No end to the Safe Harbor vacuum

Sunday (31st) marks the deadline for a new Safe Harbor agreement on transatlantic data transfers. It is unlikely that this deadline will be met. The victims of the ongoing legal uncertainty are thousands of businesses across Europe. They need legal certainty to be able to plan ahead.

European companies can only respire a little bit: A US Senate penal has passed the amended Judicial Redress Act on Thursday and thereby cleared the way to a new data transfer agreement. The Judicial Redress Act will extend the privacy rights of US citizens to EU citizens. However, the European data protection authorities have not yet arrived at a consensus on legal data transfers to the US – therefore, it seems like Safe Harbor II is still far off.

It was already in October that the European Court of Justice (ECJ) ruled that personal data may no longer be transferred from the EU to the US based on the Safe Harbor Agreement due to lacking US data protection.

Safe Harbor had been the main basis for the legal transfer of data to the US for more than 4,000 European companies. Now, the companies have to use alternative legal instruments. First, they can base their data transfers on standard contractual clauses issued by the European Commission. Second, they can use Corporate Binding Rules for data exchange within the company.

The European data protection authorities have granted the companies a reprieve until the end of January to adapt their data transfers to these alternatives. It is also until the end of January that the authorities want to clarify how the ECJ ruling may affect these specific alternatives. Furthermore, the US and the European Commission have promised to provide a new Safe Harbor agreement until this date.

However, the deadlines will likely not be met. The victims are the companies – they will have to operate in a legal limbo from next week on. Therefore, the European data protection authorities must quickly agree on a common position on the future of Safe Harbor. This position should at least transitionally maintain the standard contractual clauses and the Corporate Binding Rules to allow data transfers to the US. In the medium term, however, new rules and reforms are conceivable and necessary on both sides of the Atlantic.

Furthermore, it is important that Europe takes on a strong, consistent attitude in the matter. Only then the balancing act in the Safe Harbor negotiations with the US can succeed, which is crucial for the future of Europe as a business location. This balancing act consists in nothing less than balancing the European fundamental right to the protection of personal data with the requirements of a globally networked economy.