Data Protection - EU-US Privacy Shield adopted by European Commission
The European Commission has adopted an adequacy decision approving the Privacy Shield framework for EU-US transfers of personal data.
In October 2015 we reported that the Safe Harbor provisions, providing a mechanism for US companies to self certify their compliance with the Safe Harbor principles, was invalidated by the ECJ.
Since then, a new framework, the Privacy Shield, has been proposed, allowing US companies to self-certify on an annual basis with the US department of Commerce that they meet the Privacy Shield requirements. This framework has now been approved by the European Commission as providing adequate protection as from 1 August 2016.
European companies transferring or potentially transferring personal data to US companies should ensure they have requirements in place that the US company complies with the Privacy Shield framework.
Common examples of European companies transferring data to the US are companies with a US parent that often use IT systems located at the US headquarters to administer personal data such as HR and CRM. Likewise, significant numbers of companies outsource their IT systems to cloud service providers which frequently use US-based servers to store the data. Also, companies that send, for example, payroll data to the US for administrative purposes will need to ensure the US company is complying with the Privacy Shield provisions.
Posted on 08/03/2016 by Ortolan
