March.02.2016
On 29 February 2016 the European Commission issued the legal texts of the EU-U.S Privacy Shield which aims to replace the defunct EU-U.S Safe Harbor Framework as a legitimate mechanism for transferring personal data from the EU to the U.S.
In contrast to its predecessor, the Privacy Shield contains commitments from US government in relation to controls on access to personal data by public authorities. This is an aspect of the new scheme which aims to address the jurisprudence of the Court of Justice of the European Union and criticisms of the previous Safe Harbor Framework.
The new arrangements will include the following elements:
While the Commission is encouraging companies to begin preparation for joining the new framework, this may be an early call. Further work and analysis will be required for companies to decide if the new Privacy Shield is a suitable data transfer method for them when compared to alternative mechanisms (such as the EU Standard Contractual Clauses).
While similar to the previous Safe Harbor Framework, the Privacy Shield requires a more comprehensive compliance program to implement and maintain. It also creates significant consequences for failure to adhere to its principles. Joining the Privacy Shield should therefore not be undertaken lightly.
In addition, the published text has no legal effect until further approval is gained from relevant EU institutions. Reliance on the Privacy Shield is also further complicated by the possibility that privacy activists may launch court action against the scheme which may in turn undermine businesses confidence in the proposals.
In terms of timing, the Privacy Shield text will now be put before representatives of the Member States and the Article 29 Working Party (the representative body of data protection authorities in the EU) before being finalised.. The U.S. is now expected to begin preparation for the framework, monitoring mechanisms and the new Ombudsperson. No definitive timeframe has been provided for the Privacy Shield to come into force, however, expectation is that it will be available for use in the next few months.