Navigating Data Protection Laws: Using European Clauses As The Foundation For U.S. Agreements

Introduction: the hidden cost of data

In today's information-based economy, businesses increasingly find themselves transferring data containing personal information to or from vendors. As laws are enacted to control how a business can use personal data, such uses create liability for a business.

Damages for failure to properly protect personal data can be high: In 2022 alone, U.S. civil settlements exceeded $1 billion; a jury in a notable U.S. state case, Rogers v. BNSF Railway Co., awarded $428 million in damages, and European regulators issued an aggregate of over $1.7 billion in fines. Given this potential liability, businesses are well-advised to establish data privacy policies that assure protection commensurate with data privacy laws and to craft third-party agreements reflecting these policies.