Safe Harbour: EU and US reach deal on data transfers

European Union and United States negotiators have reached agreement on a new pact to underpin transatlantic data transfers. The deal comes almost four months after the Safe Harbour agreement governing data transfer was deemed invalid by the European Court of Justice.

The last-minute agreement was struck on Tuesday as EU data protection commissioners were poised to consider curbing data transfers. This followed the passing of a January 31st deadline for a new deal without agreement.

Announcing the new pact – which will be known as the EU-US privacy shield – EU commissioner with responsibility for the single market Andrus Ansip said the deal would protect the “fundamental rights” of EU citizens and provide legal certainty to businesses.

“The US has given binding assurances that access for law enforcement will be subject to clear limitations, safeguards and oversight . . . We will hold the US accountable to the commitments they have made,” Mr Ansip said in Strasbourg, noting the introduction of an annual review clause.

Among the main features of the deal is the establishment of an ombudsman to deal with complaints by EU citizens about the handling of their data.

The commission also outlined a three-step redress process for citizens. Citizens will be encouraged in the first instance to bring their complaints to the relevant company. As a second option, they can access a free dispute-resolution procedure through their data protection authority, while a final resort will be an arbitration process, handled by the ombudsman.

“Once the judicial redress act is passed, EU citizens will have access to US courts,” said EU justice commissioner Vera Jourová. She said she expected the pact to be in force within three months.

Asked if the new deal could still be tested in the European Court of Justice (ECJ), she said that while there may be new complainants, she was “pretty sure” the new scheme would withstand assessment.

She also noted the pact had taken on board the ECJ ruling that had deemed Safe Harbour invalid. “We really think it was a good solution to wait for the court ruling – we used the court decision as a benchmark to guide us to formulate the requirements.”