On October 6, 2015, the Court of Justice of the EU (CJEU) ruled
that the Safe Harbor decision from the EU Commission (Decision 2000/520) is invalid. The ruling
seems more severe than the opinion rendered on September 23, 2015, by
Advocate General Yves Bot, also proposing to declare this decision
invalid.
First, the CJEU states very clearly that an EU Commission
decision finding that a third country ensures an adequate level of
protection of the personal data cannot eliminate or reduce the
powers given by the Charter of Fundamental Rights and by Data
Protection Directive 95/46 to National Data Protection Authorities
(NDPAs). In other words, it remains the duty of the NDPAs to review
whether a processing is compliant with EU and national laws. An
NDPA cannot, however, decide that an EU Commission decision is
invalid. Only the CJEU has this authority. Therefore, an NDPA, when
dealing with a claim that leads it to consider that a decision of
the EU Commission is invalid,
