1. Home
  2. |Insights
  3. |EU-U.S. Data Transfer Turmoil Continues: “Privacy Shield” Needs Improvement - EU Model Clauses Might Be Invalidated by ECJ

EU-U.S. Data Transfer Turmoil Continues: “Privacy Shield” Needs Improvement - EU Model Clauses Might Be Invalidated by ECJ

Client Alert | 2 min read | 05.26.16

In a May 26, 2016 resolution, the European Parliament (EP) recommended that the European Commission should continue negotiating with the U.S. to improve the draft “EU-U.S. Privacy Shield” (“Privacy Shield”), the EU-U.S. data transfer mechanism intended to replace the invalidated “U.S.-EU Safe Harbor.”

In the resolution, passed by 501 votes to 119 with 31 abstentions, the members of the EP (MEPs) voiced concerns regarding:

  • The U.S. surveillance authorities’ access to data of European individuals transferred under the Privacy Shield.
  • The remaining possibility for the bulk collection of data, which they argue would not meet the principle of necessity and proportionality, as enshrined in the European Union (EU) Charter of Fundamental Rights.
  • The proposed U.S. ombudsperson, which – in the view of the MEPs – is neither “sufficiently independent,” nor “vested with adequate powers to effectively exercise and enforce its duty.”
  • The complexity of the last resort binding arbitration mechanism which they believe should be much more “user friendly and effective.”

This is in line with the concerns previously raised by the Article 29 Working Party (WP29) in its opinion on the Privacy Shield which was published in April, accompanied by an assessment of the U.S. surveillance activities. Although the statements of both institutions are non-binding for the Commission, both are highly influential. That influence comes to bear at a time when the partly binding Article 31 Working Party opinion on Privacy Shield is still pending after having been postponed to the end of June.

Meanwhile, the Irish data protection authority (DPA) on May 24 announced that it intends to refer a case complaining of Facebook’s use of the EU Model Clauses data transfer mechanism to the Irish High court for referral to the European Court of Justice (ECJ) – the same court which invalidated the “Safe Harbor” regime. The complaint alleges that the use of EU Model Clauses as a replacement for Safe Harbor does not alleviate the underlying issue of alleged U.S. government mass surveillance.

If the ECJ finds the EU Model Clauses to be invalid, it would take away one of the only remaining valid EU-U.S. data transfer mechanisms that companies currently use to legitimize their cross-border data transfers from Europe, which are essential to many multinational businesses.

Crowell & Moring will continue to monitor these issues and provide updates. All of our prior Privacy Law Alerts, including several on Privacy Shield and the other EU-U.S. transfer mechanisms are available here.

Insights

Client Alert | 3 min read | 03.28.24

UK Government Seeks to Loosen Third Party Litigation Funding Regulation

On 19 March 2024, the Government followed through on a promise from the Ministry of Justice to introduce draft legislation to reverse the effect of  R (on the application of PACCAR Inc & Ors) v Competition Appeal Tribunal & Ors [2023] UKSC 28.  The effect of this ruling was discussed in our prior alert and follow on commentary discussing its effect on group competition litigation and initial government reform proposals. Should the bill pass, agreements to provide third party funding to litigation or advocacy services in England will no longer be required to comply with the Damages-Based Agreements Regulations 2013 (“DBA Regulations”) to be enforceable....