On 14 October 2015, Nicolas Schmit, minister responsible for relations with the European Parliament during the Luxembourg Presidency of the Council of the EU, spoke before the plenary of the assembly held in Brussels during a debate on the consequences of the 'Schrems' judgment of the Court of Justice of the EU (CJEU), and specifically on the transfer of data between the EU and the United States of America.
It should be noted that in the judgment of 6 October 2015 the Court invalidated the decision of the European Commission, made in 2000, relating to the Safe Harbour scheme, which had provided the framework for these data flows to the US. The reasons given by the judges for their decision were the fact that law and practice in the United States give the authorities across-the-board access to EU citizens' personal data, and the absence of effective legal protection for these citizens.
The consequences of the Court's judgment must be 'carefully analysed', said Nicolas Schmit, and this should be done within the Council too.
He noted that it would firstly be for the Commission to declare its intentions following the quashing of its decision, but he also said, at the opening of the discussion, that the issue concerned not just the Commission, but also the Council, Member States and citizens. Against this background, he acknowledged that the European Parliament had 'regularly drawn attention to shortcomings' that existed in terms of data flow under Safe Harbour. 'Even before the Snowden revelations, Parliament had reported concerns regarding the level of data protection and had requested the suspension of Safe Harbour until these defects had been remedied', he said.
Now that the Court has held that the Safe Harbour decision 'did not offer sufficient protection', Nicolas Schmit has called for 'careful analysis' of the consequences of its judgment, including in the Council. He explained to MEPs that, on this point, the Commission had presented a first evaluation of potential consequences during the meeting of the Justice and Home Affairs Council (JHA) held on 9 October 2015. 'The Court's judgment concerns a Commission decision', he continued, noting that it was therefore 'firstly for the Commission' to draw its conclusions.
The Minister further noted that while the judgment 'clarifies' the powers of the European supervisory authorities in the context of data transfer to third countries which is based on an adequacy finding, it would be important for the Commission to work 'in close cooperation' with these authorities to ensure that the judgment 'is interpreted and applied uniformly'.
Speaking to MEPs, Nicolas Schmit still considered that 'in the immediate future, citizens must be reassured of the fact that their data is protected'. 'In addition, companies need to be informed about the other legal possibilities for data transfer to the United States in light of the Court's judgment', he added.
The minister then said that, in the longer term, it would be for the Commission to decide what would succeed the Safe Harbour decision. He felt that the answer to this question should be reached through 'close dialogue' with the US authorities. Any response must also 'fully respect the Court's judgment' and its principles, according to Nicolas Schmit, but he emphasised that, in doing so, 'the Commission may take into account the importance for the economy of a regular and legal flow of data between the United States and the EU'.
According to the minister, while the Court of Justice pointed out that any EU instrument 'must guarantee a high level' of protection for personal data and must comply with the Charter, particularly in the context of data transfer to third countries, the Council and the European Parliament 'must continue their work on a new robust framework for data protection'. 'I consider that this judgment makes it even more urgent and necessary to finalise the reform before the end of the year', he said, concluding his speech.
We cannot have a 'business as usual' approach, said Věra Jourová.
Věra Jourová, European Commissioner for Justice, Consumers and Gender Equality, said that the Commission respected the Court's judgment and would comply with it, as must all stakeholders. 'Safe Harbour may no longer serve as the legal basis for the transatlantic transfer of data', she said, noting that 'business as usual' was not an option.
The commissioner also believed that short-term measures were necessary in this context, both to reassure citizens and to guide companies active in this field. In this regard, the Commission works closely with the European Data Protection Supervisor within the 'Article 29' group, which brings together national data protection supervisors, and she 'dialogues with businesses'. What is involved is defining clear guidelines to avoid fragmentation of the internal market, she said.
In terms of the US approach, the commissioner believed that the USA had to 'meet these requirements in their national legal system as well as in their practice'. Věra Jourová was optimistic in this regard following the first discussions with US officials. 'I am encouraged by the reform measures, such as the 'US Safe Freedom Act' and the draft law on legal remedies, currently under discussion'.
The commissioner also stressed that it was necessary to be very clear with the US partners, since Europeans needed guarantees regarding compliance with data protection rules when data is transferred to the USA. The objective is to obtain 'a robust commitment' from the US stating that data belonging to European citizens will be highly protected, at least to the level it is in the EU. She announced that she would step up discussions with the USA and that she would keep MEPs regularly informed of these exchanges.
The debate
In the debate that followed, the main political groups welcomed the Court's judgment and stressed the need to establish a new solid legislative framework on data protection. Many speakers highlighted the legal uncertainty that had arisen as a result of the judgment, which could adversely affect European businesses involved in the transatlantic transfer of data.
Emphasising the importance of protecting the privacy of European citizens, many MEPs called on the US Government to review its legislation on the protection of consumer privacy, and all called on the European Commission to act quickly.