The Article 29 Working Party, composed of representatives from data protection authorities in the EU, issued common guidelines on 16 October 2015 on the transfer of personal data to the USA following the Safe Harbor ruling. The ruling renders transfer based on the so-called Safe Harbor scheme illegal due to massive and indiscriminate surveillance of personal data in the USA.

The main points of the Article 29 Working Party's guidelines are as follows:

  • Transfer of personal data based on the Safe Harbor scheme is not legal following the judgment of the European Court of Justice of 6 October 2015.
  • Transfer of personal data may still take place to insecure third countries (including the USA) based on the Commission's standard contractual clauses and Binding Corporate Rules.
  • The EU is encouraged to enter into an agreement with the USA, which protects the citizens of the EU.

However, it has been agreed at the same time that, if by the end of January 2016 no appropriate solution is found with the USA which may protect the EU citizens' fundamental rights, the data protection authorities of the individual countries will make individual assessments of the lawfulness of the transfer of data to the USA.

The data protection authorities of the individual countries will in this connection be obligated to take necessary and appropriate measures, which may include coordinated enforcement actions. Likewise, the data protection authorities of the individual countries will be obligated to consider complaints about transfers to the USA received before 31 January 2016.

The Article 29 Working Party

The Article 29 Working Party is composed of representatives from all national data protection authorities in the EU, the European Data Protection Supervisor and the Commission.

contacts

Charlotte Kunckel

Specialist Attorney