Today, the Advocate General of the European Court of Justice (ECJ) delivered a non-binding opinion related to U.S.-EU Safe Harbor that will likely continue uncertainty surrounding the framework until negotiations over the future of Safe Harbor can be successfully completed.
The U.S.-EU Safe Harbor Framework is based on the existing 1995 EU Data Protection Directive. Currently, more than 4,000 U.S. companies rely on the program to transfer personal data from the EU to the U.S. while complying with European privacy laws.
Following the Snowden revelations in 2013, this framework has come under challenge from two separate avenues. First was the Max Schrems vs Facebook case. Schrems, an Austrian law student, brought a case to the Irish Data Protection Authority arguing that under EU Safe Harbor his personal data could end up on U.S. servers and be accessed by the NSA, which would violate his rights under EU privacy law. The Irish DPA dismissed the case. Schrems then sued the DPA and this case was referred to the ECJ, prompting the opinion issued today.
The Snowden revelations also generated considerable political pressure in Europe, leading the European Commission to propose 13 changes to the Safe Harbor Framework. The European Commission and the U.S. Department of Commerce are working to complete negotiations of the updated U.S.-EU SH by the end of the year, prior to the ECJ’s final ruling. The announcement of an Umbrella Agreement between the U.S. and the EU on data sharing for law enforcement purposes at the start of this month appeared to be a positive step in that direction.
Today’s opinion by the ECJ Advocate General is not legally binding and does not impact the adequacy of the current framework. The opinion may or may not be a signal indicator of the final ruling to come, as ECJ has been known to go a different direction as it notably did in the Google Spain case on the Right to be Forgotten.
At this stage, U.S.-EU-Safe Harbor remains a valid and vital transfer mechanism for industry and EU-U.S. trade, which continues to be actively enforced by the FTC with 13 cases brought this past summer.
Don’t let uncertainty result in your company being noncompliant.
Call TRUSTe with any questions: 1-888-878-7830