Privacy Shield

From 2016 to 2020, the EU-US Privacy Shield regulated the transfer of personal data from the EU to the US. But in July 2020, the data transfer agreement was declared invalid by the European Court of Justice (Schrems II ruling), as it could not guarantee a level of data pro­tec­tion in line with the General Data Pro­tec­tion Reg­u­la­tion (GDPR), and pri­or­i­tized US national security re­quire­ments. At least until new reg­u­la­tions take effect, US companies will be held more ac­count­able and – if they want to avoid sanctions – must now be more actively involved than ever in the discourse on data pro­tec­tion.

Although the Privacy Shield has been in­val­i­dat­ed, EU companies can still export personal data to the US. The European Com­mis­sion decided that the EU standard contract clauses (SCC) – another commonly used in­stru­ment for data transfers – still makes it possible for data to be trans­ferred in­ter­na­tion­al­ly. But instead of just bringing data over from the European Union, US companies certified under the Privacy Shield will now have to negotiate that transfer via SCCs.

Following the Schrems II judgment, the use of standard con­trac­tu­al clauses is subject to stricter rules and con­di­tions: EU companies must take ad­di­tion­al measures and, in principle, carry out a case-by-case as­sess­ment of each data transfer. However, because the EU courts have deemed US data pro­tec­tion to be limited, EU data is con­sid­ered unsafe to be trans­ferred over to the United States.

Fur­ther­more, standard con­trac­tu­al clauses are subject to review by European su­per­vi­so­ry and data pro­tec­tion au­thor­i­ties. So if the legal situation in a third country prevents a data recipient from complying with the oblig­a­tions under the standard con­trac­tu­al clauses, data transfers may be suspended or even pro­hib­it­ed. In other words, the whole process must be taken into account when examining the level of data pro­tec­tion. Through­out, it must, therefore, be guar­an­teed that national security and in­ves­tiga­tive au­thor­i­ties in the recipient country have no access to personal data.

In the current situation, case-by-case as­sess­ment is par­tic­u­lar­ly difficult for small and medium-sized en­ter­pris­es, as they don’t normally have the know-how and the means to verify whether there’s an adequate level of data pro­tec­tion in a third country. Moreover, the ECJ’s ruling doesn’t specify exactly what concrete standards are to be applied to in­di­vid­ual case as­sess­ments or to possible ex­ten­sions of standard con­trac­tu­al clauses.

Nev­er­the­less, SMEs should actively get to grips with the topic. Legal experts advise small and medium-sized en­ter­pris­es to take the highest pre­cau­tions and to create solid doc­u­men­ta­tion on their own data pro­tec­tion efforts. In doing so, companies will be better prepared for a possible legal dispute and will be better able to defend their actions in court once the Privacy Shield ends.

So, with a re­strict­ed data flow, how should US busi­ness­es who collect data on EU citizens move forward from and what measures should they take to make sure they’re complying with all the formal aspects of standard data pro­tec­tion clauses? First and foremost, companies pre­vi­ous­ly certified under the Privacy Shield should examine all data flows, contracts, and re­la­tion­ships that involve the transfer of personal data from the EU to the US. Since the legal situation in the US will now be more closely analyzed by EU companies and the prob­a­bil­i­ty of in­ap­pro­pri­ate data access more carefully assessed, it’s important that you review all agree­ments and determine whether you want to continue receiving that data. Once you’ve done that, you need to determine how the SCCs can be im­ple­ment­ed to maintain that data flow. While some partners will be more willing to accept this new agreement to keep the business running as usual, others will certainly see it as a chance to rene­go­ti­ate agree­ments in their favor.

In the process, it should be clarified whether your business will assume special con­trac­tu­al oblig­a­tions in view of the current situation (e.g. increased mon­i­tor­ing and no­ti­fi­ca­tion oblig­a­tions). In the current situation, EU companies could also call on American business partners and service providers to use all available technical means to optimize data pro­tec­tion, for example the use of end-to-end en­cryp­tion in video con­fer­enc­ing software.

EU companies who can do without data transfers, cloud services, and servers in third countries outside the EU will look for GDPR-compliant al­ter­na­tives in Europe. In addition, de­vel­op­ments in data pro­tec­tion law should be closely followed. In an FAQ document on the ECJ’s Privacy Shield judgment, European Data Pro­tec­tion Su­per­vi­sor (EDSA) provides in­for­ma­tion on the current status to in­ter­est­ed and affected parties.

The Privacy Shield was of­fi­cial­ly in­tro­duced in mid-2016 as the successor to the EU-US Safe Harbor Privacy Prin­ci­ples. The aim of the agreement was to protect the data of European citizens that is stored and processed by companies based in the US after being trans­ferred to the US. This ex­clu­sive­ly concerned personal data, which, for example, is collected to a large extent in e-commerce. Personal data includes telephone numbers, customer IDs, credit card or iden­ti­fi­ca­tion numbers, account data, the ap­pear­ance of a person, or the address of EU citizens in com­bi­na­tion with other in­di­vid­ual data.

The validity of the Safe Harbor successor ended in July 2020 by a ruling of the European Court of Justice (ECJ). In the so-called Schrems-II ruling of 16.07.2020 the ECJ assumes that the security level required in the General Data Pro­tec­tion Reg­u­la­tion (GDPR) won’t be achieved when storing and pro­cess­ing personal data in the US.

In doing so, the ECJ also annulled the adequacy finding of the European Com­mis­sion, which re­peat­ed­ly confirmed that the US had a suf­fi­cient level of data pro­tec­tion. The ECJ ruling was triggered by a lawsuit filed by Austrian data pro­tec­tion expert Max­i­m­il­ian Schrems, who had pre­vi­ous­ly initiated the end of the Safe Harbor Agreement with a lawsuit. In this lawsuit, Schrems wanted to prohibit Facebook Ireland from trans­fer­ring his personal data to the United States, filing a complaint with the Irish data pro­tec­tion authority. When the Irish High Court did not initiate pro­ceed­ings, Schrems sued them. In the second instance, the Irish data pro­tec­tion authority referred the matter to the ECJ for legal review, which ul­ti­mate­ly over­turned the EU-US Privacy Shield.

The Safe Harbor successor was based on special data pro­tec­tion measures and standards that had to be met by the US. An important element was that US companies could certify them­selves with the Privacy Shield. After a US company vol­un­tar­i­ly submitted to the terms of the agreement, a review by the US De­part­ment of Commerce took place. Once a company had suc­cess­ful­ly completed the process, it was included in a publicly ac­ces­si­ble database. The list included a total of 5,384 or­ga­ni­za­tions at the end of the agreement’s validity.

The EU-US Privacy Shield guar­an­teed EU citizens com­pre­hen­sive rights when personal data was trans­ferred to certified companies in the US – and EU citizens could contact the companies directly to claim these rights. These companies had to respond to the citizens’ concerns within 45 days. The rights guar­an­teed in the Privacy Shield included:

• Right to in­for­ma­tion and dis­clo­sure
• Right of objection (an objection could be made against a data pro­cess­ing if necessary)
• Right to rectify in­ac­cu­rate data
• Right to deletion of data
• Com­plaints/redress pro­ce­dures were available

To enforce and protect their rights, EU citizens could also turn to an ombudsman within the US De­part­ment of State. The ombudsman should be in­de­pen­dent of all in­tel­li­gence services, in­ves­ti­gate the concerns of private in­di­vid­u­als, and provide in­for­ma­tion on whether ap­plic­a­ble law is being observed in specific cases. However, the office was not filled until 2018 at the in­sis­tence of the EU. Manisha Singh initially served as om­budsper­son, followed by Keith Krach in June 2019.

Al­ter­na­tive­ly, EU citizens could turn to their national data pro­tec­tion au­thor­i­ties, which could then contact the US Federal Trade Com­mis­sion (FTC) directly for further clar­i­fi­ca­tion. If no other form of agreement could be found, then ar­bi­tra­tion pro­ceed­ings with an en­force­able arbitral award acted as the final frontier. Ad­di­tion­al­ly, all companies were able to act in ac­cor­dance with the rec­om­men­da­tions of European data pro­tec­tion au­thor­i­ties. Those companies that process personal data are obliged to do so anyway.

A pre­req­ui­site for the validity of the Privacy Shield was the adequacy decision by the EU Com­mis­sion, which certified that the United States has adequate data pro­tec­tion standards for the storage and pro­cess­ing of personal data from the EU. The adequacy decision of 2016 was reviewed annually and renewed if the required level of data pro­tec­tion was met. The EU Com­mis­sion and the US De­part­ment of Commerce conducted the review jointly with the in­volve­ment of experts. The procedure resulted in a publicly available report that was submitted to the European Par­lia­ment and the Council.

Despite these extensive data pro­tec­tion measures, mass sur­veil­lance was not com­plete­ly ruled out. In six areas, which on closer in­spec­tion leave a certain scope for in­ter­pre­ta­tion, the US was able to collect data on and for:

• Coun­tert­er­ror­ism
• Revealing ac­tiv­i­ties of foreign powers
• Combating the pro­lif­er­a­tion of weapons of mass de­struc­tion
• Cy­ber­se­cu­ri­ty
• Pro­tec­tion of US and allied forces
• Combating transna­tion­al criminal threats

For EU citizens, the extensive rights to complain in the event of concrete breaches of data pro­tec­tion by US companies were among the benefits of the Privacy Shield agreement. An important component was also the purpose lim­i­ta­tion principle: Data could only be logged and processed for a purpose that was clearly defined in advance and legally per­mis­si­ble. For US-based or­ga­ni­za­tions, the stamp of approval of providing “adequate” privacy pro­tec­tion was key for the transfer of data outside of the EU, as well as that Member State re­quire­ments were waived for par­tic­i­pat­ing companies.

However, the EU-US Privacy Shield was met with op­po­si­tion from the get-go. Critics argued that the agreement was not far-reaching enough. There were com­plaints that the re­quire­ments of the European Court of Justice were not suf­fi­cient­ly met and that many dis­crep­an­cies were only cos­met­i­cal­ly concealed. Since the post of ombudsman was assigned to the Ministry of Foreign Affairs, critics felt that the agreement lacked in­sti­tu­tion­al in­de­pen­dence and that it con­flict­ed with the General Data Pro­tec­tion Reg­u­la­tion (Article 52 (1) GDPR). They also crit­i­cized the fact that affected EU citizens could not take legal action against decisions of the ombudsman’s office.

Another main point of criticism was that the mass sur­veil­lance measures were not subject to a pro­por­tion­al­i­ty test and in doing so violated European law. The US was still the central con­trol­ling power and there was no evidence of an in­ves­ti­ga­tion by national su­per­vi­so­ry au­thor­i­ties. The critics also missed the urgently needed control of large US online companies.

Due to these short­com­ings, critics and experts already at that time assumed that the agreement would not stand up to the review by the European Court of Justice, and therefore did not represent a long-term, legally sound solution. The con­spic­u­ous­ly small dif­fer­ences to Safe Harbor were re­peat­ed­ly denounced. Many critics assumed that various data pro­tec­tion loopholes were de facto not closed by the Privacy Shield.

Click here for important legal dis­claimers.