendations. On the basis of these recommendations, the Commission has held talks with the U.S. authorities since January 2014 with the aim of putting in place a renewed and stronger arrangement for transatlantic data exchanges. Following the judgment, the Commission remains committed to the goal of a renewed and sound framework for transatlantic transfers of personal data. In this respect, it has immediately resumed and stepped up its talks with the U.S. government in order to ensure that any new arrangement for transatlantic transfers of personal data fully complies with the standard set by the Court. Any such framework must therefore have sufficient limitations, safeguards and judicial control mechanisms in place to ensure the continued protection of the personal data of EU citizens including as regards possible access by public authorities for law enforcement and national security purposes. In the interim, concerns have been expressed by industry regarding the possibilities for continued data transfers. There is thus a need to clarify under which conditions such transfers can continue. This has prompted the Article 29 Working Party – the independent advisory body that brings together representatives of all DPAs of the Member States as well as the European Data Protection Supervisor – to issue, on 16 October, a statement regarding the first conclusions to be drawn from the judgment. Among other points, this statement contained the following guidance on data transfers: data transfers can no longer be based on the Commission's invalidated Safe Harbour Decision; Standard Contractual Clauses (hereafter also: "SCCs") and Binding Corporate Rules (hereafter also: "BCRs") can in the meantime be used as a basis for data transfers, although the Article 29 Working Party also stated that it will continue to analyse the impact of the judgment on these alternative tools. The statement further called on Member States and EU Institutions to enter into discussions with the U.S. authorities with a view to find legal and technical solutions for data transfers; the negotiations for a new Safe Harbour could, in the view of the Article 29 Working Party, be part of this solution.

The Article 29 Working Party announced that if, by the end of January 2016, no appropriate solution is found with the U.S. authorities, and depending on the assessment of alternative tools for data transfers, the DPAs will take all necessary and appropriate action, including coordinated enforcement action. Finally, the Article 29 Working Party stressed the shared responsibility of the DPAs, the EU Institutions, Member States and businesses to find sustainable solutions to implement the Court's judgment. In particular, the Working Party urged businesses to consider putting in place any legal and technical solutions to mitigate any possible risks they face when transferring data. The present Communication is without prejudice to the powers and duty of the DPAs to examine the lawfulness of such transfers in full independence. It does not lay down any binding rules and fully respects the powers of national courts to interpret the applicable law and, where necessary, to make a reference to the Court of Justice for a preliminary ruling. Nor can this Communication form the basis for any individual or collective legal entitlement or claim. 2. Alternative Bases for Transfers of Personal Data to the U.S. The rules on international data transfers laid down in Directive 95/46/EC are based on a clear distinction between, on the one hand, transfers to third countries ensuring an adequate level of protection (Article 25 of the Directive) and, on the other hand, transfers to third countries which have not been found to ensure an adequate level of protection (Article 26 of the Directive). The Schrems ruling addresses the conditions under which, pursuant to Article 25(6) of Directive 95/46/EC, the Commission can determine that a third country affords an adequate level of protection. Where the third country to which the personal data are to be exported from the EU has not been found to ensure this adequate level of protection, Article 26 of Directive 95/46/EC provides for a number of alternative grounds on which transfers may nevertheless take place. In particular transfers may be carried out where the entity responsible for determining the purposes and means of the processing of personal data (the "controller"): adduces appropriate safeguards, within the meaning of Article 26(2) of Directive 95/46/EC, regarding the protection of the privacy and fundamental rights and freedoms of individuals as well as with respect to the exercise of those rights. Such safeguards can notably be provided by means of contractual clauses binding the exporter and the importer of the data (see sections 2.1 and 2.2 below). These include SCCs issued by the Commission, and, with regard to transfers between the different entities of a multinational corporate group, BCRs authorised by DPAs; or relies on one of the derogations expressly listed in letters (a) to (f) of Article 26(1) of Directive 95/46/EC (see section 2.3 below). Compared to adequacy decisions which result from the overall assessment of a given third country's system and may in principle cover all transfers to that system, these alternative bases for transfers have both a more limited scope (as they apply only to specific data flows) and a broader coverage (as they are not necessarily confined to a specific country). They apply to data flows carried out by particular entities which have decided to make use of one of the possibilities offered by Article 26 of Directive 95/46/EC. Moreover, when basing their transfers on such grounds, and as they cannot rely on a finding of adequacy of the third country contained in a Commission decision, data exporters and importers bear the responsibility of ensuring that the transfers comply with the requirements of the Directive. 2.1. Contractual solutions As highlighted by the Article 29 Working Party, in order to offer sufficient safeguards for the purposes of Article 26(2) of Directive 95/46/EC, contractual clauses "must satisfactorily compensate for the absence of a general level of adequate protection, by including the essential elements of protection which are missing in any given particular situation". With the aim of facilitating the use of such instruments in international transfers, the Commission has approved, in accordance with Article 26(4) of the Directive, four sets of SCCs considered as fulfilling the requirements of Article 26(2) of the Directive. Two sets of model clauses relate to transfers between controllers, while the other two sets of model clauses concern transfers between a controller and a processor acting under its instructions. Each of these sets of model clauses lays down the respective obligations of data exporters and importers. These include obligations as regards, inter alia, security measures, information to the data subject in case of transfer of sensitive data, notification to the data exporter of access requests by the third countries' law enforcement authorities or of any accidental or unauthorised access, and the rights of data subjects to the access, rectification and erasure of their personal data, as well as rules on compensation for the data subject in case of damage arising from a breach by either party to the SCCs. The model clauses also require EU data subjects to have the possibility to invoke before a DPA and/or a court of the Member State in which the data exporter is established the rights they derive from the contractual clauses as a third party beneficiary. These rights and obligations are necessary in contractual clauses because, in contrast to the situation where the Commission has made an adequacy finding, it cannot be presumed that the data importer in the third country is subject to an adequate system of oversight and enforcement of data protection rules. Since Commission decisions are binding in their entirety in the Member States, incorporating the SCCs in a contract means that national authorities are in principle under the obligation to accept those clauses. Consequently, they may not refuse the transfer of the data to a third country on the sole basis that these SCCs do not offer sufficient safeguards. This is without prejudice to their power to examine these clauses in the light of the requirements set out by the Court in the Schrems ruling. In case of doubts, they should bring a case before a national court which in turn may make a request for a preliminary ruling to the Court of Justice. While there is no requirement for a prior national authorisation to proceed with the transfer in most Member States' legislation transposing Directive 95/45/EC, some Member States maintain a system of notification and/or pre-authorisation for the use of the SCCs. Where they do so, the national DPA has to compare the clauses actually contained in the contract at issue with the SCCs and verify that no change has been made. If the clauses have been used without amendment, the authorisation is in principle automatically granted. As further explained below (see section 2.4), this is without prejudice to additional measures the data exporter may have to take, in particular further to information received from the data importer on changes in the third country's legal system that may prevent the data importer from fulfilling its obligations under the contract. In the application of SCCs, both data exporters and, by subjecting themselves to the contract, data importers fall under the supervision of DPAs. The adoption of SCCs does not prevent companies from relying on other instruments, such as ad hoc contractual arrangements, to demonstrate that their transfers take place with sufficient safeguards within the meaning of Article 26(2) of Directive 95/46/EC. Pursuant to Article 26(2) of the Directive, these need to be approved on a case-by-case basis by national authorities. Some DPAs have developed guidance in this field, including in the form of standardised contracts or detailed rules to be followed in drafting the data transfer clauses. Most contracts currently used by companies to carry out their international data transfers are, however, based on Commission-approved SCCs. 2.2. Intra-group transfers

To transfer personal data from the EU to affiliates located outside the EU in compliance with the requirements set out in Article 26(2) of Directive 95/46/EC, a multinational company can adopt BCRs. This type of code of practice provides a basis only for transfers made within the corporate group. The use of BCRs thus allows personal data to move freely among the various entities of a corporate group worldwide – dispensing with the need to have contractual arrangements between each and every corporate entity – while ensuring that the same high level of protection of personal data is complied with throughout the group by means of a single set of binding and enforceable rules. Having a single set of rules creates a simpler and more effective system, which is easier for staff to implement and for data subjects to understand. With a view to helping companies in the drafting of BCRs, the Article 29 Working Party has spelled out the substantive (e.g. purpose limitation, security of processing, transparent information to data subjects, restrictions on onward transfers outside the group, individual rights of access, rectification and opposition) and procedural (e.g. audits, monitoring of compliance, complaints' handling, cooperation with DPAs, liability and jurisdiction) requirements for BCRs based on EU data protection standards. These rules are not only binding on the members of the corporate group but, similarly to the SCCs, they are also enforceable in the EU: individuals whose data are being processed by an entity of the group shall be entitled as third-party beneficiaries to enforce compliance with BCRs by lodging a complaint before a DPA and bringing an action before a Member State court. Furthermore, the BCRs must designate an entity within the EU which accepts liability for breaches of the rules by any member of the group outside of the EU which is bound by these rules. Under most Member States' laws transposing the Directive, data transfers on the basis of BCRs have to be authorised by the DPA in each Member State from which the multinational company intends to transfer data. To facilitate and speed up the process, as well as lessen the burdens on applicants, the Article 29 Working Party has established a standardised application form and a specific co-operation procedure between concerned DPAs which includes the designation of one "lead authority" responsible for handling the approval procedure. 2.3. Derogations In the absence of an adequacy decision under Article 25(6) of Directive 95/46/EC and irrespective of the use of SCCs and/or BCRs, personal data may still be transferred to entities established in a third country to the extent that one of the alternative derogations set out in Article 26(1) of Directive 95/46/EC applies: the data subject has unambiguously given his/her consent to the proposed transfer; the transfer is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken in response to the data subject’s request; the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and a third party; the transfer is necessary or legally required on important public interest grounds, or for the establishment, exercise or defence of legal claims; the transfer is necessary in order to protect the vital interests of the data subject; the transfer is made from a register which according to laws or regulations is intended to provide information to the public and which is open to consultation either by the public in general or by any person who can demonstrate legitimate interest, to the extent that the conditions laid down in law for consultation are fulfilled in the particular case.

These grounds provide a derogation from the general prohibition of transferring personal data to entities established in a third country without an adequate level of protection. In fact, the data exporter does not have to ensure that the data importer will provide adequate protection, and he will usually not need to obtain prior authorisation for the transfer from the relevant national authorities. Nevertheless, due to their exceptional character, the Article 29 Working Party considers that these derogations have to be strictly interpreted. The Article 29 Working Party has issued several non-binding guidance documents on the application of Article 26(1) of Directive 95/46/EC. These include a number of "best practice" rules that are devised to orientate the enforcement action of the DPAs. In particular, the Working Party recommends that transfers of personal data which might be qualified as repeated, mass or structural should be carried out with sufficient safeguards and, where possible, within a specific legal framework such as SCCs or BCRs. In the present Communication, the Commission will only address those derogations which appear particularly relevant to transfers in the commercial context following the finding that the Safe Harbour Decision is invalid. 2.3.1. Transfers necessary for the performance of a contract or the implementation of pre-contractual measures taken in response to the data subject's request (Article 26(1)(b)) This derogation might be applicable, for example, in the context of a hotel reservation, or when payment information is transferred to a third country in order to effect a bank transfer. However, in each of these cases the Article 29 Working Party considers that there has to be a "close and substantial connection", a "direct and objective link" between the data subject and the purposes of the contract or the pre-contractual measure (necessity test). Also, the derogation cannot be applied to transfers of additional information not necessary for the purpose of the transfer, or transfers for a purpose other than the performance of the contract (for example, follow-up marketing). As regards pre-contractual measures, the Article 29 Working Party took the view that only contacts initiated by the data subject (for example, a request for information about a particular service) would be covered but not those resulting from marketing approaches made by the data controller. 2.3.2. Transfers necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller or a third party (Article 26(1)(c)) This derogation might be applicable, for example, when the data subject is the beneficiary of an international bank transfer, or when a travel agent forwards the details of a flight booking to an airline. Again, the necessity test applies and in this case requires a close and substantial link between the data subject's interest and the purpose pursued with the contract. 2.3.3. Transfers necessary or legally required for the establishment, exercise or defence of legal claims (Article 26(1)(d)) This derogation might be applicable, for example, where a company needs to transfer data to defend itself against a legal claim, or to make such a claim in court or before a public authority. As for the two previous derogations, this is subject to the necessity test: there should be a close connection with litigation or legal (including administrative) proceedings. According to the Article 29 Working Party, the derogation can only be applied if any international rules on cooperation in criminal or civil proceedings governing the type of transfer have been complied with, notably as they derive from the provisions of the Hague Convention of 18 March 1970 ("Taking of Evidence" Convention). 2.3.4. Unambiguous prior consent by the data subject to the proposed transfer (Article 26(1)(a)) While consent can be used as the basis for data transfers, a number of considerations should be taken into account. Since consent must be given to the "proposed" transfer, this requires prior consent for the particular transfer (or a particular category of transfers). Where it is requested online, the Article 29 Working Party has recommended the use of boxes to be ticked (rather than pre-ticked boxes). Because the consent must be unambiguous, any doubt about whether it actually has been given would render the derogation inapplicable. This will likely mean that many situations where consent is at best implied (for example, because an individual has been made aware of a transfer and has not objected) would not qualify. Conversely, the derogation could be used in cases where the transferring entity has direct contact with the data subject, the necessary information can easily be provided and unambiguous consent obtained. Moreover, according to Article 2 (h) of Directive 95/46/EC, consent must be freely given, specific and informed. According to the Article 29 Working Party, the first requirement means that any "pressure" may invalidate the consent. This is particularly relevant in the employment context, where the relationship of subordination and inherent dependency of employees will normally call into question reliance on consent. More generally, consent given by a data subject who has not had the opportunity to make a genuine choice or has been presented with a fait accompli cannot be considered valid. Of significant importance is that the data subjects are properly informed in advance that the data may be transferred outside the EU, to which third country and under which conditions (its purpose, the identity and details of the recipient(s), etc.). This information should address the specific risk that their data will be transferred to a third country lacking adequate protection. Furthermore, as pointed out by the Article 29 Working Party, withdrawal of a data subject's consent, while not retroactive, should, as a principle, prevent any further processing of personal data. In light of these limitations, the Article 29 Working Party takes the view that consent is unlikely to provide an adequate long-term framework for data controllers in cases of structural transfers.