US-EU Safe Harbor Deadline Passes Without A New Data Transfer Deal

According to The New York Times, United States (US) and European Union (EU) officials were unable to reach an agreement on an updated International Safe Harbor agreement before the January 31st deadline. The agreement covered how digital data (i.e. social media content, financial data, etc..) could be transferred between the continents.

The Safe Harbor Agreement that was implemented in 2000 between the US and EU contained principles that allowed companies (i.e. tech companies and other multi-national companies) to comply with EU data protection laws when moving data from Europe to the United States.  US companies that process and/or store individuals' data may self certify that they adhere to 7 principles that comply with the EU's data protection laws.

The 7 principles include:  notice, choice, onward transfer, security, data integrity, access, and enforcement.  The initial Safe Harbor agreement was meant to be an interim agreement; however, it lasted approximately 15 years.  A couple of years ago, EU and US regulators began negotiating an updated agreement to take into account how technology has changed over the years. Last October, before a new agreement was finalized, the current one was invalidated by the European Court of Justice via a compliant from Austrian privacy advocate Max Schrems.  Mr. Schrems gained publicity several years ago for his privacy advocacy that was highlighted in the documentary Terms and Conditions May Apply when he demonstrated how much data Facebook was collecting about each of its EU users.  

Now that the deadline has passed, what comes next?  According to The New York Times, the sides still have a lot of details to work out. Therefore, until a formal announcement is made it is premature to speculate on the next step.  As I told LAW360 the other day, businesses need certainty regarding transatlantic data transfers and if an agreement is not forthcoming companies will need a Plan B. 

If consumer groups file complaints as The New York Times indicated may occur, these issues may need to be adjudicated via the courts. At this point, uncertainty is the status quo and this may create unintended service disruptions for companies that transfer digital data between the continents. My hope is that an agreement is reached sooner rather than later that is flexible enough to account for future technology changes.  

Copyright 2016 by The Law Office of Bradley S. Shear, LLC All rights reserved.

The EU's Push For Stronger Privacy Laws and Safe Harbor

Last week, the European Union took a step closer to enacting stronger digital privacy laws that will make it more challenging for companies to re-purpose the data they are collecting from their customers.  These new data protections would harmonize the privacy laws across the 28 members of the EU and stiffen the potential fines for violators up to 4% of a violator's global revenue.

The European Parliament and individual member governments still must pass the new proposals so it not certain that this is a done deal.  After all of the approvals have been obtained, the law may become effective within two years.

In general, I am in favor of strong industry self-regulation.  Unfortunately, this has not worked as hoped in the digital space.  Some companies are collecting massive amounts of personal information about their users and then utilizing the data for opaque secondary uses (i.e. selling the content to data brokers, psychological experiments, etc...).  Because of these non-transparent abuses, EU lawmakers felt it was time to act to reign in these practices.

Some positive aspects of these reforms provide users the right to know why they are being profiled, how they are being labeled, who is using their personal data, etc... This type of transparency will lead to greater accountability and hopefully lead to some companies changing their troubling privacy policies and data usage practices.  While it may be wishful thinking, I am optimistic that these new laws will convince U.S. law makers and regulators to push for some of these much needed reforms because there is little transparency in the data collection and usage industry.  

This latest push for stronger EU privacy laws coincides with the negotiation for an updated Safe Harbor data transfer agreement which may soon replace the previous one that was invalidated earlier this year.  In our digital dependent economy, participants need to be able to transfer data between continents in a timely fashion. Therefore, I am cautiously optimistic that an updated Safe Harbor Agreement will be finalized early in the new year because in our interconnected world it is imperative for businesses to have legal certainty.  

Copyright 2015 by The Law Office of Bradley S. Shear, LLC All rights reserved.