Lack of Updated Safe Harbor Framework Could Severely Impact US-EU Companies, Witnesses to Say
While the U.S. and EU agreed in principle to a new updated safe harbor accord, little information about it has been shared publicly, said Republican and Democratic Congressional staff in memos. They were released in advance of Tuesday's joint hearing of House Commerce subcommittees on Commerce, Manufacturing and Trade and Communications and Technology on the uncertainty for U.S. businesses after a European court scuttled the 15-year agreement. Witnesses will also say the revised agreement is needed before the Jan. 31 deadline set by the European Commission's Article 29 Data Protection Working Party (see 1510160030), or companies on either side of the Atlantic could face significant impacts to their businesses and potentially face multiple enforcement and compliance regimes.
Sign up for a free preview to unlock the rest of this article
Communications Daily is required reading for senior executives at top telecom corporations, law firms, lobbying organizations, associations and government agencies (including the FCC). Join them today!
The Republican staff memo said reports have indicated progress on negotiations between the Department of Commerce and the European Commission on the new data transfer agreement. It said European Justice Commissioner Věra Jourová recently noted that both sides have agreed to certain principles and she expects “significant progress” on outstanding technical points before she visits the U.S. by mid-November. "With the impending January 2016 deadline indicated by the Article 29 Working Party, the timeline to reach a new agreement is compressed for negotiators and companies," the memo said.
The Democratic memo said many observers are "unsure whether a new agreement will withstand legal challenges." While it said the terms haven't been shared publicly, "it is expected to address, among other things, increased oversight by the Department of Commerce, redress mechanisms for consumers who feel that their data has been mishandled, and an annual review mechanism that would monitor whether law enforcement and national security services have complied with limits on access to [Europeans'] data."
More than 4,400 American companies face "immediate uncertainty about whether they could continue transferring personal data from Europe," since the Court of Justice of the European Union (ECJ) nullified the safe harbor framework Oct. 6, said John Murphy, U.S. Chamber of Commerce senior vice president-international policy, in prepared testimony. But an updated one won't be a "panacea," he added. "The ECJ decision affirmed the need for individual Member State Data Protection Authorities to conduct independent investigations into all complaints," he said. The decision indicated the commission can't limit this through findings of “adequacy” in programs such as safe harbor, he said. "This means that companies may be faced with 28 different enforcement and compliance regimes, and potentially 40 if we include the German state-level data protection authorities."
Victoria Espinel, CEO of BSA | The Software Alliance, said Congress needs to look more broadly and for a longer term solution. She said the ECJ set a standard for "essential equivalence" but what that means will "require careful consideration and analysis."
Electronic Privacy Information Center President Marc Rotenberg said in an email that the ECJ decision is also a "reminder" that comprehensive U.S. privacy law reform is needed because Americans are facing "skyrocketing" identity theft, data breaches and financial fraud. He said the U.S. should do this by passing the Consumer Privacy Bill of Rights, modernizing the Privacy Act, establishing an independent data protection agency and ratifying the International Privacy Convention, actions that should also help with trans-Atlantic data flows. Joshua Meltzer, senior fellow at the Brookings Institution, in his testimony said the U.S.-EU economic relationship consists of "trade flows valued at over $1 trillion annually and stocks of investment in each economy close to $4 trillion." The hearing will begin at 10 a.m. in 2123 Rayburn.