United States and European Union Attempt to Address Transfer of EU Citizens Data

In an effort to balance the needs of multinational companies and European Union citizen’s right to privacy the United States and European Union are working together to craft an EU-U.S. Privacy Shield to facilitate the transfer of the personal data of Europeans by multinational companies.^[1]  Prior to this agreement companies such as Facebook and Google used the Safe Harbor agreement, the predecessor to the new Privacy Shield,[2] to handle European citizens’ data, but that agreement was ultimately struck down by the European Court of Justice over concerns of U.S. spying in October 2015.^[3]

After the Safe Harbor agreement was struck down, companies were forced to continue such transfers, but found themselves out of compliance with European law and open to enforcement actions from member states of the European Union.[4]  In fact, Germany’s data protection authority took steps to begin to sanction any transfers of personal data which was based solely on the Safe Harbor.[5] The Privacy Shield, a response to this uncertainty, would provide a regulatory mechanism to legally handle European citizen’s data.  This agreement has been crafted between the European Commission and Obama administration and the terms of the agreement of the agreement have been recently been announced.^[6]

The agreement identifies Privacy Principles that each organization that registers with the Shield to do business must abide by. The Privacy Principles provide a framework for the transfer of European Union citizen’s data and requires:^[7]

1. Notice – Organizations transitioning to the Privacy Shield must declare compliance with the Privacy Shield and must revise their privacy policies to notify individuals of new details;
2. Choice – Participating organizations must implement mechanisms that provide data subjects with varying levels of choice regarding the use and disclosures of their data;
3. Accountability for Transfers To Third Parties Such as Vendors – The permissible conditions for onward transfers to any third parties have been tightened and the Shield holds participating organizations responsible for the conduct of third parties that the data is forwarded to. This principle also effectively requires mechanism for oversight of these third parties by requiring organizations to: i) take steps to ensure the processor handles the data in accordance with the Privacy Principles; and ii) remediate any unauthorized processing by the processor;
4. Security – Participating organizations must demonstrate “reasonable and appropriate” data security measures;
5. Data Integrity and Purpose Limitation – Data must be relevant and reliable for its intended purpose and accurate, complete, and current. An organization cannot process personal data in a way incompatible with why it was originally collected without consent;
6. Access – Data subjects must be provided access to the personal data processed about them, and must be afforded an ability to correct, amend, or delete their personal data;
7. Recourse Enforcement and Liability – The Privacy Shield has required robust mechanisms to ensure compliance with these principles. These include, but are not limited to:

1. Independent dispute resolution bodies must be appointed to resolve individual complaints, provide recourse, and sanction noncompliant organizations.
2. Organizations must self-certify compliance with these privacy principles and they must also meet annual verification requirements through self-assessment outside compliance reviews.
3. The U.S. government has provided written assurances that any access for national security purposes will be subject to limitations, safeguards and oversight mechanisms, preventing generalized access to personal data.
4. Complaints have to be resolved by companies within 45 days.

The Privacy Shield was reviewed by the Article 29 Working Party, an advisory group that acts independently to evaluate the protection of individuals with regard to the processing of personal data and the free movement of such data.[8]   This review yielded mixed results in what is considered to be a barometer of the deals viability in court.^[9]  The review indicated that while the Privacy Shield is a substantial improvement over prior agreements, the Privacy Shield still allows the U.S. too much leeway to carry out surveillance.^[10]  It is unclear if the Privacy Shield will continue as drafted or will face further revisions in light of the Article 29 Working Party’s reviews. There is concern that the more than one half of a trillion dollars that depends on transatlantic data flows will be at risk if an agreement is not made.^[11]

^[1]  https://www.commerce.gov/sites/commerce.gov/files/media/files/2016/eu_us_privacy_shield_full_text.pdf.pdf

[2] https://www.fas.org/sgp/crs/misc/R44257.pdf

^[3]https://www.washingtonpost.com/world/national-security/eu-court-strikes-down-safe-harbor-data-transfer-deal-over-privacy-concerns/2015/10/06/2da2d9f6-6c2a-11e5-b31c-d80d62b53e28_story.html

[4] Id.; https://ico.org.uk/media/1560653/data-transfers-to-the-us-and-safe-harbor-interim-guidance.pdf.

[5] http://www.ibtimes.com/safe-harbor-20-us-eu-data-protection-talks-are-coming-down-wire-2286170

^[6] https://www.commerce.gov/sites/commerce.gov/files/media/files/2016/eu_us_privacy_shield_full_text.pdf.pdf

^[7] Id.

[8] http://ec.europa.eu/justice/data-protection/article-29/index_en.htm

^[9]http://ec.europa.eu/justice/data-protection/article-29/documentation/opinion-recommendation/files/2016/wp238_en.pdf; https://secure.edps.europa.eu/EDPSWEB/edps/site/mySite/Art29

^[10] https://secure.edps.europa.eu/EDPSWEB/edps/site/mySite/Art29

^[11]http://www.nytimes.com/2016/02/04/technology/european-privacy-regulators-want-more-details-on-us-safe-harbor-data-deal.html?_r=0