The effects of the upcoming changes in EU Data Protection Laws on Safe Harbor
On 12th March 2014, the European Parliament adopted the Draft of a Proposal for a New Data Protection Regulation from 25th January 2012 that published the European Commission. This Proposal aims at adapting the existing EU Data Protection Directive 95/46/EC to the new threats and risks, as well as to establish stronger measures and higher fines in case of data breaches.
The most important consequence for Non-European companies is that they will also be subject to the same rules as these in force in the EU when operating in EU markets. In some cases, it may be also mandatory to appoint a representative in the EU for the companies that are located outside the EU but offer services in the EU.
The Committee on Civil Liberties, Justice and Home Affairs, a standing committee from the European Parliament, published a report on 21st February 2014, in which it recognizes the necessity to find new mechanisms to protect the private sphere of individuals, as U.S. Data Protection legal Framework and U.S. Safe Harbor are considered not to provide an adequate level of protection.
Additionally, the European Commission already stated in the “Communication from 27th November 2013 on the Functioning of the Safe Harbor from the Perspective of EU Citizens and Companies established in the EU”, that it is an essential aspect to restore trust in data transfers between the U.S.A. and the EU/EEA. To achieve this, U.S. companies will have to act according to European legislation, as well as provide adequate safeguards regarding Data Processing.
All these aspects will have an impact on the EU-U.S. Safe Harbor Framework. For example, U.S.-based companies will have to search for alternative means to carry out international data transfers, if the Commission Decision 520/2000, which declared the adequacy of the Safe Harbor Privacy Principles, is suspended.
Moreover, the Proposal for a Directive concerning measures to ensure a high common level of network and information security across the Union, also called “NIS – Network and Information Security”, for which the European Parliament voted on 13th March 2014, will enforce issues regarding Data Security. This implies, for example, that the EU Member States’ companies will have to improve their infrastructures and that more requirements will be demanded by the national authorities respectively Data Processing and especially network and information security.
