Article 29 Working Party Confirms that EU Standard Contractual Clauses and Binding Corporate Rules are Still Valid – for the Time-Being
The Article 29 Working Party has confirmed in a statement that EU Standard Contractual Clauses and Binding Corporate Rules are still valid data transfer mechanisms for the time being. The announcement was made following a meeting held to discuss the consequences of the Court of Justice of the European Union’s (“CJEU“) decision invalidating the US-EU Safe Harbor Framework and just one day after the European Commission announced that a political agreement had been reached on a new framework, the “EU-US Privacy Shield”.
In its statement, the Article 29 Working Party “welcome[d] the fact of the conclusion of the negotiations between the EU and the U.S. on the introduction of a ‘EU-US Privacy Shield.’” It is interesting that the Working Party chose to “welcome the fact of the conclusion of negotiations” rather than praise the result of the conclusions. Indeed, the Working Party withheld its support of the Privacy Shield pending its ability to assess the relevant documents in the context of the CJEU judgment, which it requested receipt of by the end of February 2016.
The Article 29 Working Party has been holding hearings and discussions to assess the current legal framework and practice of US intelligence services which is to be assessed in light of European jurisprudence on fundamental rights which sets the “four essential guarantees for intelligence activities,” being: (i) processing should be based on clear, precise and accessible rules; (ii) the demonstration of necessity and proportionality; (iii) the existence of an independent oversight mechanism; and (iv) the availability of effective remedies for individuals.
Whilst the Article 29 Working Party confirmed that for the time-being other data transfer tools (i.e. EU Standard Contractual Clauses and Binding Corporate Rules) are still valid it stated that further analysis will be carried out in respect of these mechanisms in light of the new EU-US Privacy Shield and in particular, whether this new framework “will provide legal certainty for the other transfer tools.”
An extraordinary plenary meeting of the Article 29 Working Party will be held towards the end of March during which a decision will be made as to whether the EU-US Privacy Shield meets the “four essential guarantees for intelligence activities” and respects the powers afforded to data protection authorities under the EU Data Protection Directive 95/46/EC. A decision will also be made at this time in respect of the ongoing validity of EU Standard Contractual Clauses and Binding Corporate Rules, which should require consideration of arguments that the US legal order for data protection is essentially equivalent to that of the EU before imposing onerous additional conditions on the Privacy Shield, Standard Contractual Clauses and Binding Corporate Rules.
