Data Protection Update

As we reported in our October 2015 edition of the Isle of Man Regulatory Update, the Court of Justice of the European Union (CJEU) ruled on 6 October 2015 (in the Schrems case) that organisations cannot rely on the European Commission approved Safe Harbor scheme when transferring personal data from the European Union (EU) to the United States of America (US). We also reported in the April 2016 edition of the Update on the European Commission's proposed replacement to the Safe Harbor provisions announced on 2 February 2016 - the so called "EU-US Privacy Shield".

Background

The EU's Data Protection Directive 95/46/EC (Directive) provides that personal data may only be transferred to a country outside the European Economic Area (EEA) if that country ensures an adequate level of protection for the data. This corresponds to the "Eighth Data Protection Principle" as it is set out in the Isle of Man's Data Protection Act 2002. The European Commission has certified that