The US/EU Safe Harbor framework has been invalidated, but a new agreement known as the EU/US Privacy Shield is in the process of being implemented. The new agreement introduces a series of limitations on the processing of European data that will have serious implications for U.S. companies handling European citizen data. Here is what this new agreement entails, what it will mean in practice, and what you should know going forward.
Since 2000, the data transfer agreement known as the Safe Harbor framework enabled the free transfer of data between Europe and the US. However, in October of 2015, the European Court of Justice struck down this agreement, arguing that it failed to safeguard the privacy of European citizens.
The challenge first came before an Irish court from EU citizen activist Max Schrems. Given revelations about mass surveillance conducted by the NSA, he claimed that Facebook had violated his privacy by storing and processing his data within the US.
The Irish court initially rejected Schrems' challenge based on the existence of the Safe Harbor framework, However, when the case next went to European Court of Justice, this court sided with Schrems, and subsequently ruled the Safe Harbor framework invalid.
US and EU authorities scrambled to craft a new framework that would enable data transfer between the US and Europe. In February of 2016, authorities from the EU and US agreed on the EU/US Privacy Shield framework and released the full text of the agreement. On February 29, 2016, the European Commission released the full draft of the "adequacy decision" on the new Privacy Shield agreement, indicating the Commission's approval of the draft. Despite progress on this new agreement, it still requires full ratification by the EU and further implementation by US authorities.
For thousands of tech companies and other businesses, it’s important to know what the EU/US Privacy Shield not only requires of them, but how governments will approach this agreement. There are four main tenets involved in the EU/US Privacy Shield agreement, which include the following:
There are also key differences between the old Safe Harbor agreement and the new agreement. The EU/US Privacy Shield will include stronger obligations for companies in the U.S. to protect European citizen data, and introduces increased oversight and monitoring by government agencies on both sides of the Atlantic.
For American companies, it’s important to understand how the new agreement will change the way they handle European data. Here is what is now required:
In addition, the U.S. Department of Commerce will verify that companies' privacy policies are in line with Privacy Shield stipulations. There will also be a list maintained of Privacy Shield members, and companies are subject to removal from this list.
At this point, a committee with representatives of the European Member States and the DPAs will provide their opinions before a final decision on the agreement is made. The EU Council and the European Parliament must still approve the agreement as well before it goes into effect. Challenges are still expected to the agreement, and may hinder its full implementation.