The End of Safe Harbor: Implications for EU Digital Privacy and Data Protection Law

摘要

While the commitment of the CJEU to highlighting the importance of high standards in the protection of privacy and personal data remains unquestionable, much uncertainty abounds concerning the implications of Schrems. In the immediate aftermath, it is somewhat of an understatement to say that the legal vacuum left by this judgment resulted in considerable uncertainty for the digital privacy of millions of EU citizens who use online services provided by US companies self-certified under Safe Harbor (such as Facebook Inc.) on a daily basis. In the longer term, the far-reaching standards imposed on future frameworks governing personal data transfers between the European Union and all other third countries, and the sweeping scope of the independence and supervisory powers of DPAs to review such regimes, established in Schrems also raise serious questions regarding the effective implementation of these requirements in practice. Nevertheless, the criteria established by the CJEU in Schrems have been adopted by the EU legislature and now forms part of the recently reformed EU data protection legislative framework under the GDPR. All such future agreements adopted by the European Commission (including the replacement for Safe Harbor) will therefore be required to meet the requirements of Schrems in order to withstand any future judicial review challenges before the CJEU.