Is It Smart to Transfer Your Data From EU to US?

Does your group switch private information from the European Union to the US? In that case, maintain an eye fixed out for a key determination on July 16 from the EU’s prime courtroom, the Courtroom of Justice of the European Union. The Schrems II case presents a problem to the validity of the Commonplace Contractual Clauses, EU Fee-approved contracts which might be broadly used to fulfill the GDPR’s necessities for exporting private information from the EU to different nations. The questions raised by the case focus on whether or not the US nationwide intelligence businesses’ potential to require US entities (topic to varied situations) to show over private information of people who find themselves in Europe fatally undercuts the Commonplace Contractual Clauses as a method of guaranteeing that European private information is sufficiently protected when it’s transferred to the US. The questions raised in Schrems II are additionally pertinent to the EU-US Privateness Defend program, which offers a well-liked different method to information transfers for US organizations.

The Schrems II determination has been a very long time coming. The Advocate Normal’s non-binding opinion (basically, an in depth evaluation and suggestion to the Courtroom) was issued in December 2019. The roughly seven month delay between the Advocate Normal’s opinion and the Courtroom’s determination is considerably uncommon and will point out that the Courtroom has discovered it tough to achieve settlement on the choice. (However given the pandemic, it is usually potential that the delay was logistical in nature.)

The Advocate Normal’s prolonged opinion makes it clear that this can be a extremely advanced case. It’s tough to foretell the ultimate consequence. The AG has really useful that the Courtroom confine its determination to the Commonplace Contractual Clauses and resolve that the Commonplace Contractual Clauses will not be invalid on their face – successfully kicking a selected dedication again to the Irish information safety authority and Irish courts. Nevertheless, the Courtroom might go a lot farther in its determination, and the AG’s detailed evaluation of US nationwide safety applications and Privateness Defend raises severe questions on nearly all transfers of European private information to the US. (Recall that it was the Courtroom of Justice of the European Union that invalidated Privateness Defend’s predecessor, Secure Harbor again in 2015, with no grace interval for the hundreds of corporations that relied on Secure Harbor.)

There’s additionally the added complexity {that a} handful of instances attacking the surveillance legal guidelines and practices of some EU Member States stay pending earlier than the courtroom. The Advocate Normal’s opinion in these linked pending instances seeks to rein in Member States’ nationwide safety applications, however that the European Union treaties a minimum of nominally reserve nationwide safety to the Member States’ particular person governments. The assault on the Commonplace Contractual Clauses and Privateness Defend is arguably a part of a broader effort to vary the steadiness that quite a few Western democracies have struck between privateness rights and nationwide safety pursuits.

What’s going to occur if the Courtroom invalidates the Commonplace Contractual Clauses as a foundation for transferring private information to the US (or, albeit unlikely, globally)? Some US organizations, after all, can shift over to Privateness Defend if the Commonplace Contractual Clauses are struck down. Nevertheless, many organizations, together with banks and universities, are not eligible for Privateness Defend as a result of they don’t seem to be topic to the jurisdiction of the Federal Commerce Fee or Division of Transportation. One other mechanism offered below the GDPR, Binding Company Guidelines, work solely in restricted circumstances and are costly and time-consuming to place in place. Lastly, the GDPR presents some exceptions (generally known as derogations) to the information switch restrictions, however the European Knowledge Safety Board has issued steering that makes it very clear that these derogations will likely be interpreted very narrowly. Given the very restricted slate of information switch choices out there to US corporations below the GDPR, we will solely wait and see what the Courtroom decides – and cope with the fallout from there.

Schrems II: C-311/18, Knowledge Safety Commissioner v Fb Eire Restricted, Maximillian Schrems