While the decision on the Privacy Shield is currently being reviewed by the European Commission and a decision is due in July, the expectation that, if passed, the agreement will more than likely face a higher court ruling challenge at the Court of Justice of the European Union.

Which means there will be a delay in adopting the shield. Does this sound a little like “Groundhog Day”?

A few highlights of Privacy Shield:

Corporations:

Will be on the hook for more transparency and oversight of their practices. If you are in noncompliance expect some hand slapping (sanctions) for your misgivings. It’s a good idea to review your privacy policy and ensure you have adequate notices communicated.

Redress:

EU citizens will have the abilities to “complain” directly against a U.S. Privacy Shield participant, with a mandatory 45-day response window for resolution.

U.S. Government access:

If you recall, one of the sticking points that led to the demise of Safe Harbor was the small incident of Edward Snowden and the U.S. Government’s monitoring activities. So with the Shield in place, the United States has agreed to provide clear limitations, safeguards, and oversight mechanisms to our EU partners.

The Privacy Shield allows for U.S. companies to report the number of access requests they receive from the government, and an independent ombudsman will be able to handle and investigate individual complaints.

Cooperation:

The Federal Trade Commission and the Federal Communications Commission have committed to monitor and enforce more robustly and cooperate more with the EU DPAs (data protection agencies). There will also be a joint annual monitoring of the effectiveness of the Privacy Shield and an annual report to the European Commission and the EU parliament.

Both skepticism and support for the Privacy Shield have been well-documented. I think we will get to some common ground on the agreement, but it will take some time.

My prediction* is that we have more chance of England winning the Euro 2016 tournament than the Privacy Shield becoming effective in 2016.

So what’s a privacy-committed organization to do in the meantime?

Until we get the Shield in place, Model Contracts and Binding Corporate Rules are still a legally acceptable form of transfer. (That’s what Act-On does.) As always, we’re offering a point of view here. You will need to seek a legal opinion on any compliance or regulatory issue that may affect your business.

We will be communicating updates as we get them on all things Shield-related.

Cheers,

David

*England out in the semis.

Let’s block ads! (Why?)

Act-On Marketing Blog