Business group Ibec has warned that the recent ruling on the transfer of data from Europe to the United States that invalidates the Privacy Shield agreement, will have a "significant negative impact on the Irish economy".
In a letter sent to Tánaiste and Minister for Business, Enterprise and Innovation Leo Varadkar, last week, Ibec chief executive Danny McCoy said the State must lead European efforts to negotiate an effective substitute with the US to Privacy Shield. He also urged the Government to move to quickly identify interim solutions that will allow companies to continue to transfer data until an effective substitute is in place.
Mr McCoy said the uncertainty arising from the Schrems II ruling by the EU’s top court impacted businesses across the State and would add to concerns for companies already dealing with Brexit.
“This is not just an issue for the digital sector,” he said. “Data is helping to boost competitiveness and deliver services across a range of industries from manufacturing to healthcare.”
Mr McCoy’s comments come following a ruling by the Court of Justice of the European Union (ECJ) in July that declared Privacy Shield invalid as it fails to guarantee the fundamental data protection and privacy rights of EU citizens. The Schrems II ruling followed an earlier judgment in 2015 that invalidated its predecessor, Safe Harbour, on similar grounds.
Contracts
Both cases were taken on foot of complaints by Austrian privacy activist Max Schrems to Irish data protection regulators. The ruling has also raised questions about the validity of standard contractual clauses – template agreements used to create data transfer contracts – as an alternative mechanism.
Following the Schrems II ruling, the Data Protection Commissioner last month informed Facebook Ireland that personal data from the social media giant's 400 million European users should not be sent to its US parent. Facebook is challenging the DPC's decision.
Mr McCoy warned of the legal risk for companies transferring data and a need to act to eliminate uncertainty.
“Data flows are as vital to our digital-driven economy as electricity. Being able to effectively comply with the ruling is of critical importance to Ibec members. However, the ruling’s legal, organisational, and technological implications, and a lack of sufficient guidance make it difficult, at present, for companies to have absolute confidence that efforts to comply will be sufficient,” said Mr McCoy.
In his letter, he urged the Government to acknowledge the importance of standard contractual clauses remaining valid and to work to secure harmonised guidelines on supplementary measures from the European Data Protection Board.
Mr McCoy also called for the formation of a digital and data forum to bring together all those affected by the issues raised by the recent ruling, to engage on possible solutions.
Facebook’s challenge to the DPC has been brought on several grounds, including an alleged failure by the commission to conduct an inquiry before it reached its decision. The matter is due back before the court in November.
