Transatlantic Data Flows – European Parliament Motion for Resolution

Dear President Schulz,

We are writing to you in light of this week’s upcoming European Parliament Plenary activities surrounding transatlantic data flows. DIGITALEUROPE has long supported the ambitions of the EU institutions to restore trust in transatlantic data flows. As such, we have openly welcomed the publication of the draft EU-US Privacy Shield Adequacy Decision and strongly support its prompt adoption, which is essential to re-establishing a sustainable path for data transfers between the EU and the US.

However, we wish to express to you our deep concern over the language tabled by some Political Groups concerning the draft Adequacy Decision. We believe the adoption of a Motion for Resolution which includes language requesting for the European Commission to refrain from tabling a final Adequacy Decision and instead continue negotiations with the US Government while introducing a ‘sunset clause’ risks destabilising a delicate balance reached over 2 years of discussions between the EU and U.S. Such a destabilisation must be avoided.

As we have repeatedly stressed, European and US businesses of all sizes, particularly SMEs, are operating in a state of legal uncertainty following the invalidation of the Safe Harbour framework by the Court of Justice of the EU (CJEU). Once formally adopted, the EU-US Privacy Shield will not only provide entities with a new legal mechanism for transatlantic data transfers, but will also ease the doubt which has been cast by some regulators on the use of alternative transfer mechanisms such as Standard Contractual Clauses (SCCs) and Binding Corporate Rules (BCRs) in the EU-US context.

We therefore applaud the efforts of the European Commission to ensure that the new transfer tool is a solid mechanism that can withstand any test, including a possible Court challenge. We believe that the EU-US Privacy Shield achieves this goal and is an instrument that can reinstall much needed legal certainty.

The new framework is more demanding on companies, placing strict rules for the onward transfer of data by requiring a contract for data sharing with any third party. Companies will also be required to respond to user complaints within 45 days. Such requirements go beyond the requirements found in the new General Data Protection Regulation (GDPR). While such obligations will be difficult for companies, DIGITALEUROPE members are ready to meet the compliance challenge. They are ready to do this not only because it is necessary from a legal point of view, but because it is good for data protection and strong data protection is critical to rebuilding transatlantic trust. We also take note of the yearly review mechanism and suspension clause, as well as the reinforced and institutionalised collaboration between the EU and the US authorities. These will allow for any necessary adjustments in the future.

We believe that after months of uncertainty, it is time to restore trust and legal certainty for citizens and for the thousands of European and American businesses, both large and small, that depend on transatlantic data transfers. We cannot build a successful Digital Single Market without allowing companies to scale up and reach global markets.

DIGITALEUROPE thus urges the European Parliament to avoid adopting a Motion for Resolution which would risk negatively impacting the future tabling of a final EU-US Adequacy Decision and instead work to ensure a swift adoption of the Privacy Shield.

Sincerely,
John Higgins
Director General
DIGITALEUROPE