Cross-border personal information transfers often involve complex privacy requirements, particularly when the data subjects reside in the EU.

Practical Law asked the co-chair of Morrison & Foerster's Global Privacy and Data Security Group, Miriam Wugmeister, along with her colleagues, Berlin-based Senior of Counsel, Prof. Lokke Moerel and Washington DC-based Senior Privacy Advisor, Cynthia Rich, to discuss the current state of personal information transfers from the EU to the US and the newly announced US-EU "Privacy Shield" data transfer pact.

Morrison & Foerster's global privacy team leads the Global Privacy Alliance (GPA) and regularly advises some of the world’s largest and most complex multinational organizations on their most difficult US and international privacy challenges.

The EU Data Protection Directive (Directive) defines personal information as any information relating to an identified or identifiable natural person. Personal information can identify the individual directly or indirectly and includes items such as identification numbers or factors specific to the person's physical, physiological, mental, economic, cultural, or social identity.

Privacy rules in Europe restrict the transfer of all personal information from organizations operating within the European Economic Area (EEA) and Switzerland to organizations in countries outside the EEA that do not provide sufficient privacy protection. As of March 2016, the European Commission (EC) only recognizes ten countries as providing adequate data protection. Countries currently considered inadequate by the EU include the US, India, Australia, Japan, Korea, Hong Kong, Singapore, and the Philippines.

To transfer personal information, such as information relating to customers, vendors, and employees, from the EEA and Switzerland to affiliates or service providers in inadequate countries, organizations must either:

Until last October, accepted transfer mechanisms for US organizations included US-EU Safe Harbor certification, EU-approved Standard Contractual Clauses (SCCs), or Binding Corporate Rules (BCRs).

The US-EU Safe Harbor Framework enabled EEA-based organizations to comply with their privacy laws when sending personal information to US organizations. Switzerland and the US established a similar framework.

US organizations that certified to the Safe Harbor Framework agreed to handle personal information transferred from the EEA and Switzerland under seven Safe Harbor principles and fifteen frequently asked questions and answers. The Safe Harbor principles required participating organizations to:

On October 6, 2015, the ECJ issued its decision in Schrems v. Data Protection Commissioner, invalidating the EC’s adequacy decision for the EU-US Safe Harbor Framework. The decision affected tens of thousands of European organizations that share data with US Safe Harbor-certified organizations. The ECJ's concern about unfettered access to transferred EU data by US law enforcement and national security authorities and EU citizens' inability to seek judicial redress against these actions primarily drove the invalidity decision.

The ECJ further held that EU national data protection authorities (DPAs) cannot invalidate an EC's adequacy decision. They can, however, suspend or prohibit individual data transfers on a case by case basis if, for example, they find that the receiving organization's domestic laws interfere with EU data protection rights in a way that goes beyond "what is necessary in a democratic society." This conclusion raised concerns that individual DPAs could effectively suspend all transatlantic transfers if they determined that the Schrems decision applied to alternative cross-border transfer methods, such as SCCs or BCRs.

Following the ECJ decision, Working Party 29 (WP29), the DPAs' coordinating group, encouraged US and EU authorities to complete ongoing negotiations and develop a revised and improved Safe Harbor Framework to satisfy EU privacy rules. It warned that failure to reach an appropriate solution by late January 2016 could lead individual DPAs to step in and protect individuals by exercising their authority to conduct coordinated enforcement actions and suspending individual transfers. The WP29 also urged current Safe Harbor organizations to implement temporary measures, such as SCCs or BCRs, ensuring continued compliance with EU data transfer rules.

The Swiss DPA followed suit, declaring that the US-Swiss Safe Harbor Framework also no longer supported personal information transfers to the US and asking affected organizations to modify their contracts or adopt another transfer method before the end of January 2016. It also recommended that organizations enable individuals to exercise their rights by clearly informing them that government authorities may access data transmitted to the US. Data transfer contracts should also commit the parties to provide affected individuals with effective legal protection tools, and to actually perform the relevant procedures and accept resulting decisions.

Practically speaking, thousands of organizations had to scramble to put SCCs or other transfer mechanisms into place with their service providers and affiliated organizations. At the same time, the Safe Harbor's uncertain future caused organizations, particularly those scheduled for renewal, to decide whether to renew, balancing the associated financial and administrative costs with the costs of other solutions.

The Privacy Shield Framework has not been finalized yet. The Article 31 Committee of EU Member States' representatives must within three months review the EC's draft adequacy decision and issue an opinion. The WP29 also announced that it intends to issue an opinion on the draft at its April 12-13, 2016 plenary meeting and expects its opinion to also effect other transfer mechanisms. The European Data Protection Supervisor (EDPS) announced that it will issue its own opinion after the WP29 has made its opinion public.

On March 17, the EU Parliament’s Committee on Civil Liberties, Justice, and Home Affairs held hearings regarding the proposed EU-U.S. Privacy Shield. Representatives from the EC, the DoC, the WP29, the EDPS, and several private sector stakeholders participated. The hearing discussed significant questions raised about the Privacy Shield including the US Government's continued collect of personal information and concerns that it does not address all of the General Data Protection Regulation (GDPR) obligations, such as the right to data portability. Given the initial concerns raised, it is quite possible that the Privacy Shield Framework may require a further round of negotiations before adoption. The Privacy Shield is not expected to be adopted before May 2016.

To join the Privacy Shield, an organization must meet four conditions:

Privacy Shield benefits begin after the Department of Commerce ("DoC") reviews the organization's self-certification submission and qualifies it for placement on the public Privacy Shield List.

At first glance, the Privacy Shield bears a strong resemblance to Safe Harbor, with similar program entry conditions and similar core Principles, such as notice, choice, security, data integrity, access, and enforcement. However, the Privacy Shield introduces substantial changes, including:

Under both the Safe Harbor and the Privacy Shield, special rules apply to human resources data, sensitive information, travel information, and pharmaceutical and medical products data. The additional obligations and exceptions for those data categories remain largely unchanged under the Privacy Shield.

Like the Safe Harbor, a Privacy Shield organization's required public commitments provide the FTC or other regulators with jurisdiction to enforce compliance failures under Section 5 of the FTC Act or similar statutes that protect against unfair and deceptive practices. Privacy Shield program participation is only open to organizations regulated by the FTC, DoT, or another government entity the EU recognizes as capable of effectively ensuring compliance with the Principles.

The DoC, FTC, and DoT have agreed to expand their program oversight and increase reporting and disclosure obligations for both organizations and their independent dispute resolution providers. The potential sanctions remain the same under the Privacy Shield. Both programs require sanctions rigorous enough to ensure the organization's compliance with the Principles. Potential sanctions include:

Independent dispute resolution bodies must also report a Privacy Shield organization's failure to comply with their rulings to the organization's regulator or the courts, as appropriate, and the DoC.

The DoC must remove organizations that persistently fail to comply with the Principles from the Privacy Shield program. Persistent failure to comply occurs when a registered Privacy Shield organization refuses to comply with a self-regulatory or government body's final determination regarding its practices or that regulator determines the organization's frequent compliance failures render its self-reported compliance claims unreliable. If this occurs, the organization must promptly notify the DoC or face potential liability under the False Statements Act (18 U.S.C. § 1001).

Under the Privacy Shield program, the DoC expects to maintain two separate lists identifying organizations with:

Safe Harbor-certified organizations must make several important changes before relying on the Privacy Shield Framework, including:

An organization's personal information transfer practices should comply with the new Privacy Shield requirements as soon as possible once they go into effect, preferably within the first two months, but in any case no later than nine months after Privacy Shield Framework certification. During the interim period, organizations must comply by adhering to the Notice and Choice Principles and confirming that any agent receiving transferred personal information must provide at least the same level of protection that the Principles require.

The Directive recognizes several alternative ways to transfer personal information to the US using tools, such as:

Importantly, many DPAs often do not consider employee consent valid because of the employment relationship's unequal nature. As a result, organizations should not assume an employee's consent authorizes the transfer of their personal information.

Some EU DPA statements made after the Schrems decision generated concern that they may decide to suspend US transfers using SCCs or BCRs for the same reasons relating to mass surveillance and US government access that the ECJ used to invalidate the Safe Harbor Framework. To address these concerns, the WP29 announced that it plans to evaluate the Schrems decision's impact on these alternative data transfer mechanisms at its April 12-13, 2016 plenary meeting.

However, while the ECJ held that national DPAs hearing a claim may examine whether a specific data transfer under SCCs or BCRs complies with the Directive's requirements, the Schrems decision confirmed that only the ECJ – not national DPAs or courts – can strike down the EC's general adequacy decisions. Unless and until this occurs, EC decisions still bind national courts and DPAs. The EC reiterated this position by stating that national DPAs are, in principle, under the obligation to accept the SCCs and "may not refuse the transfer of data to a third country on the sole basis that these SCCs do not offer sufficient safeguards."

The US government directly addressed this concern in its February 29, 2016 Privacy Shield documents. The US statements extended the Privacy Shield surveillance commitments to all EU personal information transfers, regardless of the mechanism used. Similarly, the EC's draft adequacy decision clarified it reviewed US legal protections that applied generally, not just to Privacy Shield data transfers. The EC's draft adequacy decision explicitly states that those safeguards apply to all EU personal information transferred to the US for commercial purposes. This development should make it harder for EU regulators or potential plaintiffs to argue that SCCs and BCRs allegedly fail to meet the ECJ's Schrems adequacy test.

The Privacy Shield Framework also contains additional requirements unrelated to government access that exceed current SCC or BCR requirements in several respects. The EC may view those obligations as essential and require future SCCs or BCRs to follow them. It remains possible that the EC may also restrict transfers to other significant trading partners, such as India, Brazil, and Japan, unless they provide similar government access and surveillance assurances.

Storing personal information in an EU data center does not change the analysis if someone from the US or another country outside of the EEA can access that personal information. Remote access to the personal information equates to a transfer. As a result, if one IT person or one HR person from the US views or uses personal information stored in an EU data center, then a cross-border data transfer requiring a cross-border transfer mechanism occurs.

In December 2015, the European Parliament (EP) and the Council of the European Union reached an informal agreement on a new General Data Protection Regulation (GDPR) that will update and replace the current EU Privacy Directive. The EP expects the GDPR's formal adoption to occur in 2016, with its provisions becoming effective two years after adoption, in 2018.

The GDPR contains several important changes affecting cross-border transfers. For example, the current EU Privacy Directive does not directly establish BCR requirements. Rather, national DPAs authorize them using the WP29's 2003 BCR Working Documents series to provide guidance on expected requirements and adequacy assessment criteria. The GDPR now explicitly includes BCRs as a data transfer tool and codifies the WP29's criteria, which should streamline the authorization procedure.

To provide organizations with more flexibility, the GDPR also adds several new data transfer options, including:

The GDRP maintained the current Directive's cross-border transfer exceptions, including consent and contractual necessity, demonstrating their continued relevance and validity. The GDPR also provides that a data controller's or processor's legitimate interest may, under limited circumstances, justify a data transfer.

Importantly for US businesses, the new GDPR expands the EU's data protection jurisdictional scope. US organizations must comply with the GDPR's requirements, even if they have no physical EU presence, if they:

Those US organizations must also appoint a representative in the EU and follow EU data transfer rules.