Although no one really knows what will happen next, we thought it might be useful to outline some strategies that companies are currently using to mitigate risk in light of the European Union’s recent decision to strike down the Safe Harbor provision allowing data transfers (user web histories and other personal information) between Europe and the United States. The ruling affects any company with international users that transfers advertising and other personal information between Europe and the United States. Google and Facebook are major examples of the type of company affected. Since it’s anyone’s guess when there might be a new safe harbor agreement between the U.S. and Europe, and the current new restrictions will go into effect in January, it is wise to look into some ways of coping with tougher oversight of data transfers.
1. Transfer data of European users to European cloud computing companies.
According to a recent article in the New York Times “Some American cloud computing companies . . . have contacted European rivals in efforts to reduce their legal risks when providing online services within the 28-member bloc. That could involve American tech companies transferring legal responsibility — and data — of their European users to local cloud computing competitors, which already comply with the region’s tough privacy rules."
2. If your company is large enough (and rich enough), establish data centers in Europe.
This is an obvious choice for multinationals that may already have data centers in Europe or ones that have the resources to establish such centers.
3. Check your terms of service.
Your company may have asked customers to agree to data transfers between Europe and the United States when they initiated their relationship with you. If so, you do not need to do anything right now.
Although hope is not a strategy, there may be a new agreement on data transfers on the way. According to an article in FT, “A senior US official said both sides were “very close” to reaching a “very strong agreement” that would satisfy criticisms of safe harbour. He said the EU court ruling would not affect the essence of the deal but that it hastened the need for its conclusion.”