EU, US agree new 'privacy shield' for data transfers

The European Union and the US have agreed on a new framework for protecting the privacy of personal data passed by companies between the two territories, the European Commission announced. To be known as the EU-US Privacy Shield, the agreement comes on the deadline of 02 February set by EU privacy regulators to reach an agreement. 

EU regulators said previously that without a new political agreement, they would start enforcing the court ban on the previous 'safe harbour' designation for the US. This was found by the EU court to not include enough safeguards to protect the privacy of EU citizens or offer them legal redress if their data was misused. Since then businesses have operated in legal uncertainty about whether they could still transfer data on EU customers to the US. 

The new arrangement will provide stronger obligations on companies in the US to protect the personal data of Europeans. US companies wishing to import personal data from Europe will need to commit to "robust obligations" on how personal data is processed and individual rights are guaranteed. The US Department of Commerce will monitor that companies publish their commitments, which makes them enforceable under US law by the Federal Trade Commission. In addition, any company handling human resources data from Europe has to commit to comply with decisions by European data protection authorities.

The US also committed to ensuring that American authorities, such as law enforcement and national security forces, have access to personal data transferred from the EU only under clear conditions, when necessary and proportionate. The US ruled out indiscriminate mass surveillance on the personal data transferred to the US. To regularly monitor the functioning of the arrangement, the EC and US Department of Commerce will conduct an annual joint review, which will also include the issue of national security access. National intelligence experts from the US and European privacy regulators will be invited to participate in the review. 

Europeans who suspect their data may have been misused in the US will be able to file complaints to a dedicated new ombudsperson. Companies handling the data will face deadlines to reply to complaints, and European regulators can refer complaints to the Department of Commerce and the Federal Trade Commission. In addition, alternative dispute resolution will be free of charge. The new ombudsperson will focus on complaints about possible access by national intelligence authorities.

The agreement is still subject to a number of consultations before it is confirmed. European Commissioners Andrus Ansip and Vera Jourova will prepare a draft "adequacy decision" in the coming weeks. After obtaining the advice of the Article 29 Working Party, which unites EU privacy regulators, and consulting a committee of representatives of EU states, the decision will be subject to clearance by the full European Commission. In the meantime, the US will make the necessary preparations to put in place the new framework, monitoring mechanisms and ombudsman.