As policy-makers in Washington, DC, and Brussels meet to discuss possible alternatives to Safe Harbor in order to keep data flowing across the Atlantic, corporate privacy professionals are facing an immediate need to respond to the European Court of Justice's (ECJ's) landmark decision in the Schrems case. Whether your company relied on Safe Harbor to transfer data for storage in the cloud, to process consumer orders, centralize HR administration, engage service providers or communicate with corporate affiliates, you now need a new solution, and you need it today. What do you do until the bigwigs hammer out a new deal for Safe Harbor 2.0? Execute dozens of model clauses? Engage pricey consultants to start your binding corporate rules? Rely on consent? Or perhaps lay low and wait for the storm to pass?
On October 6, more than 2,500 professionals registered to join an IAPP web conference featuring initial reactions on the day of the Safe Harbor decision. During that session, the IAPP received dozens of questions about next steps. We poured the questions into eight buckets, entitled:
- What does the ruling do?
- What now?
- Timetable
- BCRs and model clauses as alternatives
- Enforcement
- Potential solutions
- Official responses and implications on foreign policy
- Policy and related issues
In this third installment of a five-piece series, we feature answers provided to your questions by a panel of world-renowned privacy professionals. In this piece, Wilson Sonsini Goodrich & Rosati's Laura De Boel, Cedric Burton and Chris Kuner, a member of the IAPP GDPR Comprehensive Faculty, address the "timetable" bucket.
Have more questions? Our contributors will be available to answer them in person at the IAPP’s GDPR Comprehensive, February 22-23, in Brussels. Join them there for a special training event to learn about the new framework that is set to arrive at the end of 2015.
If you missed installments one and two, find them here (enforcement and potential solutions) and here (BCRs and model clauses).
Timetable
The Privacy Advisor: Will enforcement be stayed for a certain time period? Is there an implementation period?
WSGR: The judgment does not provide for a grace period, so enforcement can be immediate. The WP29 issued a statement on Friday, October 16, in which it urged the EU, the member states and the U.S. to find a solution for data transfers to the U.S. by the end of January 2016. In the meantime, the WP29 will examine the alternative data transfer mechanisms, i.e., model clauses and BCRs. Depending on the outcome of the EU-U.S. negotiations and the WP29’s analysis of the alternative data transfer mechanisms, the WP29 will start taking action by the end of January 2016. This may include coordinated enforcement actions.
In practice, this may result in some form of grace period until the end of January 2016, but this may also be understood as an ultimatum given to the U.S. and EU institutions to agree on a new framework. DPAs may decide to hold off with investigations at their own initiative until the end of January 2016. However, private enforcement actions may occur if individuals submit complaints to DPAs. We understand that some DPAs have already received complaints regarding companies’ international data transfer practices.
The Privacy Advisor: Is there any reason a vendor that previously relied on Safe Harbor shouldn’t be putting alternatives into place immediately? Is there any validity to the argument that a renegotiated Safe Harbor will emerge and cover these data transfers and therefore the vendor can sit tight for now?
WSGR: No. Until a new Safe Harbor is agreed upon, Safe Harbor-certified companies lack a legal basis for data transfers to the U.S. In addition, a renegotiated Safe Harbor will likely lack trust from customers and will be at risk of being challenged. Therefore, companies should asses the alternative data transfer mechanisms, e.g., model contrac), or rely on one of the derogations provided in the Data Protection Directive, e.g., consent. However, in practice, certain companies may decide to hold off on implementing an alternative data transfer mechanism straightaway, since DPAs are also questioning the validity of these mechanisms under the Schrems judgment. There is a high degree of legal uncertainty in the EU. Companies need clear guidance from the WP29 and national DPAs on this issue as quickly as possible.
The Privacy Advisor: BCRs take six to nine months at best, sometimes years for companies. Start-ups and small/medium businesses go global on day one, and today have contracts in jeopardy even with a previously good Safe Harbor program. What can we tell customers?
WSGR: You should tell customers that you will continue to process the data already transferred to the U.S. in accordance with the Safe Harbor principles and that you are in parallel working on implementing an alternative data transfer solution(s) as quickly as possible. However, implementing an alternative mechanism takes time and resources as there is no one-size-fits-all alternative solution to Safe Harbor that can be recommended to all companies. Each company should look at its data processing activities, corporate structure and the nature and frequency of its international data flows to determine which solution fits. Regarding BCRs, this is not the panacea and they are unlikely to be a workable solution for start-ups and small/medium business. Even if the BCRs approval process has been streamlined, it still takes a lot of time and resources. Before Schrems, it was sometimes possible to obtain an approval within 12 to 18 months. However, as a consequence of Schrems, DPAs will likely receive an increased number of BCRs applications, which will slow down the approval process.