New Agreement on Privacy Shield Set to Become Final in Early July

On June 24, 2016, the European Commission announced that it had reached a final agreement with the United States on the terms of the EU-U.S. Privacy Shield, which will permit U.S. companies to transfer the personal data of European Union (EU) citizens to the United States in compliance with EU data protection laws. The terms of the final agreement address several concerns raised by EU regulators about the initial Privacy Shield agreement reached in February of 2016, including concerns about the U.S. government’s ability to conduct mass surveillance of transferred data, the independence of the U.S. ombudsperson who will adjudicate complaints from EU citizens regarding misuse of their data, and the lack of protections regarding data retention and transfers to other companies. 

The new agreement now includes:

  • a written commitment from the White House providing that intelligence services can engage in bulk collection of data sent from the EU to the U.S. only under specific and limited preconditions;
  • a commitment that the ombudsman will be independent from national security services; and
  • explicit data retention rules requiring companies to delete data that no longer meets the purpose for which it was collected.

While the final agreement has not yet been made public, it is anticipated that several key provisions of the initial agreement will remain unchanged.  

Impact of the Brexit Vote

With respect to companies transferring data from the United Kingdom (U.K.), the Brexit vote will not have any impact on the EU-U.S. Privacy Shield in the short-term, as Britain will not depart the EU until 2018 at the earliest. According to the U.K.’s information commissioner, the U.K. likely would adopt a similar program to the Privacy Shield after departing the EU to remain on equal footing with the EU.

Next Steps in the Implementation of the Privacy Shield

The revised agreement has been sent to the Article 31 Working Party, which is made up of representatives from the EU member states, for approval. The College of Commissioners is expected to adopt the agreement in a vote to be held in early July 2016.  U.S. companies will be able to use the EU-U.S. Privacy Shield for their data transfers shortly thereafter.

 

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Ogletree, Deakins, Nash, Smoak & Stewart, P.C. | Attorney Advertising

Written by:

Ogletree, Deakins, Nash, Smoak & Stewart, P.C.
Contact
more
less

Ogletree, Deakins, Nash, Smoak & Stewart, P.C. on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide