EU-US Privacy Shield – Practical Guidance For US Organisations

Earlier this month the European Commission adopted the 'Privacy Shield', the new EU-approved mechanism for the transatlantic transfer of personal data, replacing the now defunct Safe Harbor scheme. We provide practical guidance for organisations considering self-certifying under the new framework.

Some of the key points to bear in mind if your organisation is considering participation in the Privacy Shield are as follows:

Is your organisation eligible to join Privacy Shield?

In order for a US organisation to be eligible to participate in the Privacy Shield, it must be subject to the jurisdiction of either the US Federal Trade Commission ("FTC") or the Department of Transportation ("DOT"). Banks, financial institutions and non-profit organisations are generally not subject to the jurisdiction of the FTC and so are not eligible for participation in the Shield. Both the FTC and the DOT will play major roles in the enforcement of the Privacy Shield framework. These