DATE
 

SUMMARY OF THE MAIN OPERATIVE PROVISIONS OF A POSSIBLE DECISION ON THE BASIS OF ARTICLE 25.6 OF THE DATA PROTECTION DIRECTIVE CONCERNING THE US « SAFE HARBOR »
 

The present summary concerns a working text under discussion among the Commission's services.
 

Article 25.6 gives the Commission the power to take decisions, with the support of a qualified majority of the Member States in the Committee set up under Article 31 of the Directive, determining that the data protection provided by a particular third country is « adequate ». Such decisions are binding on the Member States.
 

A number of Article 25.6 decisions are under preparation. In all of them, the main operative provision states that specified arrangements in the third country in question provide adequate protection and makes reference to the texts of those arrangements. A further provision indicates, by derogation from the first, the circumstances in which Member State authorities may suspend data transfers and refers to the possibility that the Commission may reverse, suspend or reduce the scope of the decision if evidence accumulates that the third country, in its entirety or in part, is not in fact providing adequate protection. The draft decisions also provide for a review of the decision after three years and state that each decision applies from a date 90 days after its official publication.
 

The draft decision concerning the US refers only to the « safe harbor » arrangements and not to the US as a whole. The effect of the decision is therefore limited to those US organisations within the « safe harbor ». The « safe harbor » principles and the frequently asked questions to be issued by the Department of Commerce (collectively known as « the Principles ») are referred to in and will be annexed to the decision. ⁽¹⁾

The finding of « adequacy » is also made subject to two conditions referred to in the introduction of the « safe harbor » principles, namely the requirement that organizations must publicly declare their adherence to the Principles and the requirement that organizations qualifying for the « safe harbor » must be subject to the jurisdiction of the Federal Trade Commission or another government body with powers to take enforcement action in cases of deception or misrepresentation.⁽²⁾
 

There is also a provision indicating that the effects of the decision are assured for each organisation from the date on which it notifies to the Department of Commerce or its nominee its adherence to the « safe harbor » principles. (The details of the notification requirement are set out in FAQ 6.)
 

By derogation from the first provision, Member State authorities may suspend data flows in certain defined circumstances where their continuation would cause irreparable damage to the individuals concerned. These circumstances are when a US body has found that an organisation is not complying with the principles ; and when there is substantial evidence of non-compliance and reasons to believe that the relevant US enforcement body is not taking and will not take effective and timely action. Reasonable efforts must have been made to contact and hear the views of the body and organisation concerned. Member State measures are temporary and will end when compatibility with the rules has been assured.
 

The Member States are required to inform the Commission of evidence that any body responsible for the enforcement of the « safe harbor » principles is not effectively doing so. The Commission can if necessary take action, in accordance with Article 31, to reverse or limit the scope of the decision with respect to such enforcement body. It must first inform the Department of Commerce and the enforcement body or bodies concerned. ⁽³⁾
 

The Commission will evaluate the operation of the decision after three years ⁽⁴⁾ and draw any pertinent findings to the attention of the Article 31 Committee, including any evidence that the decision is being implemented in a discriminatory way. The Commission will submit draft measures to the Committee if necessary.

 ¹ The US side has requested that the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act of 1999 also be found to provide adequate protection for the organizations or activities falling under their provisions, but the Commission has reserved its position on this request, pending the examination of further information concerning these Acts.

 ² The US side has pointed out that the latter condition, as set out in the principles, applies only to particpants in the « safe harbor » relying wholly or partly on self-regulation.

 ³ The Department of Commerce has asked for the addition of wording which would ensure that the bodies concerned are able to exercise their rights of defence or « due process ».

⁴ The US side has a reserve on this time-frame, pending the results of the discussion about the length of the interim period.