E.U. Court Declares Data-Transfer Pact With U.S. Invalid

The global solution for payroll professionals, combines custom research, strategic white papers, country primers, webinars, and the expert guidance you’ve come...

By Stephen Gardner and Jared Mondschein

Oct. 9—An international agreement that allowed the transfer of European citizens' personal information to the U.S. is no longer valid, the European Union's highest court said Oct. 6.

The safe-harbor agreement, in effect since 2000, allowed companies to electronically transfer the personal information of Europeans, including payroll information, outside of the European Economic Area as long as the companies complied with E.U. privacy directives. The European Court of Justice deemed the existing safe-harbor agreement to be flawed and inadequate, citing the potential exposure of the information to U.S. government surveillance.

Because of the decision, organizations that transfer European payroll information to the U.S. must now halt such measures or become compliant to avoid legal risks and potential fines.

U.S. Secretary of Commerce Penny Pritzker was “deeply disappointed” by the decision, she said Oct. 6 in a statement. A new safe-harbor agreement, which the U.S. and E.U. have been working on for two years, is needed “as soon as possible,” she said. No time frame for when such an agreement would be made available was announced.

With no replacement for the previous agreement in place, the process for becoming compliant remains unclear but European authorities have pledged to provide clarity to data protection authorities on how to address data transfer requests to the U.S. Until clarity is provided, “transatlantic data flows between companies can continue using other mechanisms for international transfers of personal data available under E.U. data-protection law,” Frans Timmermans, first vice president for the European Commission, said Oct. 6.

The European Court of Justice's invalidation of the safe-harbor also may apply to past data transfers, a European Commission official who requested anonymity told Bloomberg BNA on Oct. 7.

Any transfer of data to the U.S. from the European Economic Area in the last 15 years that relied only on the E.U. safe-harbor program may in principle be open to a legal challenge in the wake of the recent invalidation of the safe-harbor adequacy decision, the commission official said.

Alternative Options for Compliance

Although transatlantic transfers of data under the safe-harbor agreement now are invalid, organizations with alternative means for data transfers in place, such as binding corporate rules or model contracts, would be able to continue to transfer data using those frameworks, Nigel Parker, a partner with Allen & Overy LLP in London, told Bloomberg BNA on Oct. 6.

Companies without alternatives might be in a difficult position because of the often arduous process of finding another means of compliance.

Binding corporate rules must be approved by E.U. national data protection authorities and “typically take about 18 months to obtain,” Parker said.

On model contracts, “in theory you can have them quite quickly,” but their adoption could be cumbersome for multinational groups, Parker said, in particular because E.U. member states apply different rules to their use. Adoption of model contracts “can take days, weeks, months, depending on the jurisdiction,” he said.

Henriette Tielemans, a partner with Covington & Burling in Brussels, told Bloomberg BNA that in some countries, such as Austria, Poland and Spain, model contracts must be approved by national data protection authorities, a process that takes “three to six months in a regular period, and this is not a regular period.” An “avalanche of authorization requests” is likely, she said.

“Some U.S. companies are already establishing servers in Europe in order to avoid the thorny issues of prohibition against cross border data transfers,” said Francoise Gilbert, a partner at Greenberg Traurig LLP in Palo Alto, Calif. However, a move to more data localization may “lead to a world of silos,” she said.

To contact the reporters on this story: Stephen Gardner in Brussels at correspondents@bna.com and Jared Mondschein at jmondschein@bna.com.

To contact the editor responsible for this story: Michael Trimarchi at mtrimarchi@bna.com

The full text of the E.U. court decision is available at http://curia.europa.eu/juris/documents.jsf?num=C-362/14.

Statements by European Commission First Vice-President Timmermans and Commissioner Jourova on the decision are available at http://europa.eu/rapid/press-release_STATEMENT-15-5782_en.htm.

U.S. Commerce Secretary Penny Pritzker's comments on the court decision is available at https://www.commerce.gov/news/press-releases/2015/10/statement-us-secretary-commerce-penny-pritzker-european-court-justice.

More information on payroll issues Europe can be found within the International Payroll Decision Support Country Primers.