MAY NATIONAL SUPERVISORY AUTHORITIES SUSPEND DATA TRANSFERS TO THE USA? ARE THERE OTHER RISKS?
Yes, The CJEU highlighted that a local data protection authority (DPA) may suspend the data transfer to the USA if it believes that personal data are not adequately protected. Close cooperation with the local authority may be a key factor if an authority decides to take immediate actions against a company already relying on the Safe Harbour.
Further, it cannot be excluded that Safe Harbour certified companies will face troubles from employees or works councils, or even be targeted by data protection activists who could try to stop further data exports with immediate effect by way of injunctive relief before national courts. It will be necessary to assess for each company individually its exposure to enforcement, and to take remedial steps as quickly as possible. (...)