Facebook and other online communities, among others, several online stores and more than 5,000 other online services and businesses now need more detailed information on how to process European users ’data in the future.
According to Data Protection Commissioner Reijo Aarnio, the decision of the European Court of Justice to annul the EU-US data transfer agreement knows more work for data protection authorities. The consequences of the decision are not yet completely clear to them either, although in Aarnio's opinion it is already in force.
Read more: Serious blow to online services - EU-US data deal collapses on suspicion of espionage
The EU-US Privacy Shield Agreement, which has been repealed by the Court, has allowed US companies to transfer data from their European users to the US. According to the European Court of Justice, US intelligence laws endangered the privacy of European users' data, making it impossible to use the EU-wide agreement.
In the United States, the ruling of the European Court of Justice has been disappointed, although even there the actual impact assessment is still in its infancy.
"While the US Department of Commerce is deeply disappointed that the right to invalidate the European Commission's Privacy Shield decision, we are still examining the decision to understand its practical implications," Secretary of Commerce Wilbur Ross told Reuters.
Instead of a Privacy Shield, so-called EU model contracts or standard contractual clauses (SCCs) can be used, which also require data collectors and processors to protect users' privacy.
However, according to Aarnio, there are still uncertainties regarding the application of the model contracts, and the European Data Protection Supervisors will start analyzing the effects of the court ruling on Friday.
In its ruling, the Court emphasized that data protection authorities must prevent the transfer of data if they do not in any case trust that the data of European users will be secure outside Europe.
- It is essential that the effects of the judgment are the same throughout Europe, Aarnio says.
- In any case, I think the court made a great decision. The European line is clearly a European line based on fundamental and human rights.
The Data Protection Board of the EU Data Protection Supervisors will start its first consultation on the subject remotely tomorrow morning. A follow-up is planned for the two-hour plenary session in the afternoon.
- I wonder a bit if the finish will be available, at least within the working hours, Aarnio ponders.
According to him, the Data Protection Council will probably publish more detailed instructions next time early next week and more information in late July.