Commission Implementing Decision (EU) 2016/2297

of 16 December 2016

amending Decisions 2001/497/EC and 2010/87/EU on standard contractual clauses for the transfer of personal data to third countries and to processors established in such countries, under Directive 95/46/EC of the European Parliament and of the Council

(notified under document C(2016) 8471)

(Text with EEA relevance)

THE EUROPEAN COMMISSION,

Having regard to the Treaty on the Functioning of the European Union,

Having regard to Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data1, and in particular Article 26(4) thereof,

After consulting the European Data Protection Supervisor,

Whereas:

(1)
In its judgment of 6 October 2015 in Case C-362/14 Maximillian Schrems v Data Protection Commissioner 2 the Court of Justice of the European Union found that, in adopting Article 3 of Decision 2000/520/EC3, the Commission exceeded the power which is conferred upon it in Article 25(6) of Directive 95/46/EC, read in the light of the Charter of Fundamental Rights of the European Union, and declared Article 3 of that Decision invalid.
(2)

Article 3(1) first subparagraph of Decision 2000/520/EC laid down restrictive conditions under which national supervisory authorities could decide to suspend data flows to a U.S. self-certified company, notwithstanding the Commission's adequacy finding.

(3)
In its Schrems judgment, the Court of Justice clarified that national supervisory authorities remain competent to oversee the transfer of personal data to a third country which has been the subject of a Commission adequacy decision and that the Commission has no competence to restrict their powers under Article 28 of Directive 95/46/EC. Pursuant to this Article, those authorities possess, in particular, investigative powers, such as the power to collect all the information necessary for the performance of their supervisory duties, effective powers of intervention, such as that of imposing a temporary or definitive ban on the processing of data, and the power to engage in legal proceedings4.
(4)

In the same judgment, the Court of Justice recalled that, in line with the second subparagraph of Article 25(6) of Directive 95/46/EC, Member States and their organs must take the measures necessary to comply with acts of the Union institutions, as the latter are in principle presumed to be lawful and accordingly produce legal effects until such time as they are withdrawn, annulled in an action for annulment or declared invalid following a reference for a preliminary ruling or a plea of illegality.

(5)

Mutatis mutandis, a Commission decision adopted pursuant to Article 26(4) of Directive 95/46/EC is binding on all organs of the Member States to which it is addressed, including their independent supervisory authorities, in so far as it has the effect of recognising that transfers taking place on the basis of standard contractual clauses set out therein offer sufficient safeguards as required by Article 26(2) of that Directive. This does not prevent a national supervisory authority from exercising its powers to oversee data flows, including the power to suspend or ban a transfer of personal data when it determines that the transfer is carried out in violation of EU or national data protection law, such as, for instance, when the data importer does not respect the standard contractual clauses.

(6)
Commission Decisions 2001/497/EC5 and 2010/87/EU6 contain a limitation on the powers of the national supervisory authorities that is comparable to Article 3(1) first subparagraph of Decision 2000/520/EC, which the Court of Justice considered invalid.
(7)

In the light of the Schrems judgment and pursuant to Article 266 of the Treaty, the provisions in those Decisions limiting the powers of the national supervisory authorities should therefore be replaced.

(8)

In order to facilitate the effective monitoring of the functioning of the decisions on standard contractual clauses currently in force, the Commission should be informed by Member States about relevant action undertaken by national supervisory authorities.

(9)

The Working Party on the Protection of Individuals with regard to the Processing of Personal Data established under Article 29 of Directive 95/46/EC has delivered an opinion, which has been taken into account in the preparation of this Decision.

(10)

The measures provided for in this Decision are in accordance with the opinion of the Committee established under Article 31(1) of Directive 95/46/EC.

(11)

Decisions 2001/497/EC and 2010/87/EU should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

Article 4 of Decision 2001/497/EC is replaced by the following:

‘Article 4

Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive 95/46/EC leading to the suspension or definitive ban of data flows to third countries in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall, without delay, inform the Commission, which will forward the information to the other Member States.’

Article 2

Article 4 of Decision 2010/87/EU is replaced by the following:

‘Article 4

Whenever the competent authorities in Member States exercise their powers pursuant to Article 28(3) of Directive 95/46/EC leading to the suspension or definitive ban of data flows to third countries in order to protect individuals with regard to the processing of their personal data, the Member State concerned shall, without delay, inform the Commission which will forward the information to the other Member States.’

Article 3

This Decision is addressed to the Member States.

Done at Brussels, 16 December 2016.

For the Commission

Věra Jourová

Member of the Commission