![](/img/client_headers/StinsonLeonard/MainHeader.jpg)
On February 2, 2016, representatives from the European Commission (press release) and the United States (press release) announced a preliminary agreement on the “Privacy Shield,” a framework that legitimizes transfers of personal data from the EU to the U.S.
Background
The Privacy Shield is the result of EU and U.S. negotiations that followed the invalidation of the EU-U.S. Safe Harbor1 under the Schrems case (Court of Justice of the European Union, Case C-362/14) in October 2015. After the Schrems case, EU Data Protection Authorities (DPAs) threatened to begin coordinated regulatory action against U.S. companies if a new “Safe Harbor” arrangement was not created before a January 31, 2016 deadline.
While the Privacy Shield was not announced until February 2, the DPAs stated that their deadline was met and requested that the text of the Privacy Shield be delivered for review by the end of February 2016. The DPAs will meet to form a recommendation on the Privacy Shield at a meeting of the Article 29 Working Party likely to be scheduled in late March 2016.
If the DPAs make a positive recommendation, the Privacy Shield may be adopted into EU law in the following months. If not, the EU and U.S. will likely continue their negotiations over the Privacy Shield, and the DPAs may renew their enforcement threats or begin actions against U.S. companies.
Once the Privacy Shield is adopted and implemented, U.S. companies may receive, store, use and share personal data of EU citizens according to the terms of the framework.
EU-U.S. Privacy Shield, Successor to the EU-U.S. Safe Harbor
The Privacy Shield is intended to legitimize transfers of personal data while satisfying the data protection issues raised by the Schrems case. The Schrems court cited concerns that the Safe Harbor did not provide protection or redress against surveillance by U.S. public authorities.
The Privacy Shield addresses these issues by: 1) obtaining written guarantees from the White House and the U.S. intelligence community with commitments to limit the scope and circumstances of surveillance; 2) requiring the U.S. to create a new “Ombudsperson” to address complaints of EU citizens regarding access of their information by U.S. public authorities; and 3) requiring the EU and U.S. to participate in an annual joint review of the Privacy Shield program, including review of national security access by U.S. public authorities.
The Privacy Shield announcement has been met with criticism, with questions raised about whether the written guarantees of the U.S. government provide meaningful protection for EU citizens, and whether the Privacy Shield can withstand judicial scrutiny. Given the business and political interests involved in protecting the flow of information between the EU and U.S., however, we expect that some form of the Privacy Shield will eventually be adopted into EU law.
Once adopted, the Privacy Shield will continue to face scrutiny in EU courts over surveillance protection and redress issues similar to those of the Schrems case.
Impact on U.S. Businesses
While the full text of the Privacy Shield framework has not been released, U.S. businesses should expect significant operational impact, including:
Note that, like the Safe Harbor, the Privacy Shield will not cover use of personal data by EU-based subsidiaries of U.S. companies. EU-based subsidiaries must comply with applicable law of their jurisdiction.
Mitigating Risks In The Meantime
The announcement of the Privacy Shield is a step toward resolving the uncertainty around EU data transfers following the Schrems invalidation of the Safe Harbor. While uncertainty continues in the interim, there are a couple steps U.S. companies can take to mitigate risks:
1) Evaluate alternative options to legitimize EU data transfers in the interim
EU DPAs have made it clear that alternative options remain valid in the interim. The best option will depend on a company’s situation and should be evaluated on a case-by-case basis.
The EU DPAs have stated that data transfers under Model Contract (or Standard Contractual Clause) agreements and Binding Corporate Rules (BCRs) will continue to remain lawful in the meantime. However, the DPAs plan on revisiting the validity of Model Contracts and BCRs in light of the Schrems case in their upcoming March meeting. Data transfers also continue to be lawful for more limited cases permitted by “derogations” of EU privacy law, including transfer with user consent or in performance of a contract.
2) Plan for compliance with increased obligations of the Privacy Shield
In the long run, the Privacy Shield will likely be the preferred option for U.S. companies. Like the old Safe Harbor, the Privacy Shield will legitimize EU data transfers while limiting U.S. companies’ exposure to EU regulatory action (as opposed to Model Contracts and BCRs, in which US companies agree to the jurisdiction of the EU DPAs).
However, the compliance demands for certifying to the Privacy Shield will be greater than with the Safe Harbor. U.S. companies will have increased obligations to document user consent, to track, update or delete user data held by the company, and to respond to EU citizen complaints. U.S. companies should begin planning early to allow time to build out the necessary IT capabilities and internal compliance processes. U.S. companies should also work with us and their insurance carriers to evaluate their cyber liability coverage and potential future needs.
Stay Tuned
As the proposed text of the Privacy Shield is released, we expect to learn more about the impact to U.S. companies. Stay tuned for further updates.
1EU privacy law, guided by the Data Protection Directive, does not permit transfer of personal data outside of the European Economic Area unless the receiving country ensures an “adequate” level of data protection. Because U.S. law does not meet this adequacy standard, the EU and U.S. developed a Safe Harbor framework under which U.S. companies could receive and use personal data of EU citizens by certifying their compliance with the Safe Harbor requirements and terms. The EU approved the Safe Harbor in July 2000.