Source: https://www.irelandip.com/2015/09/articles/cyber-risk-data-privacy/safe-harbour-in-danger/
Timestamp: 2019-04-18 17:12:26+00:00

Document:
Home » Safe Harbour in Danger?
• The Commission can negotiate international commitments with a country that it finds does not provide an adequate level of protection under its laws and make a finding based on those international commitments that the country does provide an adequate level of protection.
The US has not been included on the EU’s list of approved countries, however, on 26 July 2000 the Commission made a finding – Decision 2000/520 (the Commission Decision) – of adequate protection in respect of transfers to the US where the recipient is certified under the "Safe Harbour" programme, a self-certified standard of protection enforced by the US Federal Trade Commission.
Over 3,000 US corporations have certified under the Safe Harbour programme and many rely on the Commission Decision as the principal basis for legitimating transfers made to them by their European subsidiaries and business partners.
In light of the revelations by Edward Snowden about alleged mass surveillance by US intelligence services of EU citizens’ personal data, an Austrian law student, Max Schrems, filed a complaint with the DPC objecting to the transfer by Facebook Ireland of his personal data to Facebook Inc.’s servers in the US on the basis that the US does not ensure adequate protection of his personal data.
The DPC dismissed Mr Schrems’ complaint on the grounds that the Commission Decision was binding and precluded him from investigating the matter further. Mr Schrems challenged this determination before the Irish High Court which requested the CJEU to rule on whether the DPC was absolutely bound by the Commission Decision. In particular, the High Court sought guidance on whether the DPC could look beyond or disregard the Commission Decision in light of the Snowden revelations and the coming into force of the EU Charter of Fundamental Rights (the Charter) since the Commission Decision was made.
• That the Commission Decision be declared invalid on the basis that it fails to respect Article 7 (right of privacy) and Article 8 (right to protection of personal data) of the Charter.
• Is the Commission Decision a binding finding on the adequacy of protection afforded by US companies that are certified under the Safe Harbour programme?
• Is the Commission Decision valid, irrespective of its binding nature?
Thus, we believe that there are three possible ways for the CJEU to rule, each of which will have quite distinct consequences.
A declaration of invalidity would have serious and immediate consequences. Most importantly, it would mean that a Safe Harbour certification could no longer be relied on to legitimise a transfer of personal data from the EU to the US. This could mean that some data transfers would no longer have a valid legal basis under EU law. However, it is likely that potentially impacted companies will put in place arrangements (see next section) so that they are in a position to rely on alternative legal grounds for justifying their transfers of personal data to the US.
If the CJEU rules that the Commission Decision is invalid, then the question of whether it is binding in nature becomes moot. In such circumstances, the likelihood is that the Irish High Court would direct to the DPC to investigate Mr Schrems’ complaints and to have regard to the Article 7 and 8 Charter rights in carrying out that investigation.
• The Irish High Court would order the DPC to carry out a full investigation of Mr Schrems’ complaints taking account of his Article 7 and 8 Charter rights and the facts surrounding the Snowden revelations. One major problem with any such investigation is that orders made by the US Foreign Intelligence Surveillance Act (FISA) Court against individual companies are secret and granted on an ex parte basis (a fact already acknowledged by the Irish High Court). It is not apparent therefore whether the DPC will be able to carry out a meaningful investigation into Mr Schrems’ complaints.
• US information service providers that rely on Safe Harbour would be vulnerable to complaints similar to those made by Mr Schrems.
If the CJEU upholds the validity and binding nature of the Commission Decision, then it is likely that the Irish High Court will conclude that the DPC was correct in its decision not to investigate Mr Schrems’ complaints. Of course, negotiations between the US and EU on a replacement to Safe Harbour will continue, so the subject matter of Mr Schrems’ complaints will remain current.
The Safe Harbour regime is not the only means of ensuring that transfers of personal data from the EU to the US are lawful. Alternative methods include the Model Contractual Clauses or Binding Corporate Rules (BCRs) mechanisms. Therefore this is an opportune time for businesses to consider the suitability of these alternative structures. However, it must be said that some aspects of the Advocate General’s Opinion are so wide-ranging that, if followed by the CJEU, they could call into question the underlying validity of any transfer of personal data to the US where there is a potential for such data to be the subjected the Foreign Intelligence Surveillance Act.
The ruling of the CJEU will determine whether or not the recommendations contained in the Opinion will become binding law. The CJEU has confirmed that they will issue their decision in this case on 6 October. In parallel to the progress of this case, political discussions have been ongoing for some time in relation to amendments to the Safe Harbour regime and it is reported that these are at an advanced stage. It will be interesting to see whether the Opinion will have an impact on such discussions.
The Opinion is accessible here.
For further reading about the Schrems case, please go to our IrelandIP blog to read blog posts that members of our IP/IT Group have written on this case. These blog posts are available here, here and here.

References: CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU 
 CJEU