Skip to content

Brought to you by

Dentons logo

Privacy and Cybersecurity Law

Coverage and commentary on developments in data protection.

open menu close menu

Privacy and Cybersecurity Law

  • Home
  • About Us

Safe Harbor Decision today!

By Nick Graham
October 6, 2015
  • Europe
  • Privacy Rights
  • United Kingdom
Share on Facebook Share on Twitter Share via email Share on LinkedIn

Today, the Court of Justice of the European Union (CJEU) handed down its ruling in relation to the Schrems case. As you will have heard, the Court decided that local DPAs should be entitled to investigate matters (regardless of there being a Commission Decision applicable) and, more importantly, that the Commission Decision on Safe Harbor is, in fact, invalid.

DPA rights to investigate

We had all assumed that if a data transfer was subject to Safe Harbor then that was it. You would not have expected a local DPA to investigate Safe Harbor as that was an official decision and it should be up to the Commission to investigate or upgrade it as required.  Then came Snowden. That put Safe Harbor under the microscopic of course.

As a result of Snowden revelations, the Commission has been negotiating with the US for an upgrade to the privacy principles and FAQs. The Court, however, decided that if you read the Data Protection Directive (the famous Article 25 in particular) together with the EU Charter of Fundamental Rights, this must mean that DPAs can investigate Safe Harbor data exports.

In one sense, this turns DPAs into quasi-judicial bodies. More generally, it reflects the two key changes influencing the Court’s thinking here: (i) the Snowden revelations; and (ii) the higher standards imposed by the Charter. Neither of these factors were, presumably, in the Commission’s “corporate mind” when the Safe Harbor Decision was published, way back in 2000. The Charter, in particular, is featuring more frequently in EU data protection case law.

Safe Harbor decision

The Court raised a number of criticisms of the Commission’s original Decision. The Court highlighted that:

  • no consideration had been given to domestic US law as to whether it provided adequate protection for data;
  • the carve out for access to data for national security, crime prevention and other purposes was too broad; and
  • there was no appropriate remedy for EU citizens.

In other words, there were architectural defects in the Safe Harbor regime.  These concerns were brought to light by the surveillance revelations of Edward Snowden.

Should we panic?

No!  However, it is time to think carefully about putting alternatives to Safe Harbor in place (e.g. model contracts or BCRs).  The ICO accepts that this will take time.

Interestingly, the Commission was at pains to point out in their press conference this afternoon that they value international trade and that data flows with the US should continue.  So this is not about “pulling up the digital drawbridge”.  In particular, they have indicated that there will be guidance published to ensure business has certainty and clarity going forward.  They were also keen to point out that the “Safe Harbor 2.0” currently being negotiated is well advanced but that they need a little more time to sort out the national security issue.  Let’s wait and see.  The sooner the better

We are publishing a fuller analysis of the decision tomorrow.  Please contact me if you would like a copy.

Share on Facebook Share on Twitter Share via email Share on LinkedIn
Subscribe and stay updated
Receive our latest blog posts by email.
Stay in Touch
Nick Graham

About Nick Graham

Nick Graham is the Global Co-Chair of Dentons' Privacy and Cybersecurity Group. He specialises in data privacy, cybersecurity, information governance. Nick advises across all sectors including retail, telecoms, energy, manufacturing, banking, insurance, transport, technology and digital media.

All posts Full bio

RELATED POSTS

  • Europe
  • New and Proposed Laws

ICO releases 12 step guide on the GDPR

By Nick Graham
  • Canada
  • Privacy Rights

Copyright v. Privacy: Voltage Pictures LLC v. John Doe and Jane Doe

The recent Federal Court of Canada decision in Voltage Pictures LLC v. John Doe and Jane Doe (2014 FC 161) has […]

By Margot Patterson
  • Data Transfers
  • Europe
  • New and Proposed Laws
  • United States

Schrems: Decision Due Next Week

By Simon Elliott

About Dentons

Dentons is designed to be different. As the world’s largest law firm with 20,000 professionals in over 200 locations in more than 80 countries, we can help you grow, protect, operate and finance your business. Our polycentric and purpose-driven approach, together with our commitment to inclusion, diversity, equity and ESG, ensures we challenge the status quo to stay focused on what matters most to you. www.dentons.com

Dentons boilerplate image

Twitter

Categories

  • Accountability
  • Asia Pacific
  • Canada
  • Cloud Computing
  • Consumer Protection
  • Cybersecurity
  • Data Breach
  • Data Transfers
  • Employee Privacy
  • Enforcement
  • Europe
  • General
  • Government Information
  • Health Information Privacy
  • Latin America
  • Marketing, Cookies & Spam
  • New and Proposed Laws
  • Privacy Notices
  • Privacy Rights
  • Record Retention
  • Smart Cities
  • United Kingdom
  • United States

Subscribe and stay updated

Receive our latest blog posts by email.

Stay in Touch

Dentons logo

© 2023 Dentons

  • Legal notices
  • Privacy policy
  • Terms of use
  • Cookies on this site