EU High Court Invalidates Safe Harbor Framework For Cross-Border Data Transfers

On October 6, 2015, the Court of Justice of the European Union (CJEU) issued a highly anticipated judgment that has the potential to impact how thousands of companies transfer data from the EU to the United States. The Court's decision effectively invalidates the European Commission's "adequacy" determination with respect to the U.S.-EU Safe Harbor Framework, which was established in 2000 as a mechanism to allow for the lawful transfer of EU citizens' personal data to the U.S.

The ruling comes on the heels of a recent controversial opinion from the CJEU's Advocate General, Yves Bot, who called for a suspension of the Safe Harbor Framework in light of findings regarding the U.S. government's widespread collection of personal data and the lack of judicial redress available for EU citizens affected by such activities.

Background

Following the 2013 Snowden revelations concerning the scope of U.S. government access to personal data, Max Schrems, an Austrian citizen and Facebook user since 2008, lodged a complaint with the Irish data protection authority (the DPC) with respect to Facebook's transfer of his personal data from Facebook's Irish subsidiary to Facebook in the United States.

The Irish DPC rejected Schrems' complaint on the grounds that Facebook's transfers were permitted pursuant to the U.S.-EU Safe Harbor Framework. Schrems then challenged that decision before the Irish High Court, which ultimately stayed its proceedings and applied to the CJEU for a determination regarding whether the Irish DPC (and other EU data protection authorities) could investigate claims concerning the validity of the European Commission's adequacy determination pertaining to the Safe Harbor Framework.

The CJEU's October 6 Judgment

Key points from the CJEU's judgment:

The CJEU decided that the Irish DPC could investigate claims of this nature and conduct its own investigations, but reinforced that, in the interest of guaranteeing legal certainty with respect to the application of EU law, "the Court alone has jurisdiction to declare that an EU act, such as a Commission decision adopted pursuant to Article 25(6) or Directive 95/46, is invalid." (¶61) The CJEU considered the European Commission's decision on the adequacy of the Safe Harbor Framework (Decision 2000/520), noting that U.S. "national security, public interest, or law enforcement requirements have primacy over the safe harbour principles" (¶86), and that Decision 2000/520 does not (1) contain any...