By Dr. Thomas Jansen and Dr. Reka Hatala
Today the Independent Centre for Privacy Protection of the Federal State Schleswig-Holstein (“ULD”), one of the seventeen data protection authorities in Germany, published its position paper on the Safe Harbor decision of the ECJ. While most of the authorities have been cautious in connection with the ECJ decision so far, the ULD expressed a very unambiguous and restrictive view with respect to the consequences of the decision.
The position paper refers to Clause 5 (b) of the EU Model Clauses stating that the data importer shall warrant that it has no reason to believe that the legislation applicable to it prevents it from fulfilling the instructions received from the data exporter and its obligations under the contract. The ULD is of the opinion that a recipient of personal data in the US cannot comply with the above obligation due to the awareness of US legislation permitting public authorities to have access to the content of electronic communications on a generalized basis, which is regarded as comprising the fundamental rights to respect private life. In such case, according to Clause 5 (b) of the Model Clauses, the data exporter is entitled to suspend the transfer of data and/or terminate the contract with the data importer.
In accordance with the above the ULD calls data controllers transferring data to the US on the basis of EU Model Clauses to take into consideration the termination of the EU Model Clauses agreements or to suspend the transfers. The ULD clearly expresses its view that upon consequent application of the ECJ decision data transfers based on the EU Model Clauses are not permitted anymore.
Whereby the ULD has competence for data processing taking place in Schleswig-Holstein only, on the basis of this position paper it can be anticipated that further data protection authorities will represent a similarly stringent approach.
As the ULD also established that consent cannot be validly given by the data subjects for data transfers to the US, companies are running out of options and may have no other opportunity than continuing the data transfers based on EU Model Clauses, in which case, however, they risk a fine. Hopefully there will be a unified position of the authorities by the time such possible fines can be appealed against.