Privacy shield declared invalid but standard contractual clauses are fine(ish).....

Summary

The Court of Justice has confirmed that the EU model standard contractual clauses for data exports (SCC) are valid but warns businesses that this is not a tick box exercise. However, the US-EU Privacy Shield provisions are declared invalid.

Assessment

The use of SCC’s is now fairly enshrined in international data transfers and the decision of the court will be a welcome relief for many businesses across the world. However, the Court added a sting in the tail by making it clear that the use of SCCs was not in itself enough and that organisations exporting data needed to verify that the SCC will be respected in the relevant jurisdiction. This will put data exporters under pressure to demonstrate that they have carried out relevant due diligence on local laws and are satisfied that the SCC is binding and will not be undermined.

The end of the privacy shield (the replacement of Safe Harbour) is not that surprising. Many businesses relying on the privacy shield have been using SCC to underpin anyway and so whilst it will no doubt cause some businesses to re-evaluate their current data export arrangements, many should already be prepared. There is still some doubt as to whether an SCC (taking into account the US authority surveillance rights) will be sufficient for US/EU data transfers but for the moment there is at least some relief and clarification that an SCC (if enforced and enforceable) is fine.

What should you be doing?

If you are currently relying on the US-EU privacy shield for data exporting then this needs to be reviewed and replaced with an SCC as soon as possible;

If you are using SCCs then:

a. consider what mechanisms and safety checks you have in place for reviewing the SCC in light of the local laws of the country you are exporting to. For example, what rights do public authorities have in that jurisdiction to access such data and are there any laws in the local jurisdiction that invalidate/undermine the SCC;

b. ensure that you have in place appropriate monitoring provisions to keep track on the SCC and its enforceability. For example, ensure that all data importers have duty to notify you of any changes in law or reasons that the SCC cannot be complied with;

c. keep records of your assessments and monitoring.

The facts

The decision of the court followed a complaint lodged by an Austrian privacy right activist with the Irish Data Protection Commission over the transfer of data from Facebook Ireland to Facebook Inc in the US. The activist argued that the US did not provide adequate protection against the surveillance rights operated by US authorities.

The Court held that consideration must be given to the potential access public authorities have in the relevant non-EU country and that data transfers should be suspended or prohibited where data transfer protections cannot be complied with in practice.