First Vice-President Timmermans and Commissioner Jourová’s press conference on Safe Harbour following the Court ruling in case C-362/14 (Schrems)

Speaking points of First Vice-President Timmermans and Commissioner Jourová First Vice-President Timmermans and Commissioner Jourová ‘s press conference on Safe Harbour following the Court ruling in case C-362/14 (Schrems)

First Vice-President Frans Timmermans :

Today’s judgment by the Court is an important step towards upholding Europeans’ fundamental rights to data protection.

The Court confirms the need of having robust data protection safeguards in place before transferring citizens’ data.

I see this as a confirmation of the European Commission’s approach for the renegotiation of the Safe Harbour.

We have already been working with the American authorities to make data transfers safer for European citizens.

In the light of the ruling, we will continue this work towards a renewed and safe framework for the transfer of personal data across the Atlantic.

In the meantime, transatlantic data flows between companies can continue using other mechanisms for international transfers of personal data available under EU data protection law.

Our priorities as Commission are now:

• the protection of personal data transferred across the Atlantic;
• the continuation of transatlantic data flows, which are important for our economy, with adequate safeguards;
• and the uniform application of EU law in the internal market.

We will come forward with clear guidance for national data protection authorities on how to deal with data transfer requests to the U.S., in the light of the ruling.

As citizens need robust safeguards and businesses need legal certainty; the guidance should help avoiding a patchwork of potentially contradicting decisions by the national data protection authorities and therefore provide predictability for citizens and businesses alike.

We will work closely with national data protection authorities, which are responsible for the enforcement of data protection law in our Member States.

They will meet in the coming days to discuss all of this.

I will let Vera talk you through the steps we have taken so far, and what we are planning to do next.

Commissioner Vera Jourová:

As Frans Timmermans just said, we have three priorities :

–         First, we have to guarantee that EU citizens’ data are protected by sufficient safeguards when they are transferred.

–         Then, it is important that transatlantic data flows can continue, as they are the backbone of our economy.

–         Finally, we will work together with the national Data protection authorities to ensure a coordinated response on alternative ways to transfer data. This is important for European businesses.

We will also continue our discussions with the US. Let me remind you that following the Snowden revelations in 2013, the Commission had identified the shortcomings of the Safe Harbour arrangement and had made 13 concrete recommendations on how to make the Safe Harbour safer. This has been acknowledged by the Court ruling.

Since 2013, we’ve been working relentlessly with the American authorities to revise the Safe Harbour. And we have made important progress that we can now build on in light of the judgment. Our aim is to step up discussions with the US towards a renewed and safe framework for the transfer of personal data across the Atlantic.

Now, you’ll ask me how data flows can continue without the Safe Harbour in the meantime.

The EU data protection rules provide for several other mechanisms that provide safeguards for international transfers of personal data, for instance through standard data protection clauses in contracts between companies exchanging data across the Atlantic or binding corporate rules for transfers within a corporate group.

Also the Data protection rules include derogations under which data can be transferred on the basis of:

• performance of a contract [e.g. If you book a hotel in the U.S., my personal data are transferred there in order to fulfil the contract];
• Important public interest grounds [e.g. cooperation between authorities in the fight against fraud, cartels, etc.];
• The vital interest of the data subject [e.g. it means in urgent life or death situations, personal data such as medical records can be transferred internationally in the person’s own interest]; or
• Or if there is no other ground, the free and informed consent of the individual.

The Commission will work closely with the Data Protection Authorities. I have already spoken to the Chair of the “Article 29 working party” (gathering the national Data Protection Authorities) earlier today.

We agreed on the need to avoid fragmentation and ensure a coordinated European approach in the Internal Market. The Commission will also look into what it can to offer assistance and help to business who are looking for answers on how to facilitate data transfers in light of the judgement. We will put relevant information and contact points on our website.

And we will be in contact with our counterparts in the US to discuss next steps in light of the judgement.

Let me also shortly touch upon two other files that are often mentioned in the context of this ruling today: the EU Data Protection Reform and the EU-US Umbrella Agreement for the law enforcement sector.

Both are well on track and we will be able to finalize them this year. In fact the Court confirms the importance of strong data protection safeguards once more today and this is exactly the aim of the Commission’s reforms that are on the table.

One example on the Data Protection Reform: the reform aims to strengthen the powers of national data protection authorities, which have an essential role in upholding individuals’ rights to data protection. This is fully in line with today’s ruling.

The Umbrella agreement is something different than Safe Harbour. It does not itself enable data transfers. Rather, it sets high data protection standards in the area of police and criminal justice cooperation. The Umbrella agreement will improve the protection of personal data of Europeans in the U.S. as it will make sure that citizens will have recourse to judicial redress possibilities in the U.S. in case of privacy breaches, once the US Congress has adopted the respective draft Bill.

To conclude, let me underline once more: The Commission remains fully committed to data transfers across the Atlantic whilst ensuring robust data protection safeguards for citizens and legal clarity for businesses. Thank you.

Courtesy of the European Commission