The European Commission has today adopted its adequacy decision for the EU–US Privacy Shield, the replacement for the Safe Harbor framework that was invalidated by the Court of Justice in October 2015.
Key features
- US organisations self-certify to the US Department of Commerce and commit to the Privacy Shield Principles.
- Stronger obligations on participating companies, including onward transfer accountability.
- Written assurances on limitations of US public authority access to data, and a new Ombudsperson mechanism.
- Several redress routes for EU individuals and an annual joint review.
US companies can begin self-certifying from 1 August 2016. Organisations transferring personal data to the US should check whether their recipients are certified, and consider keeping Standard Contractual Clauses as a fallback, given that legal challenges are widely expected.
Source: Commission Implementing Decision (EU) 2016/1250 – Privacy Shield (EUR-Lex)
This update is general information, not legal advice. If you would like help assessing the impact on your information security or privacy programme, contact us.
