Safe Harbor: Article 29 Working Party issues initial guidance and sets compliance deadline for end of January 2016 (October 2015)

On Friday, the Article 29 Working Party, a European advisory body on data protection and privacy that comprises of EU Member States national Data Protection Authorities (DPAs) issued a statement in response to the decision issued earlier this month by the Court of Justice of the European Union (CJEU) in the Schrems cases which invalidated Safe Harbor.
In its statement, the Article 29 Working Party, inter alia:

  • Emphasized that transfers that are still taking place under Safe Harbor are now unlawful.
  • Urgently called on the Member States and the European institutions to open discussion with US authorities in order to find political, legal and technical solutions enabling data transfers to the United States, indicating that the current negotiations around a new Safe Harbor could be part of the solution.
  • Endorsed the other transfers tools – the Standard Contractual Clauses and Binding Corporate Rules – as interim solutions.
  • Indicated that if by the end of January 2016 no appropriate solution is found with the US authorities and depending on the assessment of the transfer tools by the Working Party, EU DPAs would be “committed to take all necessary and appropriate actions, which may include coordinated enforcement actions.”
  • Announced that EU DPAs will put in place information campaigns at national level which may include direct information to all known companies that used to rely on Safe Harbor as well as general messages on the DPAs’ websites.
  • Advised business to consider the implementation of legal and technical solutions in a timely manner to mitigate risks and come into compliance with EU data protection laws following the Schrems ruling.

The opinions, recommendations and other statements of the Article 29 Working Party are not legally binding, however, they enjoy significant authority.