On 6 October 2015, the European Court of Justice (the “ECJ”) rendered a landmark judgment regarding the Safe Harbour principles that represent a key element in the transfer of personal data from the European Union to the United States (Case C-362/14, Maximillian Schrems v. Data Protection Commissioner). As a principle, personal data shall not be transferred to a third country (i.e. non EU Member State) if that third country does not ensure an adequate level of protection (that is a level of protection for individuals equivalent to that granted by European data protection legislation deriving from Directive 95/46/EC).
Following preliminary questions raised by the Irish High Court, the ECJ reaffirmed the powers of the national supervisory authorities (such as the Commission Nationale pour la Protection des Données in Luxembourg) in their mission of controlling the proper compliance of national data protection legislation by individuals and companies. Accordingly, even if a prior favourable decision from the European Commission exists as to the adequate level of protection in a third country – such as Decision 2000/520 in relation to the Safe Harbour principles in the United States - the national supervisory authorities shall investigate and render a decision when a complaint is lodged before them regarding the processing of personal data in that third country.
In the Schrems case, the complaint lodged before the Irish Data Protection Commissioner dealt with the processing in the United States of personal data collected in Ireland and the transfer of those data from Facebook Ireland to Facebook, Inc. The Data Protection Commissioner had dismissed the complaint arguing that, in its Decision 2000/520, the European Commission had ruled that the U.S undertakings adhering to the Safe Harbour principles (such as Facebook, Inc.) were granting an adequate level of protection in its Decision 2000/520.
On 6 October 2015, the ECJ disagreed with that reasoning and declared invalid the Decision 2000/520 in relation to the Safe Harbour principles. The reasoning of the ECJ and the impact of the ruling for business players working in or with the United States will be further detailed in an article that will be published on our website.
