{"id":845,"date":"2016-02-12T22:32:39","date_gmt":"2016-02-12T21:32:39","guid":{"rendered":"https:\/\/planit.legal\/wp\/?p=845"},"modified":"2019-03-25T23:59:22","modified_gmt":"2019-03-25T22:59:22","slug":"from-safe-harbor-to-eu-us-privacy-shield-future-of-international-data-transfers","status":"publish","type":"post","link":"https:\/\/planit.legal\/en\/from-safe-harbor-to-eu-us-privacy-shield-future-of-international-data-transfers\/","title":{"rendered":"From Safe Harbor to EU-US-Privacy-Shield \u2013 Future of International Data Transfers"},"content":{"rendered":"

The ECJ Safe Harbor Ruling anuls the EU Commissions Safe Harbor Decision and puts the future of transatlantic data transfers at stake. A new approach for data transfers between EU and USA shall bring the solution: The EU-US-Privacy-Shield. Whether or not this will be successful is to the same degree uncertain as the legitimacy of international data transfers from the EU to other third contries.<\/p>\n

1.\u00a0\u00a0 \u00a0The Safe Harbor Ruling<\/h2>\n

My Colleague Bernhard Freund has discussed the key aspects of the Safe Harbor Ruling. Aim of this article (without the claim of giving the comprehensive picture) is to pick up loose ends from his discussion.
\nThe Safe Harbor Ruling has the direct consequence that a justification of transatlantic data transfers ceases to exist and creates a large number of open questions and obstacles for other international data transfers that are far from being solved.<\/p>\n

The EU Commissions [PDF<\/a>] immediate and later the German [PDF in German<\/a>] governments reaction to the Safe Harbor Ruling may be summarised as \u201ctransatlantic data transfers have always been possible and will somehow be possible in the future regardless\u201d. Accordingly, they suggest using EU Standard Contractual Clauses instead of the Safe Harbor justification. The German Data Protection Authorities\u2019 views are more nuanced and differ between the individual Data Protection Authorities.<\/p>\n

The Bavarian Data Protection Authority and the Hamburg Data Protection Authority [PDF in German<\/a>] take the view that data transfers to the USA are possible on the Basis of EU Standard Contractual Clauses while the Data Protection Authorities of Hessen and Schleswig-Holstein see also the legitimacy of EU Standard Contractual Clauses at stake. The Rheinland-Pfalz Data Protection Authority even assumes that data transfers to the USA would with immediate effect require the Data Protection Authorities\u2019 prior approval [PDF in German<\/a>].<\/p>\n

2.\u00a0\u00a0 \u00a0What\u2019s Next?<\/h2>\n

The EU-US-Privacy-Shield is now supposed to provide the final solution for these obstacles. The EU-US-Privacy-Shield approach is, however, rather uncertain. As of today, there is a mere EU Commission\u2019s press statement<\/a>, suggesting a mutual political agreement between EU Commission and US Government Representatives on protecting personal data of EU citizens in the USA.<\/p>\n

The EU Commission\u2019s expectations are rather high and suggesting the EU-US-Privacy-Shield would provide extensive protection for EU citizens fundamental rights (in particular with respect to their privacy rights) when their personal data are transferred to the USA. Also, the EU-US-Privacy-Shield shall bring legal certainty for affected companies. Both shall be accomplished by:<\/p>\n