The CJEU invalidates the “Safe Harbor” level of security for data transfers with the United States.
The judgment c-362/14 of the Court of Justice of the European Union (CJEU) invalidates the Commission Decision that declared the level of protection of the Safe Harbor between the EU and the US to be adequate.
But how does this affect Spanish companies?
Currently, a large majority of cloud services used by businesses are based in the United States. These services transfer our clients' data to servers located in the US. For example, companies use email marketing platforms like Mailchimp, store invoices in the cloud as a backup in Dropbox , use Google for surveys, and engage with social media platforms like Facebook, Twitter, and Instagram. Through all these activities, companies are transferring data outside the European Union. This means that the data falls under the jurisdiction of the United States of America.
To guarantee the fundamental rights of EU citizens, adequate levels of protection were established for data transfers. But after Edward Snowdenthat the US National Security Agency (NSA) was conducting surveillance on data stored in the US, things changed. Austrian Maximillian Schrems sued Facebook before the Irish authorities for failing to guarantee the protection of his data by storing it in the US, and after several years in court, the Court of Justice of the European Union (CJEU) ruled that the level of data transfer protection was invalid.
Following this October 2015 ruling, the data protection agencies of the member states issued communications to the companies affected. The Spanish Agency sent an "ultimatum" setting January 29, 2016, as the deadline for compliance with the new specifications (see the Confidencial news article) . However, after this deadline, it issued a statement specifying that the ruling "implies that transfers from the European Union to the US can no longer be carried out under the legal basis of the Safe Harbor Decision."
What options do companies have now?
The joint statement from the Data Protection Agencies affirms that “ Transfers still being carried out under the Safe Harbor Decision following the CJEU ruling are illegal,” and the Spanish Data Protection Agency has set a deadline of January 29, 2016, for compliance. So what options are left?
The first step is to check with your service provider to see what actions they are taking. Applications like Jootform have offered their European users the option to transfer all their data to servers located in EU countries. Others, like Mailchimp ( download the contract here ), are offering a contract committing them to process data in accordance with European legislation . Both of these actions comply with the new regulations following the ruling.
If they are not adapting to the new legal situation, it will be necessary to look for alternatives to the applications that have the information hosted in the EU.
For any questions or to discuss your specific case, you can contact us via email at ambit@ambitassessor.com or at our offices.
Jordi Gabarró
Social Media Manager
Linkedin: in/Jordigabarro
Twitter: @unaltrediasera
Do you have any questions about this topic?
Our team of expert advisors will help you resolve any issues related to our services.
Contact us now
A Àmbit Assessor, SL has 40 years dedicated to the tax, comptable and labor consultancy of the Pime.
Latest entries from MGI Àmbit
(see all)
Related
