NEW FRAMEWORK
On 2 February 2016, the European Commission issued a press release announcing that they had reached a consensus with the US Government in order to establish a new framework for personal data exchange.
Said new framework has been named “EU-US Privacy Shield” and, according to said press release, it aims to meet the requirements mentioned in the judgement of the European Court of Justice on 6 October 2015, already commented in a previous article and which annulled the Commission’s decision that declared the US as “safe harbour” with regard to data protection.
However, such negotiation has not yet materialised in any binding decision for operators.
PRACTICAL EFFECTS
After the US “safe harbour” was cancelled, until a new binding decision is made by the European Commission, companies wishing to transfer personal data to the US must apply for a regulatory approval from the Spanish Data Protection Agency.
Companies applying for said approval must provide, among others:
the contract based on the standard contractual clauses from which the transfer is derived; an application letter; powers of attorney of the applicant; etc.
For the transfer between companies belonging to the same group, the Binding Corporate Rules (BCR) are to be observed.
Once all documents have been submitted, the AEPD (the Spanish Data Protection Agency) is allowed a period of three months to rule a decision (positive or negative). Once this period of three months has elapsed, the authorisation will be considered to have been granted.
CONCLUSION
Said procedure will vanish for transfers of data to the United State if the U.S is declared a safe harbour again. According to the press release of 2 February, the Commission will issue the corresponding decision as soon as U.S. authorities carry out modifications in their regulation. It is unknown how long it will take, thus conservative companies must adhere to current requirements and apply for a regulatory approval.
Vilá Abogados
For more information, please contact:
