The European Commission has now issued a formal communication by way of guidance following the decision of the European Court of Justice (“ECJ”) in relation to the transfer of personal data to the USA under the Safe Harbour framework.
As we have reported previously, in October 2015 the ECJ ruled that the Safe Harbour regime was invalid.
The guidance confirms the position set out by the ECJ and discusses the alternative bases for transfers of personal data to the US. These are: model contractual clauses; binding corporate rules; and derogations, the principal one of which (in most cases) is to rely on the unambiguous prior consent of the data subject.
The guidance reminds us that two important conditions must always be considered namely that:
- Transfers to any third country can only lawfully be made if the data has been collected in the EU in accordance with applicable national data protection laws; and
- The responsibility is on data controllers to ensure that data transfers take place with the appropriate safeguards. The necessary assessment must be carried out in the light of all of the circumstances surrounding the transfer in question.
Compliance with the requirements is to be assessed by national data protection authorities on a case by case basis.
The EU Commission has been engaged in discussions with the US government on a new arrangement for transatlantic data transfers since 2013 and the issue is now a key priority. The Commission has stated that its objective is now to conclude the discussions and achieve this objective within three months.
For the time being the message to all data controllers and data processors is clear – data can still be transferred to the USA provided that one of the alternative bases for the transfer of such data is adopted.
If you would like specific advice on data transfers and how these revelations affect your business then Talk to Tollers, contact Liz Appleyard on 01908 306950.