EC issues guidelines on personal data transfers to the US

The European Commission has reiterated a deadline of three months to come to a new 'safe harbour' agreement with the US on the transfer of personal data between the territories. Following the EU court ruling in October scrapping the EC's previous designation of the US as a 'safe harbour' for data on EU residents, the European Commission has issued guidelines for businesses operating in the EU and sending protected data to the US. They may still legally do so under certain conditions, such as agreeing a contract or obtaining informed consent from the data subject or by agreeing rules on intra-company transfers with a national data protection regulator in the EU. The EC's guidelines provide detailed information on how to comply with these methods, including model contract clauses. 

However, the priority remains securing a new agreement on how the US must adapt its regulations for the protection of personal data and system for legal redress in order to meet the EU's standards. The so-called Article 29 Working Party, which unites the EU's national privacy regulators, said shortly after the EU Court ruling that a new agreement should be in place within three months, or its members would start enforcing the court ruling as part of their obligations under the EU Data Protection Directive. 

EC Vice-President Andrus Ansip, responsible for the Digital Single Market, said the Commission was committed to taking "swift action", as directed by the Article 29 group. "Today we provide clear guidelines and we commit to a clear timeframe to conclude current negotiations," he said. "The EU and the US are each other's most important trading partners. Data flows between our continents are essential for people and businesses." Justice Commissioner Vera Jourova added that EC representatives will be back in Washington next week to continue negotiations with the US.