The EU-US ‘Privacy Shield’ heralds new era of trans-Atlantic data transfers
13 December 2016
Click here to read online.
A new set of regulations now governs the transfer of data between the US and Europe, in the wake of changes that followed an EU court case resulting from the 2013 Edward Snowden data leak case. Here, Rebecca McNulty, a senior associate with the Bedell Cristin law firm in Jersey, considers the new “EU-US Privacy Shield”, and whether, as some say, it might one day be successfully challenged, amid calls for something still more robust…
Year on year, we generate more data, use more electronic devices, and take advantage of the latest technological developments to transfer still more data.
As a result, the scope and significance of transatlantic data transfers have increased, but so too have the risks. And getting it wrong can be costly, both financially as well as reputationally.
Handling personal data appropriately and carefully, therefore, should be high on the list of any company’s priorities.
Global offshore finance centres such as Jersey and Guernsey, although not part of the European Union, nevertheless have to monitor developments within the EU, including in the rapidly evolving data protection sphere, to ensure they continue to meet international standards. And in this area, one of the latest developments to have emerged is the so-called “EU-US Privacy Shield”.
The Channel Islands and the EU
To best understand this privacy shield, we need to go back and look at the existing legal relationship between the Channel Islands and the EU. This relationship is enshrined in what is known as Protocol 3 of the UK’s Accession Treaty 1972, under which Jersey and Guernsey are part of the EU’s customs union.
What this means is that the two Channel Islands are essentially regarded as being within the EU’s Single Market for the purpose of trading in goods, but are regarded as “third countries” in all other respects.
Both jurisdictions benefit from a close relationship with the EU, and as a result, they voluntarily implement appropriate EU legislation, or, where applicable, apply the international standards on which such legislation is based.
Laws are also in place representing the voluntary implementation of the European Data Protective Directive, which concerns the protection of the individual in respect of processing personal data, and the free movement of such data.
This European Data Protective Directive places restrictions on the transfer of data outside the European Economic Area (EEA), so that data may only be transferred to countries outside the EEA that can ensure an adequate level of protection for any personal data transferred. (There is no reason for this to change as a consequence of Brexit, by the way.)
As major international finance centres, both Jersey and Guernsey naturally have to meet the international “gold standard” in data protection. And in fact, they have been included among a number of non-EEA countries that the European Commission has certified as providing “adequate protection” for such data.
This ensures that personal data can flow to and from EU countries to third countries like Jersey and Guernsey, without further safeguards being necessary.
Safe Harbor not ‘safe’
The US, of course, isn’t part of the EU, and has its own set of data transfer rules.
It used to operate under what was known as the so-called “Safe Harbor arrangement”. That arrangement was declared invalid and non-compliant in October 2015 by the European Court of Justice, in a case known as “Schrems v Data Protection Commissioner”, which was sparked by the Edward Snowden revelations in 2013, of the US government’s global surveillance programmes.
The decision in Schrems left the world of transatlantic personal data transfers, at least temporarily, in a state of legal limbo.
One of the biggest issues with the Safe Harbor arrangement was the US government’s mass surveillance of data, revealed by Edward Snowden, which could be accessed and further processed by US authorities in a way that the EU regarded as incompatible with the grounds under which the data was originally collected, and the purpose for which it was transferred to the US.
The Privacy Shield
This brings us to the “Privacy Shield”. This is what has effectively replaced the Safe Harbor arrangement in overseeing the way data transfers are carried out across the Atlantic, between the US and EU member states, as well as non-EU jurisdictions like Jersey and Guernsey that are able to participate.
It was approved in July, and aims to reflect the requirements of the European Court of Justice in the Schrems case.
It is the result of a collaborative effort by the European Commission, European Data Protection Authorities, European Parliament, the EU member states themselves, and their US counterparts.
In the words of the US Department of Commerce, it was designed by that US government department and the European Commission to “provide companies on both sides of the Atlantic with a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States in support of transatlantic commerce”.
According to the US Department of Commerce, the Shield:
- provides a set of robust and enforceable protections for the personal data of EU individuals in the US;
- provides transparency regarding how participating companies use personal data, strong US government oversight, and increased cooperation with EU data protection authorities;
- offers EU individuals access to multiple avenues to address any concerns regarding participants’ compliance with the framework, including free dispute resolution;
- ensures a continuing level of protection when personal data is collected under the Shield and transferred to third parties; and
- makes it easier for EU individuals to understand and exercise their rights in the US.
Joining the Shield is voluntary, and requires that a US company self-certify to the US Department of Commerce that it commits to complying with the Shield’s requirements.
Long term solution or short term fix?
Concerns have been expressed over the self-certification process involved in signing up to the Shield. Specifically, questions are being asked about whether the Shield offers a long term solution to the gap left by the departure of the Safe Harbor arrangement, or whether it represents nothing more than a short-term fix.
The Safe Harbor arrangement also involved a self-certification process, critics note, and ultimately that arrangement proved not to be so “safe” after all, in terms of personal data protection, both as a result of commercial parties’ own failures as well as the US authorities’ practice of taking advantage of the data it was able to access.
With no compulsory independent testing, no sampling and no obvious compliance requirements, there are, these critics maintain, justifiable concerns over whether the Shield will provide adequate protection.
Current thinking, therefore, suggests that the Shield could be subject to challenge at some point, perhaps in the not too distant future.
The US factor
Meantime – and possibly adding to the concerns surrounding the Shield – is the fact that this is an arrangement with the US, a country whose authorities have in the past demonstrated an apparent indifference to the data protection rights of individuals, and a country that has just witnessed the biggest upset in modern political history, with Donald Trump overcoming all the odds to become the 45th US President.
Trump, of course, as some of those concerned about trans-Atlantic data protection standards point out, is someone who, during the campaign, invited the Russians to hack Hilary Clinton’s emails, and whose own company, Trump International Golf Course Scotland, recently found itself in trouble for not being registered under the Data Protection Law in England.
Regulation and protection
The question, then, is this: Does the Shield protect financial intermediaries, service providers and advisory firms in jurisdictions such as Jersey and Guernsey in their dealings with US commercial entities?
As things stand presently, the answer to that might be yes, in relation to data export and adequacy of protection – but the protection of personal data relies on companies exercising reasonable care in the way they store individual’s data, and protecting that data from both internal and external threats such as hackers, cyber-criminal organisations and state sponsored attacks.
What’s more, personal data is reported to be a trending target of cyber-attacks. The size of the company holding the data does not appear to matter. Personal data is valuable, and with the increasing digitalisation of personal data, protecting that data has become a critical task for any business.
When considering the transfer of data, businesses therefore need to pause for a moment and consider carefully whether a particular service provider offers the necessary personal data safeguards.
With current thinking being that the Shield will likely be challenged at some point, you should consider carefully where, for example, you are transferring your employees’ personal data to. What would happen if the Shield were to be successfully challenged, and a US provider is left holding your employees’ personal data without appropriate safeguards in place?
Apparently the Russian intelligent service uses manual typewriters, in an effort to avoid the intelligence it holds being compromised unnecessarily.
We don’t see any need to revert to manual typewriters at the moment, but businesses do need to exercise reasonable care when dealing with personal data, and particularly when considering transatlantic data transfers.
Company executives should consider reviewing their firm’s data management policy, and ensuring that when anyone transfers data, they ensure that a comprehensive contract dealing with the transfer is put in place.
They should also ensure that there is some provision for the reporting of any security breach, and making sure that they have policies and procedures in place to deal with any such breach, or potential breach.
The EU-US Privacy Shield is, as it happens, just one of a number of data issues that firms have to understand.
The new General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), which is due to come into force on 25 May 2018, will replace the current EU Directive that governs data transfers.
The GDPR is a regulation that the European Commission is evidently looking to rely on to strengthen data protection for individuals within the EU, and also to deal with the export of personal data outside the EU.
The Office of the Information Commissioner has warned that changes to the European privacy and data protection legislation will have a “significant impact on the Channel Islands”, and that reforming domestic laws and practices needs to be prioritised, to avoid serious detrimental effect on the financial and digital sectors which rely on cross border data transfers.
We will wait, therefore, to see how exactly the Shield will impact the financial services industries in the Channel Islands, and await the coming into force of the GDPR.
And at the same time, we are bearing in mind the saying, famously uttered in one of the Godfather films and possibly worth bearing in mind with respect to trans-Atlantic data transfer matters: “Keep your friends close, keep your enemies closer”.
With Donald Trump poised to take up his seat as president of the US in less than two months’ time, you might wish to consider keeping your enemies close, and your data, for now at least, where possible, even closer.