The EU-U.S. Privacy Shield (the "Shield") has been announced following political agreement being reached in early February regarding a revised approach to transferring data from the EU to the U.S. following the decision last year that the current Safe Harbour arrangement was inadequate. This followed the revelations of Edward Snowden and a case brought by Max Schrems against the Irish data protection authority about concerns he had about the transfer of his Facebook data from Ireland to the U.S.
The European Commission has now published its draft adequacy decision and the legal texts that will put the Shield in place as well as a Communication summarising the actions taken to restore trust in data transfers from the EU to U.S. This encompasses (i) the reform of EU Data protection rules, which apply to all companies providing services on the EU market, (ii) the EU-U.S. Umbrella Agreement ensuring high data protection standards for data transfers between the EU and U.S., and (iii) the Shield for commercial data exchange which contains obligations on U.S. companies who handle personal data.
The European Parliament approved the reformed General Data Protection Regulation. Given this is a Regulation (rather than a Directive), this legislation will apply automatically in every Member State (without need for additional domestic legislation) when it comes into force in 2018.
The European Commission made the Umbrella Agreement conditional on the U.S. Congress passing the U.S. Judicial Review Act (which it has done), President Obama has also signed it. This has significant consequences for U.S.-based businesses because it means that EU citizens will have the right to obtain judicial redress in the U.S. when their data is mishandled by U.S. authorities.
The Article 29 Working Party (the group of European data protection authorities which include the ICO (the Information Commissioner's Office – the UK's data protection authority) has provided its opinion on the Shield. It broadly welcomes the "significant improvements" made by the Shield and notes that many of the "shortcomings" of the previous Safe Harbour arrangements have been dealt with. However, amidst this praise, the Working Party also recommended that the European Commission should take steps to make sure that the Shield is "clear and understandable for both sides of the Atlantic" and redresses all of the concerns raised by the Article 29 Working Party (and not just most of them), such as the failure to specify certain key data protection principles and a lack of clarity as to the scope, limitations and guarantees in relation to the onwards transfer of personal data received from a Privacy Shield entity in the U.S. to third country recipients.
EU Member States will also have to give their approval to the new measures before formal adoption by the College of EU Commissioners. As such, there is still some way to go before there is certainty about how to transfer personal data between the EU and the U.S.
Whilst uncertainty remains, the ICO continues to recommend that organisations use standard contractual clauses and binding corporate rules to safeguard personal data transferred to the U.S. The ICO has also stated that it will not "expedite" complaints about Safe Harbour while the process to finalise its replacement remains ongoing and businesses await the outcome. Instead they will be guided by the risk posed to individuals and steps that can be reasonably expected of data controllers. Similar statements have been made by the data protection authorities in Estonia, the Netherlands and Sweden. However, the same message does not apply across the EU, with France's data protection authority stating they are investigating businesses using Safe Harbour and that whether or not enforcement powers will be used will be based on their national law.
Indeed, there remain concerns that the new Shield, and even the existing alternate ways to transfer data to the U.S., e.g., binding corporate rules and standard contractual clauses, will be challenged by civil liberties groups, concerned individuals and even data protection authorities as the fundamental concerns about the protection of data may ultimately remain. The new Shield may not even be the beginning of the end of the story.
Termination Payments to be subject to employer's national insurance contributions
In the Budget statement (the UK Government's proposals for tax and spend usually announced in March or April of each year) delivered by the Chancellor George Osborne on 16 March 2016, it was announced that from 2018 termination payments over £30,000 would start to be subject to employer's National Insurance contributions (under £30,000 is currently free of tax and will remain free of National Insurance contributions).
As noted in 2015 Year in Review, the response to the consultation on the simplification of the tax and national insurance treatment of termination payments are expected in 2016. The government has indicated in the Budget that from April 2018, the government will tighten the scope of the exemption to prevent manipulation. We therefore anticipate that there will be further and, potentially, more wide-ranging changes to termination payments made over the next few years.
Case Update
Barbulescu v Romania – When can an employer monitor an employee's social media usage?
The media was ablaze with articles early this year regarding this decision from the ECJ relating to the rights of employers to monitor their employees' online communications, including those via personal email and social media accounts. Many headlines gave the misleading impression that employers now had a carte blanche to review the private communications of employees. This is not the case. Rather, what the decision held is that, although the right to privacy is engaged by an employer's review of an employee's private communications, an employee's rights must be balanced against an employer's interests in ensuring that their employees are using work time to perform job related tasks.
The company monitored the employee's Yahoo Messenger account, accessing both his work account and a second personal account, and discovered that the employee had sent multiple messages regarding his health and sex life on company time.
In reaching its decision, the ECHR accepted that Mr. Barbulescu's rights to respect for his private and family life, his home, and his correspondence under Article 8 of the European Convention on Human Rights were engaged by his employer's conduct. However, the Article 8 right is not an absolute right. The ECHR focused on the fact that the company only accessed Mr. Barbulescu's private communications because it believed that they contained professional communications.
The decision makes very clear that any monitoring of employee's private and personal communications must be for a legitimate purpose and be a proportionate means of achieving that purpose. In this case, that meant that any monitoring of employee internet-use was focused on company resources, tied to a company policy, limited in scope, and proportionate.
For the full article on this decision, please click this link to Proskauer's International Labor and Employment Law blog.
Lock v British Gas – Should commission payments be included in holiday pay?
The latest chapter in the ongoing litigation around the Working Time Directive and whether commission payments should be included in holiday pay has been delivered by the EAT. The EAT has upheld the decision of the Employment Tribunal that domestic legislation could be interpreted in a way which conforms to the requirements of the Working Time Directive (the "WTR").
BACKGROUND
By way of reminder, Article 7 of the Directive provides that member states must ensure that workers have the right to at least four weeks' paid annual leave. However, it does not specify how this should be calculated. The Directive is implemented into UK law by the WTR, which provide workers with 5.6 weeks' annual leave (i.e., in the UK workers are entitled to more holiday than the minimum required by the Directive).
Workers are entitled to be paid at the rate of a week's pay for each week of leave, calculated in accordance with provisions contained in the Employment Rights Act 1996 ("ERA 1996"), which makes a distinction between employees with "normal working hours" and those with "no normal working hours". Generally, a worker with normal working hours will have a week's pay calculated by reference to those hours. A worker without normal working hours will have a week's pay based on average weekly remuneration (including certain overtime pay, bonuses and commission) over a 12-week period.
FACTS
Mr Lock was employed by British Gas Trading Limited as an internal energy sales consultant. He received a basic salary plus commission on the sales that he achieved. The commission made up approximately 60% of his remuneration. Mr Lock had normal working hours, whose remuneration did not vary with the amount of work done (rather it varied based on the sales he achieved). As a result, based on the WTR, his holiday pay was calculated on his basic salary only and did not incorporate his commission.
Mr Lock took statutory annual leave between 19 December 2011 and 3 January 2012. His holiday pay during this period was based on his basic salary only and did not incorporate any commission. Mr Lock brought a claim in the Employment Tribunal under the WTR for the commission he could have earned had he not been on holiday for the period he was on holiday.
PREVIOUS DECISIONS
The Employment Tribunal referred questions to the ECJ, including the following: does Article 7 of the Directive require holiday pay to be calculated in such a way as to reflect the loss of commission caused by being away on leave?
The ECJ held that, where a worker's remuneration includes contractual commission, determined with reference to sales achieved, the Directive precludes a national law that calculates statutory holiday pay based on basic salary alone and fails to account for commission. The ECJ stated that if commission payments are not taken into account, the worker will be placed at a financial disadvantage when taking statutory annual leave; no commission will be generated during the holiday period. In such circumstances, the worker might be deterred from exercising the right to annual leave, which is contrary to the purpose of the Directive.
The ECJ referred the case back to the original Employment Tribunal to determine how this ruling should be applied to UK law. The Employment Tribunal responded by adding wording to the WTR (adopting the approach taken in Bear Scotland v Fulton on the interpretation of domestic legislation) which means that under UK law employees with normal working hours who receive commission should have that commission included in the calculation of their holiday pay.
British Gas appealed the Employment Tribunal's decision arguing that the decision in Bear Scotland could be distinguished because it concerned non-guaranteed overtime (which was dealt with specifically by section 234 of ERA 1996). If that was wrong, then Bear Scotland was wrongly decided as there is a Court of Appeal decision, Bamsey v Albon Engineering & Manufacturing plc, which should have been followed. In any event, Bear Scotland is not binding on the EAT and should not be followed.
The Secretary of State intervened stating that the Employment Tribunal decisions should be upheld.
EAT DECISION
The EAT, upholding the decision of the Employment Tribunal, stated that it was not possible to distinguish Bear Scotland. Though the EAT is not bound by its own previous decisions, they are of persuasive authority and will accord respect to them and generally follow them. There are established exceptions to this principle but none of those apply to this case. The EAT did not view the decision in Bear Scotland as "manifestly wrong". In any case, if Bear Scotland was wrongly decided then it must be for the Court of Appeal to say so. In addition, the decision of Bamsey was no longer binding because it had been decided before the subsequent ECJ case law on the meaning of Article 7 and, therefore, was no longer based on good law.
COMMENT
-
A further tribunal case in this litigation was expected to deal with the basis on which holiday pay should be calculated, but it is understood that British Gas is seeking permission to appeal the EAT's decision to the Court of Appeal, so that decision is likely to be delayed.
There are several issues that remain unclear following this latest chapter relating to how to deal with claims relating to underpaid holiday and how to calculate holiday pay going forwards. Should employers look at the previous 12 weeks' pay, or look at overall remuneration over the course of a year? The Bear Scotland litigation is also still ongoing which looks at whether claims are time-barred if more than three months have elapsed between deductions. Until these matters are resolved, it remains an area of considerable uncertainty.
