On July 8, 2016, the European Union (“EU”) member states voted in support of the Privacy Shield through the Article 31 Committee, which is composed of representatives of the 28 member states.  The Privacy Shield would replace the Safe Harbor Framework — which the European Court of Justice invalidated in October 2015 — as a potential basis for transatlantic transfers of personal data.  Once adopted, the Privacy Shield aims to enhance privacy standards and provide a significantly improved framework over the invalidated Safe Harbor agreement to protect data flowing from Europe to the United States.  The next step is for the European Commission’s College of Commissioners to adopt a Final Adequacy Decision before the Privacy Shield becomes effective.

Companies that make use of the Privacy Shield must commit to providing adequate protection for EU citizens’ privacy rights.  The Privacy Shield requires participating companies to allow individuals to opt out of the use of their personal information for direct marketing and third party disclosure, establish consent before using sensitive private information for a purpose unrelated to the initial collection, and inform individuals of their right to access their own personal data, including the right to amend or delete. 

Furthermore, the Privacy Shield provides individuals options for dispute resolution.  Individuals may raise complaints to companies, and may submit unresolved complaints to the Department of Commerce.  The Privacy Shield contains additional safeguards related to the bulk collection of data, including the creation of an independent Ombudsman to handle concerns about government surveillance or other complaints. 

Please click here for a copy of the European Commission’s Statement.