The working party is composed of representatives from the national data protection authorities (DPAs) of the EU Member States, the European Data Protection Supervisor and the European Commission, so its views have been awaited with interest given that the CJEU’s decision highlighted the importance of a DPA’s assessment of the adequacy of cross-border data transfers. The European Commission has also provided remarks on the CJEU’s judgment and issued an explanatory communication on the consequences of the ruling which is consistent with the working party’s statement.
The Article 29 working party statement, along with some further communications from national DPAs, offers some practical guidance on how companies can deal with data transfers out of the EU in the future. However, the window of opportunity to implement these measures ay be closing – so steps should be taken quickly. Read more