Worldwide: The EU-US ‘Privacy Shield' Heralds New Era Of Trans-Atlantic Data Transfers

Last Updated: 29 December 2016
Article by Rebecca McNulty

A new set of regulations now governs the transfer of data between the US and Europe, in the wake of changes that followed an EU court case resulting from the 2013 Edward Snowden data leak case. Here, Rebecca McNulty, a senior associate with the Bedell Cristin law firm in Jersey, considers the new "EU-US Privacy Shield", and whether, as some say, it might one day be successfully challenged, amid calls for something still more robust...

Year on year, we generate more data, use more electronic devices, and take advantage of the latest technological developments to transfer still more data.

As a result, the scope and significance of transatlantic data transfers have increased, but so too have the risks. And getting it wrong can be costly, both financially as well as reputationally.

Handling personal data appropriately and carefully, therefore, should be high on the list of any company's priorities.

Global offshore finance centres such as Jersey and Guernsey, although not part of the European Union, nevertheless have to monitor developments within the EU, including in the rapidly evolving data protection sphere, to ensure they continue to meet international standards. And in this area, one of the latest developments to have emerged is the so-called "EU-US Privacy Shield".

The Channel Islands and the EU
To best understand this privacy shield, we need to go back and look at the existing legal relationship between the Channel Islands and the EU. This relationship is enshrined in what is known as Protocol 3 of the UK's Accession Treaty 1972, under which Jersey and Guernsey are part of the EU's customs union.

What this means is that the two Channel Islands are essentially regarded as being within the EU's Single Market for the purpose of trading in goods, but are regarded as "third countries" in all other respects.

Both jurisdictions benefit from a close relationship with the EU, and as a result, they voluntarily implement appropriate EU legislation, or, where applicable, apply the international standards on which such legislation is based.

Laws are also in place representing the voluntary implementation of the European Data Protective Directive, which concerns the protection of the individual in respect of processing personal data, and the free movement of such data.

This European Data Protective Directive places restrictions on the transfer of data outside the European Economic Area (EEA), so that data may only be transferred to countries outside the EEA that can ensure an adequate level of protection for any personal data transferred. (There is no reason for this to change as a consequence of Brexit, by the way.)

As major international finance centres, both Jersey and Guernsey naturally have to meet the international "gold standard" in data protection. And in fact, they have been included among a number of non-EEA countries that the European Commission has certified as providing "adequate protection" for such data.

This ensures that personal data can flow to and from EU countries to third countries like Jersey and Guernsey, without further safeguards being necessary.

Safe Harbor not 'safe'
The US, of course, isn't part of the EU, and has its own set of data transfer rules.

It used to operate under what was known as the so-called "Safe Harbor arrangement". That arrangement was declared invalid and non-compliant in October 2015 by the European Court of Justice, in a case known as "Schrems v Data Protection Commissioner", which was sparked by the Edward Snowden revelations in 2013, of the US government's global surveillance programmes.

The decision in Schrems left the world of transatlantic personal data transfers, at least temporarily, in a state of legal limbo.

One of the biggest issues with the Safe Harbor arrangement was the US government's mass surveillance of data, revealed by Edward Snowden, which could be accessed and further processed by US authorities in a way that the EU regarded as incompatible with the grounds under which the data was originally collected, and the purpose for which it was transferred to the US.

The Privacy Shield
This brings us to the "Privacy Shield". This is what has effectively replaced the Safe Harbor arrangement in overseeing the way data transfers are carried out across the Atlantic, between the US and EU member states, as well as non-EU jurisdictions like Jersey and Guernsey that are able to participate.

It was approved in July, and aims to reflect the requirements of the European Court of Justice in the Schrems case.

It is the result of a collaborative effort by the European Commission, European Data Protection Authorities, European Parliament, the EU member states themselves, and their US counterparts.

In the words of the US Department of Commerce, it was designed by that US government department and the European Commission to "provide companies on both sides of the Atlantic with a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States in support of transatlantic commerce".

According to the US Department of Commerce, the Shield:

  • provides a set of robust and enforceable protections for the personal data of EU individuals in the US;
  • provides transparency regarding how participating companies use personal data, strong US government oversight, and increased cooperation with EU data protection authorities;
  • offers EU individuals access to multiple avenues to address any concerns regarding participants' compliance with the framework, including free dispute resolution;
  • ensures a continuing level of protection when personal data is collected under the Shield and transferred to third parties; and
  • makes it easier for EU individuals to understand and exercise their rights in the US.

Joining the Shield is voluntary, and requires that a US company self-certify to the US Department of Commerce that it commits to complying with the Shield's requirements.

The self-certification process will involve a participating company confirming the company's eligibility to participate in the Shield; developing a Shield compliant privacy policy statement; identifying the company's independent recourse mechanism; ensuring a verification mechanism is in place to confirm compliance with the Shield; designating a contact within the company regarding the Shield and finally, reviewing the information required to self-certify and submitting it.

Long term solution or short term fix?
Concerns have been expressed over the self-certification process involved in signing up to the Shield. Specifically, questions are being asked about whether the Shield offers a long term solution to the gap left by the departure of the Safe Harbor arrangement, or whether it represents nothing more than a short-term fix.

The Safe Harbor arrangement also involved a self-certification process, critics note, and ultimately that arrangement proved not to be so "safe" after all, in terms of personal data protection, both as a result of commercial parties' own failures as well as the US authorities' practice of taking advantage of the data it was able to access.

With no compulsory independent testing, no sampling and no obvious compliance requirements, there are, these critics maintain, justifiable concerns over whether the Shield will provide adequate protection.

Current thinking, therefore, suggests that the Shield could be subject to challenge at some point, perhaps in the not too distant future.

The US factor
Meantime – and possibly adding to the concerns surrounding the Shield – is the fact that this is an arrangement with the US, a country whose authorities have in the past demonstrated an apparent indifference to the data protection rights of individuals, and a country that has just witnessed the biggest upset in modern political history, with Donald Trump overcoming all the odds to become the 45th US President.

Trump, of course, as some of those concerned about trans-Atlantic data protection standards point out, is someone who, during the campaign, invited the Russians to hack Hilary Clinton's emails, and whose own company, Trump International Golf Course Scotland, recently found itself in trouble for not being registered under the Data Protection Law in England.

Regulation and protection
The question, then, is this: Does the Shield protect financial intermediaries, service providers and advisory firms in jurisdictions such as Jersey and Guernsey in their dealings with US commercial entities?

As things stand presently, the answer to that might be yes, in relation to data export and adequacy of protection – but the protection of personal data relies on companies exercising reasonable care in the way they store individual's data, and protecting that data from both internal and external threats such as hackers, cyber-criminal organisations and state sponsored attacks.

What's more, personal data is reported to be a trending target of cyber-attacks. The size of the company holding the data does not appear to matter. Personal data is valuable, and with the increasing digitalisation of personal data, protecting that data has become a critical task for any business.

When considering the transfer of data, businesses therefore need to pause for a moment and consider carefully whether a particular service provider offers the necessary personal data safeguards.

With current thinking being that the Shield will likely be challenged at some point, you should consider carefully where, for example, you are transferring your employees' personal data to. What would happen if the Shield were to be successfully challenged, and a US provider is left holding your employees' personal data without appropriate safeguards in place?

Apparently the Russian intelligent service uses manual typewriters, in an effort to avoid the intelligence it holds being compromised unnecessarily.

We don't see any need to revert to manual typewriters at the moment, but businesses do need to exercise reasonable care when dealing with personal data, and particularly when considering transatlantic data transfers.

Company executives should consider reviewing their firm's data management policy, and ensuring that when anyone transfers data, they ensure that a comprehensive contract dealing with the transfer is put in place.

They should also ensure that there is some provision for the reporting of any security breach, and making sure that they have policies and procedures in place to deal with any such breach, or potential breach.

The GDPR
The EU-US Privacy Shield is, as it happens, just one of a number of data issues that firms have to understand.

The new General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), which is due to come into force on 25 May 2018, will replace the current EU Directive that governs data transfers.

The GDPR is a regulation that the European Commission is evidently looking to rely on to strengthen data protection for individuals within the EU, and also to deal with the export of personal data outside the EU.

The Office of the Information Commissioner has warned that changes to the European privacy and data protection legislation will have a "significant impact on the Channel Islands", and that reforming domestic laws and practices needs to be prioritised, to avoid serious detrimental effect on the financial and digital sectors which rely on cross border data transfers.

We will wait, therefore, to see how exactly the Shield will impact the financial services industries in the Channel Islands, and await the coming into force of the GDPR.

And at the same time, we are bearing in mind the saying, famously uttered in one of the Godfather films and possibly worth bearing in mind with respect to trans-Atlantic data transfer matters: "Keep your friends close, keep your enemies closer".

With Donald Trump poised to take up his seat as president of the US in less than two months' time, you might wish to consider keeping your enemies close, and your data, for now at least, where possible, even closer.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

To print this article, all you need is to be registered on Mondaq.com.

Click to Login as an existing user or Register so you can print this article.

Authors
Similar Articles
Relevancy Powered by MondaqAI
Callington Chambers
Bedell Cristin
 
In association with
Related Topics
 
Similar Articles
Relevancy Powered by MondaqAI
Callington Chambers
Bedell Cristin
Related Articles
 
Up-coming Events Search
Tools
Print
Font Size:
Translation
Channels
Mondaq on Twitter
 
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).
 
Email Address
Company Name
Password
Confirm Password
Position
Mondaq Topics -- Select your Interests
 Accounting
 Anti-trust
 Commercial
 Compliance
 Consumer
 Criminal
 Employment
 Energy
 Environment
 Family
 Finance
 Government
 Healthcare
 Immigration
 Insolvency
 Insurance
 International
 IP
 Law Performance
 Law Practice
 Litigation
 Media & IT
 Privacy
 Real Estate
 Strategy
 Tax
 Technology
 Transport
 Wealth Mgt
Regions
Africa
Asia
Asia Pacific
Australasia
Canada
Caribbean
Europe
European Union
Latin America
Middle East
U.K.
United States
Worldwide Updates
Registration (you must scroll down to set your data preferences)

Mondaq Ltd requires you to register and provide information that personally identifies you, including your content preferences, for three primary purposes (full details of Mondaq’s use of your personal data can be found in our Privacy and Cookies Notice):

  • To allow you to personalize the Mondaq websites you are visiting to show content ("Content") relevant to your interests.
  • To enable features such as password reminder, news alerts, email a colleague, and linking from Mondaq (and its affiliate sites) to your website.
  • To produce demographic feedback for our content providers ("Contributors") who contribute Content for free for your use.

Mondaq hopes that our registered users will support us in maintaining our free to view business model by consenting to our use of your personal data as described below.

Mondaq has a "free to view" business model. Our services are paid for by Contributors in exchange for Mondaq providing them with access to information about who accesses their content. Once personal data is transferred to our Contributors they become a data controller of this personal data. They use it to measure the response that their articles are receiving, as a form of market research. They may also use it to provide Mondaq users with information about their products and services.

Details of each Contributor to which your personal data will be transferred is clearly stated within the Content that you access. For full details of how this Contributor will use your personal data, you should review the Contributor’s own Privacy Notice.

Please indicate your preference below:

Yes, I am happy to support Mondaq in maintaining its free to view business model by agreeing to allow Mondaq to share my personal data with Contributors whose Content I access
No, I do not want Mondaq to share my personal data with Contributors

Also please let us know whether you are happy to receive communications promoting products and services offered by Mondaq:

Yes, I am happy to received promotional communications from Mondaq
No, please do not send me promotional communications from Mondaq
Terms & Conditions

Mondaq.com (the Website) is owned and managed by Mondaq Ltd (Mondaq). Mondaq grants you a non-exclusive, revocable licence to access the Website and associated services, such as the Mondaq News Alerts (Services), subject to and in consideration of your compliance with the following terms and conditions of use (Terms). Your use of the Website and/or Services constitutes your agreement to the Terms. Mondaq may terminate your use of the Website and Services if you are in breach of these Terms or if Mondaq decides to terminate the licence granted hereunder for any reason whatsoever.

Use of www.mondaq.com

To Use Mondaq.com you must be: eighteen (18) years old or over; legally capable of entering into binding contracts; and not in any way prohibited by the applicable law to enter into these Terms in the jurisdiction which you are currently located.

You may use the Website as an unregistered user, however, you are required to register as a user if you wish to read the full text of the Content or to receive the Services.

You may not modify, publish, transmit, transfer or sell, reproduce, create derivative works from, distribute, perform, link, display, or in any way exploit any of the Content, in whole or in part, except as expressly permitted in these Terms or with the prior written consent of Mondaq. You may not use electronic or other means to extract details or information from the Content. Nor shall you extract information about users or Contributors in order to offer them any services or products.

In your use of the Website and/or Services you shall: comply with all applicable laws, regulations, directives and legislations which apply to your Use of the Website and/or Services in whatever country you are physically located including without limitation any and all consumer law, export control laws and regulations; provide to us true, correct and accurate information and promptly inform us in the event that any information that you have provided to us changes or becomes inaccurate; notify Mondaq immediately of any circumstances where you have reason to believe that any Intellectual Property Rights or any other rights of any third party may have been infringed; co-operate with reasonable security or other checks or requests for information made by Mondaq from time to time; and at all times be fully liable for the breach of any of these Terms by a third party using your login details to access the Website and/or Services

however, you shall not: do anything likely to impair, interfere with or damage or cause harm or distress to any persons, or the network; do anything that will infringe any Intellectual Property Rights or other rights of Mondaq or any third party; or use the Website, Services and/or Content otherwise than in accordance with these Terms; use any trade marks or service marks of Mondaq or the Contributors, or do anything which may be seen to take unfair advantage of the reputation and goodwill of Mondaq or the Contributors, or the Website, Services and/or Content.

Mondaq reserves the right, in its sole discretion, to take any action that it deems necessary and appropriate in the event it considers that there is a breach or threatened breach of the Terms.

Mondaq’s Rights and Obligations

Unless otherwise expressly set out to the contrary, nothing in these Terms shall serve to transfer from Mondaq to you, any Intellectual Property Rights owned by and/or licensed to Mondaq and all rights, title and interest in and to such Intellectual Property Rights will remain exclusively with Mondaq and/or its licensors.

Mondaq shall use its reasonable endeavours to make the Website and Services available to you at all times, but we cannot guarantee an uninterrupted and fault free service.

Mondaq reserves the right to make changes to the services and/or the Website or part thereof, from time to time, and we may add, remove, modify and/or vary any elements of features and functionalities of the Website or the services.

Mondaq also reserves the right from time to time to monitor your Use of the Website and/or services.

Disclaimer

The Content is general information only. It is not intended to constitute legal advice or seek to be the complete and comprehensive statement of the law, nor is it intended to address your specific requirements or provide advice on which reliance should be placed. Mondaq and/or its Contributors and other suppliers make no representations about the suitability of the information contained in the Content for any purpose. All Content provided "as is" without warranty of any kind. Mondaq and/or its Contributors and other suppliers hereby exclude and disclaim all representations, warranties or guarantees with regard to the Content, including all implied warranties and conditions of merchantability, fitness for a particular purpose, title and non-infringement. To the maximum extent permitted by law, Mondaq expressly excludes all representations, warranties, obligations, and liabilities arising out of or in connection with all Content. In no event shall Mondaq and/or its respective suppliers be liable for any special, indirect or consequential damages or any damages whatsoever resulting from loss of use, data or profits, whether in an action of contract, negligence or other tortious action, arising out of or in connection with the use of the Content or performance of Mondaq’s Services.

General

Mondaq may alter or amend these Terms by amending them on the Website. By continuing to Use the Services and/or the Website after such amendment, you will be deemed to have accepted any amendment to these Terms.

These Terms shall be governed by and construed in accordance with the laws of England and Wales and you irrevocably submit to the exclusive jurisdiction of the courts of England and Wales to settle any dispute which may arise out of or in connection with these Terms. If you live outside the United Kingdom, English law shall apply only to the extent that English law shall not deprive you of any legal protection accorded in accordance with the law of the place where you are habitually resident ("Local Law"). In the event English law deprives you of any legal protection which is accorded to you under Local Law, then these terms shall be governed by Local Law and any dispute or claim arising out of or in connection with these Terms shall be subject to the non-exclusive jurisdiction of the courts where you are habitually resident.

You may print and keep a copy of these Terms, which form the entire agreement between you and Mondaq and supersede any other communications or advertising in respect of the Service and/or the Website.

No delay in exercising or non-exercise by you and/or Mondaq of any of its rights under or in connection with these Terms shall operate as a waiver or release of each of your or Mondaq’s right. Rather, any such waiver or release must be specifically granted in writing signed by the party granting it.

If any part of these Terms is held unenforceable, that part shall be enforced to the maximum extent permissible so as to give effect to the intent of the parties, and the Terms shall continue in full force and effect.

Mondaq shall not incur any liability to you on account of any loss or damage resulting from any delay or failure to perform all or any part of these Terms if such delay or failure is caused, in whole or in part, by events, occurrences, or causes beyond the control of Mondaq. Such events, occurrences or causes will include, without limitation, acts of God, strikes, lockouts, server and network failure, riots, acts of war, earthquakes, fire and explosions.

By clicking Register you state you have read and agree to our Terms and Conditions