The Article 29 Working Party (WP) has issued an urgent call for intergovernmental talks between member states, EU institutions and US authorities to find solutions enabling EU-US data transfers that respect fundamental rights, in light of the ECJ Schrems ruling invalidating the Safe Harbor regime (see Legal update, ECJ rules that the EU-US Safe Harbor arrangement is invalid), noting that "current negotiations around a new Safe Harbour could be a part of the solution".

The WP states that while it analyses the impact of the judgment on alternative data transfer mechanisms, the Standard Contractual Clauses and Binding Corporate Rules can still be used. However, it further states that unless a resolution with the US authorities is reached by the end of January 2016 and depending on its assessment of alternative data transfer mechanisms, EU data protection authorities may take enforcement action where necessary or appropriate.

Data controllers are unlikely to take comfort from this WP statement. It reiterates that ongoing transfers under Safe Harbor are unlawful and supports the use of alternative transfer mechanisms, despite casting doubt on their validity, on which the WP, or indeed the ECJ, has yet to opine, in light of the Schrems judgment. In this context, the WP notes that enforcement action could be taken in the near future, depending on two uncertain factors. This leaves entities who relied on Safe Harbor in an unhappy position for the moment. Hopefully, the outcome of the WP's assessment will be forthcoming soon. National information campaigns are to be implemented to at least provide guidance, if not legal certainty, on compliance obligations. For further comment, see Article, The future of EU-US data transfers - Reactions to the Schrems decision on the EU-US Safe Harbor and for information on data transfers, see Practice note, Cross-border transfers of data.

Source: Article 29 Working Party statement, 16 October 2015.