New EU-U.S. Data Transfer Pact May Become Obsolete: EU Data Chief

By Daniel R. Stoller

U.S. companies that rely on an EU-U.S. pact to transfer personal EU data to the U.S. may eventually find it has outgrown its usefulness, a top EU data protection official said.

If companies in the EU and U.S. are complying with the General Data Protection Regulation (GDPR), the need for an existing data transfer pact—the Privacy Shield—will diminish, European Data Protection Supervisor Giovanni Buttarelli told Bloomberg Law on the sidelines of the International Association of Privacy Professionals’ Global Privacy Summit in Washington March 27.

The Privacy Shield is a cross-border data transfer pact hammered out between the U.S. and EU that allows U.S. companies to transfer data from the EU to the U.S. without running afoul of European privacy law. Large data collectors such as Facebook Inc., 23andMe Inc., and Twitter Inc. are among the 2,766 U.S. Privacy Shield companies that have self-certified their compliance with EU-approved privacy principles to the U.S. Commerce Department.

The Privacy Shield is used often by a range of U.S. industries, such as the retail, health-care, and legal services sectors, that need to move EU data outside of the bloc for employment or business purposes.

The Privacy Shield and its precursor, the U.S.-EU Safe Harbor, was always a “short-term solution” to EU to U.S. data transfers, because EU data protections are expanding under GDPR, Buttarelli said. The Privacy Shield and Safe Harbor were tailored to respond to EU data protections that existed under the 1995 Data Protection Directive, which the GDPR updates and replaces, he said.

Any company that does business in the EU will have to comply with the GDPR by May 25. The EU-wide regulation will require companies that handle or process EU data to increase transparency of data processing, provide clearer consent provisions, and give users the ability to move their data, among other enhanced data privacy measures.

Since companies that want to do business with the EU will have to follow the GDPR’s more stringent data protection rules, the Privacy Shield may no longer have a purpose to serve, Buttarelli said.

Before transferring any data under the Privacy Shield, companies would have to comply with principles under the GDPR, Buttarelli said. That, in effect, gives the data transfer pact “much less importance,” he said.

To contact the reporter on this story: Daniel R. Stoller in Washington at dstoller@bloomberglaw.com

To contact the editor responsible for this story: Barbara Yuill at byuill@bloomberglaw.com

Copyright © 2018 The Bureau of National Affairs, Inc. All Rights Reserved.