Privacy Shield

From 2016 to 2020, the EU-US Privacy Shield regulated the transfer of personal data from the EU to the US. But in July 2020, the data transfer agreement was declared invalid by the European Court of Justice (Schrems II ruling), as it could not guarantee a level of data pro­tec­tion in line with the General Data Pro­tec­tion Reg­u­la­tion (GDPR), and pri­or­it­ised US national security re­quire­ments. At least until new reg­u­la­tions take effect, US companies will be held more ac­count­able and – if they want to avoid sanctions – must now be more actively involved than ever in the discourse on data pro­tec­tion. In a post-Brexit world, the UK will need a data adequacy agreement to transfer data beyond its borders.

Although the Privacy Shield has been in­val­id­ated, EU companies can still export personal data to the US. The European Com­mis­sion decided that the EU standard contract clauses (SCC) – another commonly used in­stru­ment for data transfers – still makes it possible for data to be trans­ferred in­ter­na­tion­ally. While US companies certified under the Privacy Shield will now have to negotiate that transfer via SCCs, UK companies will be under the same scrutiny, and must provide as­sur­ances that data won’t be stored and used beyond its agreed use.

Following the Schrems II judgment, the use of standard con­trac­tu­al clauses is subject to stricter rules and con­di­tions: EU companies must take ad­di­tion­al measures and, in principle, carry out a case-by-case as­sess­ment of each data transfer. This poses an ad­di­tion­al hurdle for the UK, which is already facing a very com­plic­ated process in terms of re­arran­ging data pro­tec­tion agree­ments in light of Brexit. But to make sure that data can be trans­ferred from the EU to the UK, the UK requires an adequacy decision from the European Court of Justice (ECJ). Without it, long-term dis­rup­tions to data flow between the EU and UK are highly likely.

Fur­ther­more, standard con­trac­tu­al clauses are subject to review by European su­per­vis­ory and data pro­tec­tion au­thor­it­ies. So if the legal situation in a third country prevents a data recipient from complying with the ob­lig­a­tions under the standard con­trac­tu­al clauses, data transfers may be suspended or even pro­hib­ited. In other words, the whole process must be taken into account when examining the level of data pro­tec­tion. Through­out, it must, therefore, be guar­an­teed that national security and in­vest­ig­at­ive au­thor­it­ies in the recipient country have no access to personal data.

In the current situation, case-by-case as­sess­ment is par­tic­u­larly difficult for small and medium-sized en­ter­prises, as they don’t normally have the know-how and the means to verify whether there’s an adequate level of data pro­tec­tion in a third country. Moreover, the ECJ’s ruling doesn’t specify exactly what concrete standards are to be applied to in­di­vidu­al case as­sess­ments or to possible ex­ten­sions of standard con­trac­tu­al clauses.

Nev­er­the­less, SMEs should actively get to grips with the topic. Legal experts advise small and medium-sized en­ter­prises to take the highest pre­cau­tions and to create solid doc­u­ment­a­tion on their own data pro­tec­tion efforts. In doing so, companies will be better prepared for a possible legal dispute and will be better able to defend their actions in court once the Privacy Shield ends.

In the UK, further com­plic­a­tions are on the horizon. While in the trans­ition­al with­draw­al period from the EU, the UK is still bound by the EU’s reg­u­lat­ory re­quire­ments with regards to data pro­tec­tion. From January 2021, though, that’s about to change. Since the EU will be concerned that the UK will transfer data on the US as a ‘third country’, data transfers will be under more scrutiny than ever, and will probably be assessed on a case-by-case basis.

So, with a re­stric­ted data flow, how should UK busi­nesses who collect data on EU citizens move forward from and what measures should they take to make sure they’re complying with all the formal aspects of standard data pro­tec­tion clauses? First and foremost, companies should examine all data flows, contracts, and re­la­tion­ships that involve the transfer of personal data from the EU to the UK. Once you’ve done that, you need to determine how the SCCs can be im­ple­men­ted to maintain that data flow. While some partners will be more willing to accept this new agreement to keep the business running as usual, others will certainly see it as a chance to rene­go­ti­ate agree­ments in their favour. Experts suggest preparing for the worst, in other words, for the EU’s adequacy decision to go against the UK.

To put your business in the pro­cess­best possible position, it should be clarified whether your busi­nes­sit will assume special con­trac­tu­al ob­lig­a­tions in view of the current situation (e.g. increased mon­it­or­ing and no­ti­fic­a­tion ob­lig­a­tions). In the current situation, EU companies could also call on Amer­ic­a­nUK business partners and service providers to use all available technical means to op­tim­ize­optim­ise data pro­tec­tion, for example the use of end-to-end en­cryp­tion in video con­fer­en­cing software.

EU companies who can do without data transfers, cloud services, and servers in third countries outside the EU will look for GDPR-compliant al­tern­at­ives in Europe. In addition, de­vel­op­ments in data pro­tec­tion law should be closely followed. In an FAQ document on the ECJ’s Privacy Shield judgment, European Data Pro­tec­tion Su­per­visor (EDSA) provides in­form­a­tion on the current status to in­ter­ested and affected parties.

The Privacy Shield was of­fi­cially in­tro­duced in mid-2016 as the successor to the EU-US Safe Harbor Privacy Prin­ciples. The aim of the agreement was to protect the data of European citizens that is stored and processed by companies based in the US after being trans­ferred to the US. This ex­clus­ively concerned personal data, which, for example, is collected to a large extent in e-commerce. Personal data includes telephone numbers, customer IDs, credit card or iden­ti­fic­a­tion numbers, account data, the ap­pear­ance of a person, or the address of EU citizens in com­bin­a­tion with other in­di­vidu­al data.

The validity of the Safe Harbor successor ended in July 2020 by a ruling of the European Court of Justice (ECJ). In the so-called Schrems-II ruling of 16.07.2020 the ECJ assumes that the security level required in the General Data Pro­tec­tion Reg­u­la­tion (GDPR) won’t be achieved when storing and pro­cessing personal data in the US. Once the UK leaves the EU, it can therefore be assumed that UK national security and sur­veil­lance will be under more scrutiny than ever, just like the US.

With the end of the EU-US Privacy Shield, the ECJ also annulled the adequacy finding of the European Com­mis­sion, which re­peatedly confirmed that the US had a suf­fi­cient level of data pro­tec­tion. The ECJ ruling was triggered by a lawsuit filed by Austrian data pro­tec­tion expert Max­imili­an Schrems, who had pre­vi­ously initiated the end of the Safe Harbor Agreement with a lawsuit. In this lawsuit, Schrems wanted to prohibit Facebook Ireland from trans­fer­ring his personal data to the United States, filing a complaint with the Irish data pro­tec­tion authority. When the Irish High Court did not initiate pro­ceed­ings, Schrems sued them. In the second instance, the Irish data pro­tec­tion authority referred the matter to the ECJ for legal review, which ul­ti­mately over­turned the EU-US Privacy Shield.

The Safe Harbor successor was based on special data pro­tec­tion measures and standards that had to be met by the US. An important element was that US companies could certify them­selves with the Privacy Shield. After a US company vol­un­tar­ily submitted to the terms of the agreement, a review by the US De­part­ment of Commerce took place. Once a company had suc­cess­fully completed the process, it was included in a publicly ac­cess­ible database. The list included a total of 5,384 or­gan­isa­tions at the end of the agreement’s validity.

The EU-US Privacy Shield guar­an­teed EU citizens com­pre­hens­ive rights when personal data was trans­ferred to certified companies in the US – and EU citizens could contact the companies directly to claim these rights. These companies had to respond to the citizens’ concerns within 45 days. The rights guar­an­teed in the Privacy Shield included:

• Right to in­form­a­tion and dis­clos­ure
• Right of objection (an objection could be made against a data pro­cessing if necessary)
• Right to rectify in­ac­cur­ate data
• Right to deletion of data
• Com­plaints/redress pro­ced­ures were available

To enforce and protect their rights, EU citizens could also turn to an ombudsman within the US De­part­ment of State. The ombudsman should be in­de­pend­ent of all in­tel­li­gence services, in­vest­ig­ate the concerns of private in­di­vidu­als, and provide in­form­a­tion on whether ap­plic­able law is being observed in specific cases. However, the office was not filled until 2018 at the in­sist­ence of the EU. Manisha Singh initially served as om­bud­sper­son, followed by Keith Krach in June 2019.

Al­tern­at­ively, EU citizens could turn to their national data pro­tec­tion au­thor­it­ies, which could then contact the US Federal Trade Com­mis­sion (FTC) directly for further cla­ri­fic­a­tion. If no other form of agreement could be found, then ar­bit­ra­tion pro­ceed­ings with an en­force­able arbitral award acted as the final frontier. Ad­di­tion­ally, all companies were able to act in ac­cord­ance with the re­com­mend­a­tions of European data pro­tec­tion au­thor­it­ies. Those companies that process personal data are obliged to do so anyway.

A pre­requis­ite for the validity of the Privacy Shield was the adequacy decision by the EU Com­mis­sion, which certified that the United States has adequate data pro­tec­tion standards for the storage and pro­cessing of personal data from the EU. The adequacy decision of 2016 was reviewed annually and renewed if the required level of data pro­tec­tion was met. The EU Com­mis­sion and the US De­part­ment of Commerce conducted the review jointly with the in­volve­ment of experts. The procedure resulted in a publicly available report that was submitted to the European Par­lia­ment and the Council.

Despite these extensive data pro­tec­tion measures, mass sur­veil­lance was not com­pletely ruled out. In six areas, which on closer in­spec­tion leave a certain scope for in­ter­pret­a­tion, the US was able to collect data on and for:

• Coun­terter­ror­ism
• Revealing activ­it­ies of foreign powers
• Combating the pro­lif­er­a­tion of weapons of mass de­struc­tion
• Cy­ber­se­cur­ity
• Pro­tec­tion of US and allied forces
• Combating transna­tion­al criminal threats

For EU citizens, the extensive rights to complain in the event of concrete breaches of data pro­tec­tion by US companies were among the benefits of the Privacy Shield agreement. An important component was also the purpose lim­it­a­tion principle: Data could only be logged and processed for a purpose that was clearly defined in advance and legally per­miss­ible. For US-based or­gan­iz­a­tions, the stamp of approval of providing ‘adequate’ privacy pro­tec­tion was key for the transfer of data outside of the EU, as well as that Member State re­quire­ments were waived for par­ti­cip­at­ing companies.

However, the EU-US Privacy Shield was met with op­pos­i­tion from the get-go. Critics argued that the agreement was not far-reaching enough. There were com­plaints that the re­quire­ments of the European Court of Justice were not suf­fi­ciently met and that many dis­crep­an­cies were only cos­met­ic­ally concealed. Since the post of ombudsman was assigned to the Ministry of Foreign Affairs, critics felt that the agreement lacked in­sti­tu­tion­al in­de­pend­ence and that it con­flic­ted with the General Data Pro­tec­tion Reg­u­la­tion (Article 52 (1) GDPR). They also cri­ti­cized the fact that affected EU citizens could not take legal action against decisions of the ombudsman’s office.

Another main point of criticism was that the mass sur­veil­lance measures were not subject to a pro­por­tion­al­ity test and in doing so violated European law. The US was still the central con­trolling power and there was no evidence of an in­vest­ig­a­tion by national su­per­vis­ory au­thor­it­ies. The critics also missed the urgently needed control of large US online companies.

Due to these short­com­ings, critics and experts already at that time assumed that the agreement would not stand up to the review by the European Court of Justice, and therefore did not represent a long-term, legally sound solution. The con­spicu­ously small dif­fer­ences to Safe Harbor were re­peatedly denounced. Many critics assumed that various data pro­tec­tion loopholes were de facto not closed by the Privacy Shield.

Please note the legal dis­claim­er relating to this article.