As a follow up to the ruling of the Court of Justice of the European Union in Case C‑362/14, in which the Court declared that the Decision of the European Commission recognising the Safe Harbour Privacy Principles was invalid, the European Commission has released on 6 November a set of guidelines in the form of a Communication on the transfer of personal data from the EU to the US. The aim of the Communication is to help companies that are transferring data from Europe to the US to better know how to proceed until an agreement between the European Union and the United States on a “safer Safe Harbour” can be reached.
As summarised in an official press release, the following points are stressed in the Communication:
- the Safe Harbour arrangement can no longer serve as a legal basis for transfers of personal data to the U.S.;
- the Commission will continue and finalise negotiations for a renewed and sound framework for transatlantic transfers of personal data, which must meet the requirements identified in the Court ruling, notably as regards limitations and safeguards on access to personal data by U.S. public authorities;
- other adequacy decisions will need to be amended, to ensure that Data Protection Authorities (DPAs) remain free to investigate complaints by individuals.