The Court of Justice of the European Union (CJEU) has been advised by its Advocate General (AG) to find that the European Commission decision establishing the ‘Safe Harbor’ framework does not eliminate or reduce national authorities’ duties to assess compliance with EU data protection laws.  While the CJEU’s judges are not bound by the AG’s advice, they tend to follow it in most cases. 

The AG also advised that the Safe Harbor framework is invalid in the light of findings that the US allows for large-scale collection of personal data from EU citizens which is transferred to the US, without effective judicial protection.  These findings, the AG noted, demonstrate that the Safe Harbor framework does not contain sufficient guarantees in respect of data protection.

The case arises from a complaint filed by an Austrian law student, Max Schrems, against Facebook with the Irish Data Protection Commissioner (DPC).  Mr Schrems sought judicial review of the DPC’s decision not to investigate his complaints, particularly in relation to the security of personal information transferred to the US. The Irish High Court referred the question of whether or not the DPC was bound by the Commission decision establishing the Safe Harbor framework  given the “gaping holes in contemporary US data protection practice”.  It also questioned whether the DPC could or should conduct its own investigation in light of allegations of mass US surveillance programs.

The future of Safe Harbor has been in question since Edward Snowden leaked details of a US mass electronic surveillance program in 2013. The leaks showed that the National Security Agency in the US used major web companies, including Apple, Google, Facebook and Microsoft, to gather user data.  Following this, the European Commission called for a review of the Safe Harbor framework and negotiations have been ongoing for some time.

For those companies that transfer data to and from the US, the Safe Harbor framework is of crucial importance.  Irish businesses who currently rely on Safe Harbor should start considering alternative options in the event that the CJEU decides to follow the AG’s opinion in this case.

Follow us on Twitter    @WFIDEA

Contributed by: John Magee & John Farrell