Data Protection: The New Framework for Personal Data Transfers to the USA


Following the European Court of Justice (ECJ) decision from 6 October 2015 which declared the Safe Harbour framework invalid and as part of the reform of EU Data Protection Rules, the European Commission and the U.S. Department of Commerce reached on 2 February 2016 a political agreement on a new framework for transatlantic exchanges of personal data for commercial purposes: the EU-U.S. Privacy Shield. As a second step on 29 February 2016 the EU Commission published a draft adequacy decision confirming the sufficiency of the protection of personal data provided by the EU-US Privacy Shield. Although again based on a system of self-certification, the EU-U.S. Privacy Shield Framework provides stronger obligations on companies in the U.S to protect personal data of Europeans in combination with strong commitments by the U.S. Government on the enforcement of the arrangement. Such framework reflects the requirements set by the European Court of Justice in its ruling from 6 October 2015. According to the new framework several redress mechanisms are available for data subjects where infringements of the Privacy Principles by self certified organizations are in place. In addition, a free of charge Alternative Dispute Resolution solution will also be available. An opportunity for EU citizens to go to their national Data Protection Authorities, who will work with the DoC and FTC has also been envisaged. All of the above measures aim to identify and punish in practice infringements, thus offering an effective legal remedy of the data subject concerned. Notably, the Privacy Shield provides for safeguards and transparency obligations on U.S. government access. Any access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms. Until the Adequacy decision becomes effective, personal data can flow from the 28 EU countries to the US using the alternative tools as outlined in the Communication by the Commission to the European Parliament and the Council dated 6 November 2015 (mostly Standard Contractual Clauses and Binding Corporate Rules).