news

Client Alert – PRIVACY SHIELD INVALIDATION: WHAT IT MEANS FOR YOU NOW

Jul 22, 2020
  • FisherBroyles News

American clients who are receiving personal information about European Union (‘EU’) residents (including having such information processed in an American data center or third party web hosting firm) or who are providing such EU information to someone else in America for the same purposes, together with UK or EU clients who transfer such personal data to the US, must take notice of the very recent decision of the European Court of Justice (‘ECJ’) to invalidate the Privacy Shield certification program.[1] (https://www.bbc.com/news/technology-53418898). Full text of Ruling below in footnote. This Alert is intended to provide some preliminary guidance as to short terms responses.

This program allowed those obtaining or providing such material to presumptively comply with EU privacy law if the recipient self-certified that it took specified steps to ensure the privacy of the data subjects. Several thousand companies availed themselves of the program and many contracts on which we have worked contemplated such personal information moving from the EU to the US relying on such certification.

An alternative to such certification which was at least provisionally validated by the ECJ is the use and incorporation into such contracts of ‘Standard Contractual Clauses (‘SCC’s)’ prescribed (to the letter) by EU authorities. Some contracts which we have seen expressly contemplated the invalidation of the Shield mechanism and require use of SCC’s in such event. Upon request, we will gladly provide the specific SCC language. Note, however, that it is not subject to negotiation by contractual parties.

All clients which are sharing or receiving EU personal information should proceed to utilize and comply with the SCC’s and require the same from pertinent vendors. If a contract already calls for use of SCC’s in the event of invalidation of the Shield mechanism, then no contract amendment is necessary, but reference should be made to the operational requirements of the SCC’s as the same are implemented. Where you are sharing such material with a third party under such a contract, you should discuss with the third party how they are doing their ‘cutover’.

If you are sharing such material under a contract which provides only for reliance upon the Shield, you should approach the other party to discuss this topic as well as a required contractual amendment. If you are the recipient of such material under a contract providing for Shield compliance, it is probable that you will be approached by the other party regarding use of SCC’s. If this is not the case, you should still familiarize yourself with the SCC’s and act in accordance with them.

We will revert with additional information as it becomes available. Even the SCC’s are not entirely free from doubt as to their validity in light of previously expressed concerns of EU authorities regarding US government surveillance and a variety of issues associated with activities of US intelligence agencies and law enforcement. To the extent that Congress and President Trump are willing and able to address proposed restrictions on such activity in the remainder of the Congressional session, it may cause (or at least permit) a change in approach by private clients.

Please do not hesitate to approach your FisherBroyles lead to discuss the best responses for you to the ECJ action.

For additional information, please contact any of the following: Kimberly Booher at kimberly.booher@fisherbroyles.com, Rory Graham at rory.graham@fisherbroyles.com, Martin B. Robins at martin.robins@fisherbroyles.com with any questions or more specific situations.

 

[1] http://curia.europa.eu/juris/document/document.jsf;jsessionid=5DFBDDBFADA7E999D1CDDA41E6E72B7F?text=&docid=228677&pageIndex=0&doclang=en&mode=req&dir=&occ=first&part=1&cid=9872582

About FisherBroyles, LLP

Founded in 2002, FisherBroyles, LLP is the first and world’s largest distributed law firm partnership. The Next Generation Law Firm® has grown to hundreds of partners in 23 offices globally. The FisherBroyles’ efficient and cost-effective Law Firm 2.0® model leverages talent and technology instead of unnecessary overhead that does not add value to our clients, all without sacrificing BigLaw quality. Visit our website at www.fisherbroyles.com to learn more about our firm’s unique approach and how we can best meet your legal needs.

These materials have been prepared for informational purposes only, are not legal advice, and under rules applicable to the professional conduct of attorneys in various jurisdictions may be considered advertising materials. This information is not intended to create an attorney-client or similar relationship. Whether you need legal services and which lawyer you select are important decisions that should not be based on these materials alone.

© 2020 FisherBroyles LLP