New court request raises further doubts about transatlantic data transfers

Irish data protection authority wants EU court to rule on whether standard contracts offer better privacy protection than the Safe Harbor pact it has already struck down

Thousands of companies were turned into lawbreakers at a stroke the last time the High Court of Ireland referred a question about data protection to the Court of Justice of the European Union. And it may be about to do it again.

That means yet more uncertainty for companies processing European citizens' personal information in the U.S., as they struggle to keep up with the changes in privacy regulations triggered by the CJEU's response to the Irish court's last question.

Under EU law, citizens' personal information can only be exported to jurisdictions guaranteeing a similar level of privacy protection to that required by the 1995 Data Protection Directive.

The Safe Harbor Agreement made by EU and U.S. authorities in July 2000 was supposed to make that guarantee for data transferred to the U.S..

Last October, though, the CJEU struck down the agreement, saying it did not adequately protect European citizens' personal information from massive and indiscriminate surveillance by U.S. authorities.

The Irish high court triggered that ruling by asking the CJEU to rule on some matters of law in a case pitting Austrian Facebook user Maximilian Schrems against the Irish Data Protection Commissioner.

Schrems had complained that, in the light of the revelations of Edward Snowden about the U.S. National Security Agency's surveillance of data held by U.S. companies, Facebook's handling of his personal information did not meet EU legal requirements. Facebook CEO Mark Zuckerberg has denied the accusations.

In the wake of the CJEU's ruling, the European Commission told businesses making transatlantic data transfers to use alternative legal mechanisms, such as standard contract clauses or binding corporate rules, to offer the necessary legal guarantees while it struck a new agreement with U.S. authorities.

But now the Irish Data Protection Commissioner wants the country's high court to ask the CJEU whether standard contract clauses suffer from the same inadequacies as Safe Harbor.

The Article 29 Working Party, which brings together data protection authorities from all EU member states, has been studying just that question since the CJEU's ruling in October.

To minimize the potential disruption to businesses, the working party will wait until the Commission has completed its negotiations with U.S. authorities on Privacy Shield, the replacement for Safe Harbor, before giving its verdict on alternative transfer mechanisms, it said in April.

That the working party feels the need to withhold its opinion of those mechanisms suggests it is not entirely happy with standard contract clauses either. But if it were to torpedo all the data transfer mechanisms allowed under the directive, there would be no legal way for businesses to send personal information from the EU to the U.S.

Facebook is taking the whole thing calmly. "There is no immediate impact for people or businesses who use our services," a company spokeswoman said Wednesday. "Standard contract clauses remain valid, and Facebook has other legal methods in place to transfer data between countries," she said.

That's certainly true for now, but a new ruling from the CJEU could change that.

Schrems, whose complaint to the Irish DPC triggered the whole legal process, expects the CJEU to invalidate standard, or model, contract clauses, for exactly the same reasons it struck down Safe Harbor.

"All data protection lawyers knew that model contracts were a shaky thing, but it was so far the easiest and quickest solution they came up with. As long as the U.S. does not substantially change its laws I don't see how there could be a solution," he said via email.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Privacy Shield

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Peter Sayer

IDG News Service
Show Comments

Cool Tech

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Breitling Superocean Heritage Chronographe 44

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?