Preparing To Meet Strengthened Commitments To Privacy Under The New EU-US Privacy Shield

Scenario

A large company with offices in Europe and the United States had self-certified to adhere to the EU-US Safe Harbor framework and relies on the framework for its intra-company transfers of data. Then the Safe Harbor framework is struck down by the Court of Justice of the European Union. The company's general counsel is pleased to learn that a new framework, the EU-US Privacy Shield, has been proposed, but isn't sure what the company will need to do to comply with the new Privacy Shield if the new framework is formally adopted.

Background

In October 2015, the Court of Justice of the European Union ("CJEU") held that transfers of personal data from Europe to the United States made under the so-called EU-US Safe Harbor scheme were invalid, as those transfers did not ensure an adequate level of protection under European data protection law. The case was filed by Max Schrems, a Facebook subscriber from Austria, who complained that the Safe Harbor framework