European Union privacy regulators aim to agree next month on whether and how data transfers to the United States should continue as the European Commission weighs Washington’s latest proposals on a new EU-U.S. data-transfer pact.
European data protection authorities will gather in Brussels on Feb. 2 to find a common position on which legal channels companies can use to shuffle personal data across the Atlantic after the simplest system, known as Safe Harbour, was quashed by the top EU court due to concerns about US snooping.
The 15-year-old Safe Harbour framework used by over 4,000 firms to transfer Europeans’ data to the United States was declared invalid by the European Court of Justice (ECJ) on Oct. 6 because the court found US national security requirements trumped privacy safeguards. This meant that the data were not adequately protected.
Under EU data protection law, companies cannot transfer EU citizens’ personal data to countries outside the EU deemed to have insufficient privacy safeguards, of which the United States is one. Revelations of mass US surveillance programs where American authorities collected private information directly from big tech firms like Apple, Facebook and Google riled Europe two years ago, and set the stage for the ECJ ruling.
As Washington and Brussels stepped up discussions on a new pact, EU data protection authorities gave businesses a three-month grace period in which they could set up alternative legal systems to transfer data across the Atlantic.
These would cover binding corporate rules within multinationals, model clauses between companies or requests to people for their consent.
EU data protection authorities also urged the United States and EU to agree a new data transfer framework in the same period, failing which they could start taking enforcement action against companies if they decided that alternatives such as model clauses offered no greater protection against US snooping than the old Safe Harbour did.
The US submitted a package of proposals on a new Safe Harbour deal this week. These included a letter from US Secretary of Commerce Penny Pritzker explaining US commitments on the oversight of a possible new framework by both the Department of Commerce and the US Federal Trade Commission, according to a person familiar with the discussions.
If acceptable to the EU, a new framework could be submitted for approval by all 28 EU commissioners on Feb. 2 to coincide with the regulators’ meeting, the person said. However, further details may need to be ironed out after that.
