On February 2, 2016, The European Commission (EC) and the U.S. Department of Commerce (Commerce) reached a deal on a new transatlantic data-transfer pact to replace the 15-year-old Safe Harbor agreement. The European Court of Justice invalidated the Safe Harbor agreement in late 2015 on the ground that it failed to adequately protect the privacy rights of EU citizens.

The text of the replacement agreement—dubbed the EU-U.S. Privacy Shield—has not yet been released, but the EC issued a Press Release about the agreement and several aspects of it are of immediate significance to companies involved in transnational transfers of personal data (e.g., employee and consumer data). Two notable changes are...