On 6 October 2015 the Court of Justice of the European Union issued a landmark judgment  in the Maximilian Schrems v Data Protection Commissioner case (C-362- 14), in which it annulled the European Commission’s Decision of 26 July 2000 on the adequacy of the protection provided by the safe harbour privacy principles.

In reply to the above on 16 October 2015 the Article 29 Data Protection Working Party issued a statement concerning the indicated judgment. Having regard to the fact that the Art. 29 Working Party is currently the most important forum of cooperation between data protection authorities of EU Member States and considering an undoubtedly international character of the discussed issue, Member States decided to express a joint statement on the consequences of the issued judgment for the principles of data transfer to the US. In connection with this, the Working Partycalled on the Member States and the European institutions to open discussions with US authorities in order to find political, legal and technical solutions enabling data transfers to the territory of the United States that respect fundamental rights. The works in this regards are currently being conducted. The Working Party stressed as well that despite of the fact that it is impossible to use Safe Harbour in case of personal data transfer to the US, all other prerequisites legitimising personal data transfer are still valid, so Standard Contractual Clauses and Binding Corporate Rules can still be used. In the Polish legal order, the catalogue of such prerequisites is foreseen in Art. 47-48  of the Act of 29 August 1997 on the Protection of Personal Data. In case where Member States do not develop another joint solution by that time, Member States’ DPAs, including the Inspector General for Personal Data Protection, will commence on their own initiative enforcement of legal provisions in this regard as of 1 February 2016.

In GIODO’s view the timeframe indicated by the Art. 29 Working party in the mentioned statement does not mean that entrepreneurs are not obliged to immediately point at another legal ground legitimising transfer to third countries. The indicated timeframe shall be treated as a deadline until which Member States’ DPAs, as a rule, shall not initiate  activities aiming at enforcement of the mentioned judgment.  

However, the Inspector General for Personal Data Protection will react to any complaints received in this regard, even those submitted before 1 February 2016. For it needs to be emphasised that formally due to legal validity of CJEU’s judgments and to the fact that the Court did not decide to postpone the effects of the judgment in the Schrems case, at the time of its issuance data transfer to the US based on the European Commission’s decision becomes illegal.