On 12 July 2016, the European Commission formally approved a trans-Atlantic data transfer legal framework, the Privacy Shield. The Privacy Shield replaces the old Safe Harbour regime which was overturned by the European Court of Justice (ECJ) on 6 October 2015 amid concerns over mass surveillance by the US. The Privacy Shield addresses and protects data transfer from Europe to the US for both individuals and businesses by ensuring that EU consumer data is afforded the same level of protection when it reaches US company servers, and by providing clarity for trans-Atlantic businesses. The regime is based on the following key principles: i) imposition of strong obligations on companies and robust enforcement; ii) creation of clear safeguards and transparency obligations; iii) introduction of several redress possibilities for individuals; and iv) introduction of reviewing mechanisms to monitor the functioning of the regime.
The approval of the new regime will be especially welcomed by tech companies in the US because it provides much needed clarity, following the demise of Safe Harbour, as to which safeguards they should implement to ensure that consumer data is handled legally. Once companies have implemented the stricter principles to become Privacy Shield-compliant, they will be able to sign up to the regime and be certified from 1 August 2016. Certified US companies can then rely on the Privacy Shield to effectuate transfers of personal data from the EU, and EU companies will be able to transfer data to certified US companies. However, there are critics who believe that in the absence of regulatory backing (irrespective of any adequacy decision by the European Commission), the fate of the Privacy Shield will be much the same as its predecessor and, as such, unlikely to provide businesses and consumers with real comfort that the regime is robust enough to withstand legal challenges before the ECJ. Watch this space.
For more details on the key principles of the Privacy Shield regime, please see the European Commission Press Release on http://europa.eu/rapid/press-release_IP-16-2461_en.htm.