(Telecompaper) The EU's data protection regulators have given the EU and US three months to negotiate a new 'safe harbour' agreement on the transfer of personal data to the US, or the regulators may start pursuing enforcement action against companies. The existing designation for the US as a 'safe' destination for data on EU residents was overturned in a ruling by the EU Court of Justice. It found the US could not be considered safe given the evidence of wide-ranging data collection by security services in the US and the lack of legal recourse for EU citizens in the US if their data is misused. The Article 29 Working Party, which unites the EU's data protection regulators, said in a statement that it was "absolutely essential" for EU members to take a common position on implementation of the court ruling. They called for the EU to open talks with the US in order to find ways for data to be transferred between the countries while still respecting fundamental rights of the data subjects. Until a new agreement can be reached, companies may continue to use standard contractual clauses and binding corporate rules to provide protection for subjects of data collection and transfer. The Article 29 group will start a review of these and other tools to assess the impact of the ECJ ruling. If no apporpriate solution is found with the US by the end of January 2016 and depending on the results of the regulatory review, the EU data protection authorities said they are "committed to take all necessary and appropriate actions, which may include coordinated enforcement actions".