Privacy watchdogs give EU, US three months to negotiate new Safe Harbor deal

If there's no new deal by the end of January, national data protection authorities threaten coordinated legal action against offending companies

European data protection authorities have given the European Commission and national governments three months to come up with an alternative to the Safe Harbor agreement swept away two weeks ago by a ruling of the Court of Justice of the European Union.

But any new agreement must protect the personal data of European citizens from massive and indiscriminate surveillance, which is incompatible with EU law, the data protection authorities making up the Article 29 Working Party said late Friday.

Since the CJEU ruled on Oct. 6 that the Safe Harbor agreement between the Commission and U.S. authorities did not offer necessary legal guarantees, businesses that relied on it for the transfer of their customers' or employees' private personal information from the EU to the U.S. have been doing so in something of a legal vacuum.

The High Court of Ireland triggered the CJEU's ruling by referring some matters of law to it in a case pitting an Austrian Facebook user, Maximilian Schrems, against the Irish Data Protection Commissioner. Schrems had complained that, in the light of the revelations of Edward Snowden about the U.S. National Security Agency's surveillance of data held by U.S. companies, Facebook's handling of his personal information did not meet EU legal requirements. Schrems appealed to the Irish high court after the DPC dismissed his initial complaint. With the CJEU's ruling now in, that case is set to continue at the high court on Tuesday, according to Schrems.

EU law allows such information to be exported only if it can be guaranteed the same privacy protections as the data enjoys within the EU, and provides for a number of ways to provide those legal guarantees. The Safe Harbor agreement was one such, covering all transfers of data by companies that certified they met its requirements. However, the CJEU determined that the agreement, while binding on the activities of companies, imposed no such restraints on the behavior of U.S. law enforcers or intelligence agencies.

For the authorities making up the working party, countries where state authorities have powers to access information beyond what is necessary in a democratic society are not safe destinations for the export of personal data.

In the absence of a replacement agreement, companies must resort to time-consuming and potentially expensive ad-hoc legal arrangements, such as model contract clauses or binding corporate rules, or refrain from transferring personal data. The working party members consider that those arrangements may still be used while they complete their legal analysis of the CJEU's decision.

In the wake of Snowden's revelations, the Commission had already recognized that the Safe Harbor agreement did not offer sufficient protection from surveillance, and had begun negotiating new terms with U.S. authorities.

Those negotiations could form the basis of a new agreement, the working party said, as long as it includes obligations on the necessary oversight of access by public authorities, on transparency, on proportionality, on redress mechanisms and on data protection rights

If no new agreement has been reached by the end of January, the working party warned, its members would consider coordinated enforcement actions to ensure companies complied with EU data protection requirements.

Companies still relying on the old Safe Harbor agreement are now acting unlawfully, it said, adding that they should consider what technical or legal steps they need to take to protect the personal data they handle.

Join the CSO newsletter!

Error: Please check your email address.

More about EUEuropean CommissionFacebookNational Security Agency

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Peter Sayer

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts