An update of EU regulatory developments since the European Court of Justice ruled the US/EU Safe Harbour Agreement invalid:
The Unabhängiges Landeszentrum für Datenschutz (ULD), a German data protection agency, has issued a position paper stating that “organisations, which use Standard Contractual Clauses to transfer personal data to US, now need to consider terminating the underlying standard contract with the data importer in the US or suspending data transfers. In consistent application of the requirements explicated by the CJEU in its judgment, a data transfer on the basis of Standard Contractual Clauses to the US is no longer permitted“.
This has been closely following by a public statement from the Article 29 Working Group, which is currently analysing the impact of the European Court of Justice judgment on other transfer tools (such as Standard Contractual Clauses). The ULD noted that in the interim “data protection authorities consider that Standard Contractual Clauses and Binding Corporate Rules can still be used“, although “this will not prevent data protection authorities to investigate particular cases, for instance on the basis of
complaints, and to exercise their powers in order to protect individuals“.