ECJ Invalidates Safe Harbour Regime Governing Transfers Of Personal Data From EU To US

On 6 October 2015, the Court of Justice of the European Union ("ECJ") invalidated the European Commission Safe Harbour Decision (Case C-362/14 (Maximilian Schrems v. Data Protection Commissioner)). The ECJ judgment came only weeks after the Advocate General had published his opinion in this case (See, VBB on Business Law, Volume 2015, no 9, p. 10, available at www.vbb.com).

Under EU Directive 95/46/EC (the "Data Protection Directive"), personal data must not be transferred to a recipient outside the EEA unless such a recipient is located in a country which is deemed to provide an adequate level of protection (Article 25(1) of the Data Protection Directive). This decision on "adequacy" is made by the European Commission in accordance with Article 25(6) of the Data Protection Directive. For instance, in Decision 2000/520, the European Commission decided that the US Safe Harbour Privacy system ensures an adequate level of protection for personal data transferred from the EU to companies established in the US.

The Safe Harbour system includes a series of principles concerning the protection of personal data to which US companies may subscribe voluntarily. Many US companies have signed up to the Safe Harbour scheme and transfer personal data from the EU on the basis of Decision 2000/520.

The role of national data protection authorities

In the judgment of 6 October 2015, the ECJ first assessed the role of national data protection authorities with regard to the Safe Harbour adequacy decision.

The ECJ held that, in principle, a decision of the European Commission on the basis of Article 25(6) of the Data Protection Directive is binding on all Member States. However, the ECJ also considered that national data protection authorities must be able to examine with complete independence whether the transfer of a person's data to a third country satisfies the requirements laid down by the Data Protection Directive. The European Commission decision on Safe Harbour therefore does not prevent the national data protection authority from examining a claim that would cause the mentioned decision to become invalid.

Nevertheless, a national data protection authority cannot invalidate the European Commission decision. Indeed, the ECJ reminded that it is exclusively competent to invalidate a European Commission decision.

Therefore, the ECJ recommends national data protection authorities to bring a case before national courts and refer questions to the ECJ for a...