Two recent developments have significantly increased the already uncertain legal landscape surrounding transatlantic data flows. Earlier today, the EU Parliament voted out a resolution calling on the European Commission (EU Commission) to further negotiate the terms of the EU-U.S. Privacy Shield (Privacy Shield). And yesterday, the Irish Data Protection Commissioner (DPC) announced the launch of new proceedings before the Court of Justice of the European Union (CJEU) to assess the validity of the EU Standard Contractual Clauses, a key transatlantic data transfer mechanism used by companies in the wake of the invalidation of the EU-U.S. Safe Harbor Framework (Safe Harbor).

EU Parliament Adds Pressure on Privacy Shield

Today's EU Parliament resolution calls on the EU Commission to incorporate the recommendations issued by the Article 29 Working Party (WP29) in its April opinion, and to further negotiate with the U.S. government before formally adopting the Privacy Shield. Although the resolution is not binding on the EU Commission or the EU countries, it increases the political pressure regarding the Privacy Shield.

The Privacy Shield was publicly released by the EU Commission on February 29, 2016, but is not yet effective. The EU Commission still needs to issue an adequacy decision that formally recognizes the Privacy Shield as a valid legal basis for data transfers to the U.S. This requires an opinion from the WP29 and a vote from representatives of EU countries (within the so-called Article 31 Committee).

To date, there has been little support for the Privacy Shield from these groups. The WP29 issued an unfavorable opinion on the Privacy Shield in April 2016, and the various meetings of representatives of the EU countries have been reported to be critical of the Privacy Shield. In its April opinion, the WP29 criticized the complexity of the Privacy Shield documents and in particular the redress mechanisms for EU citizens, and generally asked to better align the Privacy Shield with EU data protection principles. The WP29 also requested additional safeguards against bulk data access by U.S. surveillance authorities. More details on the opinion can be found here. Additional rounds of negotiations between the EU Commission and the U.S. Department of Commerce are currently taking place.

Validity of EU Standard Contractual Clauses Is Further Questioned

After the invalidation of the Safe Harbor, companies transferring personal data between the EU and the U.S. were left with few data transfer solutions: EU Standard Contractual Clauses, Binding Corporate Rules, Ad-hoc Contract, or limited exceptions. Many companies chose to implement the EU Standard Contractual Clauses.

After the Schrems judgment was issued, Max Schrems filed a new complaint with the Irish DPC against Facebook. His new complaint argued that Facebook's reliance on the EU Standard Contractual Clauses for data transfers to the U.S. was not in line with the requirements of the CJEU's Schrems judgment.

Yesterday, the Irish DPC announced that it will soon ask the Irish High Court to request a new preliminary ruling from the CJEU (as in Schrems) regarding the validity of EU Standard Contractual Clauses as a data transfer mechanism. The exact timing of the proceedings is uncertain, but it is likely that the CJEU will take a minimum of 12 to 18 months to issue its final decision. This announcement greatly increases the legal uncertainty around EU-U.S. data transfers.

We will continue to monitor related developments and update you on any significant news.

Wilson Sonsini Goodrich & Rosati routinely helps clients manage risks related to the enforcement of privacy and data protection laws globally, along with advising clients on EU privacy and data security issues. For more information, please contact Cédric Burton, Christopher Kuner, Lydia Parnes, Michael Rubin, Chris Olsen, or another member of the firm's privacy and data protection practice.

Sarah Cadiot, Sára G. Hoffman, and Laura De Boel contributed to the preparation of this WSGR Alert.