The CJEU`s decision led to months of negotiations between representatives of the United States and the European Commission on a new framework to replace the Safe Harbor. The European Data Protection Authorities, represented by the Article 29 Working Group (a working group composed of representatives of EU Member States, EU institutions and the European Commission tasked with providing advice on data protection and privacy issues), had given both parties until the end of January 2016 to reach a new agreement. When the clock struck midnight at the deadline, officials from the European Commission and the United States announced a new data transfer agreement – the EU-US Privacy Shield Agreement. A few weeks later, they provided the details. Initial reactions from the US government expressed disappointment and concern over the CJEU`s decision. FTC President Edith Ramirez issued a brief statement that the FTC would review the decision and assess its impact. Ramirez also said the FTC would continue to work with its “European counterparts to develop effective solutions to protect consumer privacy when it comes to cross-border data transfers.” U.S. Commerce Secretary Penny Pritzker expressed disappointment with the decision and encouraged an agreement on an updated safe harbor deal as soon as possible. White House press secretary Josh Earnest told reporters: “We believe this decision was based on false assumptions about privacy in the United States. There is concern about the economic consequences of this particular decision. In its statement following the publication of the decision, the Article 29 Working Group highlighted the problems identified by the CJEU with the Safe Harbour and called on the EC and the US.
The authorities should continue negotiations to develop the type of legal and technical mechanisms that would allow the transfer of data to the US in a way that respects the fundamental rights of EU citizens and have announced that national data protection authorities will start taking the necessary measures, possibly including enforcement measures, by the end of January 2016 if the US and the EU fail to reach an agreement. Could. With the new agreement, this rule has changed radically. Companies that now wish to pass on data to third parties must also respect the principle of purpose limitation and ensure that the third party offers the same level of protection as the company of origin. Organizations must also provide the Department of Commerce with a copy of the relevant parts of their confidentiality agreement with the third party upon request. However, even if these requirements are met, an organization remains liable if the third party does not process the information in a manner consistent with the Privacy Shield, unless it proves that it is not responsible for an event that harms personal data. ItI encouraged the European Commission and the US Department of Commerce to negotiate a new agreement to replace the Safe Harbour Framework by 31 January 2016, established by the data protection authorities of EU Member States following the CJEU ruling. After Safe Harbor, the international data transfer law used by the United States and the European Union, was declared invalid in October 2015, the Department of Commerce and the European Commission worked to draft a new agreement that would give Europeans more rights with respect to their personal data in the United States. On July 12, 2016, the EU-U.S. Privacy Shield Act was passed.
Statement by Thomas Jarzombek, CDU/CSU-BT Parliamentary Group on the Digital Agenda, the EU-US Privacy Shield. “. An agreement in the negotiations on transatlantic data exchange gives hope that legal certainty will soon prevail for the digital economy and that a free flow of data across the Atlantic will be guaranteed. Each of these options has advantages and disadvantages; Therefore, companies should carefully consider the different options, taking into account the specific data, organisations and purposes of the transfers in question. Part of this calculation should probably include the chances of success of the Privacy Shield when the inevitable challenges are brought before the courts; Despite the strict data protection requirements and control mechanisms contained in the regulation, a number of critics have already focused on perceived shortcomings to raise doubts about the agreement`s compliance with EU law. A significant change from the Safe Harbor is the transfer of data to third parties or the principle of onward transfer. Under the old agreement, an organization was required to provide consumers with notice and choice before sharing personal information with third parties, but this was not necessary if the third party “acted as an agent to perform tasks on behalf of and at the direction of a third party.” The 6. In October 2015, the Court of Justice of the European Union issued a ruling declaring “invalid” European Commission Decision 2000/520/EC of 26 July 2000 “on the adequacy of the Safe Harbor Privacy Principles and related frequently asked questions of the United States Department of Commerce”. As a result of this decision, the Safe Harbor Agreement between the United States and the EU is not a valid mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States. .
