The Court of Justice of the European Union (the “CJEU”) ruled this October that a 15-year-old decision of the EU Commission (so-called “Safe Harbour Decision”), which allows the USA-based companies to handle EU citizens’ personal data, is invalid.
The Safe Harbour Decision included a series of principles concerning personal data protection under which the USA companies were allowed to transfer personal data of EU citizens back to the USA if complied with one set of rules on how data collected within the European Union should be stored and processed.
Basically, in the ruling of the CJEU it is pointed out that the EU Commission was incompetent to eliminate or even reduce the national personal data authorities’ powers and that the Safe Harbour Decision compromised the essence of the fundamental right to respect for private life provided by the Charter of Fundamental Rights of the EU, and the Data Protection Directive.
Although this ruling of the CJEU could primarily affect technology companies e.g. Amazon, Facebook and Google operating across the EU, we do advise our clients engaged in transferring personal data to the USA entities, or servers located in the USA, to take this issue with significant diligence.