The EU Commission recently announced that it had come to an agreement with the US on a new framework to facilitate data flows. This announcement follows the decision by the Court of Justice of the European Union (CJEU) in Schrems v Data Protection Commissioner invalidating the traditional safe-harbour principles. Click here to view our earlier bulletin on the Schrems decision.
The effect of the CJEU's decision in Schrems was to invalidate the safe harbour principles on which companies used to rely to transfer personal data from the European Union (EU) to the United States (US). The CJEU was of the view that the revelations by Edward Snowden demonstrated a broad and indiscriminate lawful access regime in the US that is incompatible with EU data protection laws. The EU Data Protection Directive requires that information being transferred outside of the EU maintain an adequate level of protection as compared to the safeguards that exist under EU law.1 In Schrems the CJEU reasoned that the ability of public agencies to apply broad surveillance frustrates the ability of businesses to provide meaningful data protection assurances with respect to data transferred into the United States. Therefore, the CJEU found that the safe harbour regime could not protect personal information transferred from the EU to the US. The Schrems decision created great uncertainty for a number of businesses, since the global nature of business in today's marketplace often requires the transfer of data between the EU and the US.
The Proposed Solution
The EU Commission recently issued a press release indicating that it had come to an agreement with the US on a new framework for transatlantic data flows that is consistent with the CJEU's requirements in Schrems. The press release refers to the agreement as the "EU-US Privacy Shield".
The EU-US Privacy Shield calls for increased cooperation between the European Data Protection Authorities and the US Department of Commerce and Federal Trade Commission. The arrangement includes a commitment by US authorities that the possibility of lawful access will be subject to greater limitations and oversight. The arrangement will require:
Greater obligations on companies handling personal information from the EU; Increased safeguards...