EU-US Privacy Shield

Earlier this week, the European Commission announced its agreement with the United States on a new framework for transatlantic data flows. Details of the new agreement, officially known as the EU-US Privacy Shield (unofficially, Safe Harbor 2.0) are still sparse, but the following is a brief summary of what we know at the moment:

Brief Details.

The new agreement, in theory, replaces the old Safe Harbor framework, which was invalidated last year following a decision from the European Court of Justice. The text hasn’t yet been formally released, and limited details have been revealed, but the new agreement calls for companies processing personal information in the US to agree to “robust obligations” to protect EU personal information, and written guarantees from the United States that its national security agencies will not have unfettered access to data transferred from the EU to the US. It also allows Europeans who feel that their information has been the subject of surveillance by US intelligence agencies to complain to a new ombudsman, with a further right of redress through arbitration if complaints are not adequately addressed. Other obligations for US companies processing EU employment data include the obligation to comply with decisions by the European data protection authorities.

Next Steps.

As discussed above, full details of the agreement have not yet been published. Europe’s national data protection agencies have demanded that more details be provided regarding whether the new agreement will adequately protection individuals’ personal information. This demand is significant, as it indicates that the regulators are unwilling to accept the word of the European Commission on this issue. Note also that the agreement can’t take effect until all 28 EU countries have signed it.

A deadline of February 29 has been set for receipt of the further information detailed above. After that date, EU companies transferring personal information to the US under the old Safe Harbor scheme could be subject to investigation and fines. Until the new agreement has been formally accepted and more information is provided to enable businesses to make informed choices, the use of model contract clauses will, for most companies, remain the transfer mechanism of choice.