Oct. 9—An international agreement that allowed the transfer of European citizens' personal information to the U.S. is no longer valid, the European Union's highest court said Oct. 6.
The safe-harbor agreement, in effect since 2000, allowed companies to electronically transfer the personal information of Europeans, including payroll information, outside of the European Economic Area as long as the companies complied with E.U. privacy directives. The European Court of Justice deemed the existing safe-harbor agreement to be flawed and inadequate, citing the potential exposure of the information to U.S. government surveillance.
Because of the decision, organizations that transfer European payroll information to the U.S. must now halt such measures or become compliant to avoid legal risks and potential fines.
U.S. Secretary of Commerce Penny Pritzker was “deeply disappointed” by the decision, she said Oct. 6 in a statement. A new safe-harbor agreement, which the U.S. and E.U. have been working on for two years, is needed “as soon as possible,” she said. No time frame for when such an agreement would be made available was announced.
With no replacement for the previous agreement in place, the process for becoming compliant remains unclear but European authorities have pledged to provide clarity to data protection authorities on how to address data transfer requests to the U.S. Until clarity is provided, “transatlantic data flows between companies can continue using other mechanisms for international transfers of personal data available under E.U. data-protection law,” Frans Timmermans, first vice president for the European Commission, said Oct. 6.
The European Court of Justice's invalidation of the safe-harbor also may apply to past data transfers, a European Commission official who requested anonymity told Bloomberg BNA on Oct. 7.
Any transfer of data to the U.S. from the European Economic Area in the last 15 years that relied only on the E.U. safe-harbor program may in principle be open to a legal challenge in the wake of the recent invalidation of the safe-harbor adequacy decision, the commission official said.
Although transatlantic transfers of data under the safe-harbor agreement now are invalid, organizations with alternative means for data transfers in place, such as binding corporate rules or model contracts, would be able to continue to transfer data using those frameworks, Nigel Parker, a partner with Allen & Overy LLP in London, told Bloomberg BNA on Oct. 6.
Companies without alternatives might be in a difficult position because of the often arduous process of finding another means of compliance.
Binding corporate rules must be approved by E.U. national data protection authorities and “typically take about 18 months to obtain,” Parker said.
On model contracts, “in theory you can have them quite quickly,” but their adoption could be cumbersome for multinational groups, Parker said, in particular because E.U. member states apply different rules to their use. Adoption of model contracts “can take days, weeks, months, depending on the jurisdiction,” he said.
Henriette Tielemans, a partner with Covington & Burling in Brussels, told Bloomberg BNA that in some countries, such as Austria, Poland and Spain, model contracts must be approved by national data protection authorities, a process that takes “three to six months in a regular period, and this is not a regular period.” An “avalanche of authorization requests” is likely, she said.
“Some U.S. companies are already establishing servers in Europe in order to avoid the thorny issues of prohibition against cross border data transfers,” said Francoise Gilbert, a partner at Greenberg Traurig LLP in Palo Alto, Calif. However, a move to more data localization may “lead to a world of silos,” she said.
To contact the editor responsible for this story: Michael Trimarchi at firstname.lastname@example.org
The full text of the E.U. court decision is available at http://curia.europa.eu/juris/documents.jsf?num=C-362/14.
Statements by European Commission First Vice-President Timmermans and Commissioner Jourova on the decision are available at http://europa.eu/rapid/press-release_STATEMENT-15-5782_en.htm.
U.S. Commerce Secretary Penny Pritzker's comments on the court decision is available at https://www.commerce.gov/news/press-releases/2015/10/statement-us-secretary-commerce-penny-pritzker-european-court-justice.
More information on payroll issues Europe can be found within the International Payroll Decision Support Country Primers.
All Bloomberg BNA treatises are available on standing order, which ensures you will always receive the most current edition of the book or supplement of the title you have ordered from Bloomberg BNA’s book division. As soon as a new supplement or edition is published (usually annually) for a title you’ve previously purchased and requested to be placed on standing order, we’ll ship it to you to review for 30 days without any obligation. During this period, you can either (a) honor the invoice and receive a 5% discount (in addition to any other discounts you may qualify for) off the then-current price of the update, plus shipping and handling or (b) return the book(s), in which case, your invoice will be cancelled upon receipt of the book(s). Call us for a prepaid UPS label for your return. It’s as simple and easy as that. Most importantly, standing orders mean you will never have to worry about the timeliness of the information you’re relying on. And, you may discontinue standing orders at any time by contacting us at 1.800.960.1220 or by sending an email to email@example.com.
Put me on standing order at a 5% discount off list price of all future updates, in addition to any other discounts I may quality for. (Returnable within 30 days.)
Notify me when updates are available (No standing order will be created).
This Bloomberg BNA report is available on standing order, which ensures you will all receive the latest edition. This report is updated annually and we will send you the latest edition once it has been published. By signing up for standing order you will never have to worry about the timeliness of the information you need. And, you may discontinue standing orders at any time by contacting us at 1.800.372.1033, option 5, or by sending us an email to firstname.lastname@example.org.
Put me on standing order
Notify me when new releases are available (no standing order will be created)