Onward Transfer Grace Period Ends September 30

The EU-US Privacy Shield became operational on August 1, 2016; a nine-month grace period for compliance with the onward transfer requirements applies for organizations that sign up to the Privacy Shield prior to October 1, 2016.

Since August 1, US businesses have been able to self-certify compliance with the Privacy Shield principles in order to receive personal data from European Union-based businesses or consumers without specific consent or special agreements (see our July 2016 LawFlash and Privacy Shield Summary for more detail).

Organizations that self-certify must first develop a privacy policy that conforms to the Privacy Shield principles, which include

• providing individuals with a mechanism to "opt out" of disclosures of their personal data to third parties or for secondary uses of their personal data;