The huge volume of information held about European citizens in the United States, particularly by US tech companies, has been a concern for some time. These concerns were heightened by the Snowden revelations, which continue to cast a long shadow over transatlantic privacy relations.
The Court of Justice has now ruled that Safe Harbor is invalid (Schrems C-362-14). This enormously popular scheme was used by thousands of US companies offering cloud computing, whistleblowing hotlines, social media and other services but no longer provides a justification for transfers of personal data to the US.
The Court came to this conclusion not because of potential misuse by commercial organisations that are part of Safe Harbor, but instead because of access to that personal data by US government, particularly its intelligence agencies. This conflicts with the rights to privacy and data protection under the Charter of Fundamental Rights.
It is not clear if the current proposals to reform Safe Harbor are sufficient to remedy these concerns. The Court suggests that adequate protection means a level of protection "essentially equivalent" to that provided under the European Data Protection Directive. The US cannot allow its intelligence agencies generalised rights to store and access personal data transferred to the US, and must instead only allow access and use where strictly necessary and proportionate. European citizens must also have effective legal remedies for misuse by the US government. Whether the package of measures proposed to reform Safe Harbor, including the Judicial Redress Bill, are sufficient is likely to be the subject of much debate.
Given the above uncertainties, organisations relying on Safe Harbor to transfer personal data to the US now need to move to alternative compliance solutions, such as Model Contracts. These should remain safe, although as with any of the other Commission's decisions, they too could be challenged in the Court of Justice in the future.
Full analysis of the case is available here.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
