ICO Reminds Organisations Of EU-U.S. Personal Data Transfer Obligations

The Interim Deputy Commissioner at the Information Commissioner's Office ("ICO"), Steve Wood, has published a blog reminding organisations of their obligations when transferring personal data to the United States, pursuant to the case brought by Max Schrems in 2015, which led to the Safe Harbor framework being declared immediately invalid. Wood reminds organisations that continued reliance on Safe Harbor as a means to provide an adequate level of protection for the rights and freedoms of data subjects "is not an option." Although it is accepted that implementation of the required changes may take time, the ICO, in certain circumstances, will contemplate enforcement action against companies that fail to comply with the provisions of the Data Protection Act 1998 ("DPA"). It is recommended that organisations do not delay.