In October last year we discussed the European Court of Justice’s judgment of 6 October 2015, ruling that the 15-year-old Safe Harbor framework for EU-US data transfers was invalid. Please click here to view this newsletter.

The European Commission and the United States have now reached political agreement on a new framework to replace Safe Harbor. The aim is to ensure that the privacy rights of European citizens are protected, while giving companies more certainty in how they can legally transfer data across the Atlantic for HR and business purposes.

Some important elements of the new framework, the “EU-US Privacy Shield”, are summarized below:

  • Companies transferring data from Europe will need to commit to stronger processing obligations, which will be monitored and enforceable by the US Department of Commerce and the US Federal Trade Commission. In addition, any company handling HR data from Europe must also commit to complying with decisions by European data protection authorities.
  • A key issue with the Safe Harbor framework was the access to personal data it allowed US authorities. The Privacy Shield agreement includes commitments from the US government that such access by public authorities will now be subject under law to clear conditions, limitations and oversight.
  • Europeans will have several redress possibilities for any misuse of data. Companies will have deadlines to reply to complaints; European data protection authorities can refer complaints to the US Department of Commerce and the US Federal Trade Commission; alternative dispute resolution will be free of charge; and a new Ombudsman will be created to handle complaints on possible access by national intelligence authorities.
  • There will be an annual joint review conducted by the European Commission and the US Department of Commerce, to include national intelligence experts from the US and the European data protection authorities.

The framework is still subject to scrutiny by EU and US legislators and there is no agreed timetable for implementation.