The CJEU Safe Harbor Decision: Keep Calm but Protect Your Business October 14, 2015

Size: px

Start display at page:

Download "The CJEU Safe Harbor Decision: Keep Calm but Protect Your Business October 14, 2015"

Collin Long
7 years ago
Views:

1 The CJEU Safe Harbor Decision: Keep Calm but Protect Your Business October 14, 2015

2 Privacy and Data Protection Team Named Practice Group of the Year by Law360 Chambers USA 2014 Nationally-Ranked Privacy and Data Protection Practice Over 750 breaches handled; more than 245 in 2014 alone Team includes 40+ attorneys specializing in privacy and data security law across the country Tanya Forsheit, Esq. Partner, Los Angeles Tel. (310) Melinda McLellan, Esq. Counsel, New York Tel. (212) Blog:

3 Holman Fenwick Willan LLP Privacy and Data Protection Team recommended in Legal 500 for its ability, experience, knowledge and responsiveness in assisting purchasers and suppliers in regulatory and commercial issues International capability (13 offices in 11 countries) Europe: Belgium, France, Greece, Switzerland, UK Global: Australia, Brazil, China, Hong Kong, Singapore, UAE Anthony Woolich Partner, London Tel. +44 (0) Felicity Burling Associate, London Tel. +44 (0)

4 Agenda Overview: EU Data Protection Law & Cross- Border Data Transfers History of the Safe Harbor Framework The October 6 Decision Background; Key Conclusions; Legal Effects What Now? Next Steps in the Short Term Practical Impacts; Compliance Options What Next? Potentially Sustainable Solutions Safe Harbor 2.0; U.S. Legislation; Data Localization 4

5 EU Data Protection Law The EU Data Protection Directive Key terms and concepts: What is Personal Data? Data controllers / processors? Application across the EU Data transfer across borders what s the problem? European Commission s adequacy findings 5

6 The EU-US Safe Harbor Framework Origins of the Safe Harbor Framework Role of the Department of Commerce The self-certification process U.S. Federal Trade Commission Recent enforcement actions Criticism of the Safe Harbor EU reaction to Snowden revelations Ongoing negotiations to revamp Safe Harbor 6

7 The Schrems Case Maximillian Schrems, Facebook and the Irish Data Protection Authority Why the Court of Justice of the European Union? Advocate General Bot s Opinion Invalidate Safe Harbor Broader authority for DPAs CJEU decision not subject to appeal Case goes back to Ireland 7

8 The CJEU s Judgment Deficiencies in the European Commission s adequacy finding re: Safe Harbor Enables interference with fundamental rights of EU data subjects No effective legal protection for EU citizens CJEU alone has authority to invalidate a Commission decision Impact on other data transfer mechanisms Retroactivity? 8

9 What Now? Legal Impact Legal effect of the CJEU decision: Safe Harbor invalid (on its legal construction) DPAs can investigate despite Commission decisions EU Data Protection Authorities reactions (so far) What legal actions can be taken to stop businesses from transferring data to the U.S.? Biggest risks from the EU perspective Powers under the Directive (Art. 28) Penalties and liability for illegal transfer Reputational damage 9

10 What Now? Practical Impact Effects on day-to-day business operations What are the risks of business as usual? Stop-gap measures Continue to adhere to Safe Harbor principles Consider consent as a basis for certain transfers Alternative data transfer mechanisms Representations regarding Safe Harbor Updating privacy policies Service provider agreements and other contracts 10

11 What Next? Guidance from DPAs and other regulators Safe Harbor 2.0? Will individual DPAs create a patchwork quilt in Europe? Will forthcoming legislation in the U.S. satisfy EU authorities? EU citizen awareness and Schrems-style inquiries and challenges 11

12 Questions? When will enforcement begin, and what will it look like? Will the CJEU judgment create a de facto data localization requirement in the EU? Could the U.S. ever achieve adequacy? How will forthcoming revisions to the EU Data Protection Directive shape the landscape? 12

13 United Kingdom Friary Court 65 Crutched Friars London EC3N 2AE T: +44 (0) F: +44 (0) France - Paris 65 rue d Anjou Paris T: F: Belgium Blue Tower Avenue Louise Brussels T: F: Switzerland - Geneva 6th Floor 13-15, Cours de Rive 1204 Geneva T: +41 (0) F: +41 (0) Greece 6th Floor 83 Akti Miaouli & Flessa Street Piraeus T: F: Dubai Level 8, Barclays Building Emaar Square, Sheikh Zayed Rd PO Box 53934, Dubai, UAE T: F: Hong Kong 15th Floor Tower One Lippo Centre, 89 Queensway Admiralty, Hong Kong T: F: People s Republic of China Room 901, China Insurance Building 166 East Lu Jia Zui Road, Pudong Shanghai, T: F: Singapore 3 Church Street #19-03 Samsung Hub Singapore T: F: Australia - Melbourne Level 41, Bourke Place 600 Bourke Street Melbourne VIC 3000 T: +61 (0) F: +61 (0) Australia - Sydney 1 Bligh Street Sydney NSW 2000 T: +61 (0) F: +61 (0) Australia - Perth Level 19 Alluvion 58 Mounts Bay Road Perth WA 6000 T: +61 (0) F: +61 (0) Brazil São Paulo Av. Paulista, Andar -cj.211 Bela Vista - São Paulo SP CEP Brazil T: +55 (11) F: +55 (11) ALLIANCES Salem Al Maddfa Advocates & Legal Consultants Blue Tower 6th Floor, Suite 601 Al Khaleefa St. PO Box Abu Dhabi UAE HFW AsiaLegal 3 Church Street #19-03 Samsung Hub Singapore T: F:

14 Atlanta Chicago Cincinnati Cleveland Columbus Costa Mesa Denver Houston Los Angeles New York Orlando Philadelphia Seattle Washington, DC These materials have been prepared by Baker & Hostetler LLP for informational purposes only and are not legal advice. The information is not intended to create, and receipt of it does not constitute, a lawyer-client relationship. Readers should not act upon this information without seeking professional counsel. You should consult a lawyer for individual advice regarding your own situation Baker & Hostetler LLP. All Rights Reserved.

Payment Card Industry Update and Cyber Risk Management

Payment Card Industry Update and Cyber Risk Management CRAIG A. HOFFMAN, ESQ. BAKERHOSTETLER ADAM COTTINI, MANAGING DIRECTOR, CYBER LIABILITY PRACTICE, ARTHUR J GALLAGHER & CO. OCTOBER 22, 2015 2014 ARTHUR