Mightier Than The Shield? EU-US Data Transfers Back Under The Microscope

In October 2015 the EU's highest court (the CJEU) found the longstanding EU-US data transfer framework – Safe Harbor – to be invalid. In the interim, both  EU regulators and the European Commission moved to offer guidance and clarification. Within 2 weeks of the CJEU decision, EU regulators, in their collective grouping as the Article 29 Working Party ("WP29"), confirmed that both the European Commission Standard Contractual Clauses ("SCCs") and Binding Corporate Rules ("BCRs") remained valid methods to transfer data to the US. However, WP29 also indicated that coordinated enforcement may begin by end of January 2016.

This week, the 31 January deadline expired and WP29 convened a two-day meeting to discuss, among other issues, US data transfers. In parallel, the European Commission ("Commission") issued a press release indicating that agreement had been reached with the US for a new framework to support data transfers. We take a look at these developments and