May 19, 2019

May 17, 2019

Subscribe to Latest Legal News and Analysis

May 16, 2019

Subscribe to Latest Legal News and Analysis

Farewell ‘Safe Harbor,’ Hello ‘Privacy Shield’: Europe and U.S. Agree on New Rules for Transatlantic Data Transfer

After intense negotiations, and after the official deadline had passed on Sunday, 31 January 2016, the United States and the European Union have finally agreed on a new set of rules—the “EU-U.S. Privacy Shield”—for data transfers across the Atlantic. The Privacy Shield replaces the old Safe Harbor agreement, which was struck down by the European Court of Justice (ECJ) in October 2015. Critics already comment that the Privacy Shield will share Safe Harbor’s fate and will be declared invalid by the ECJ; nevertheless, until such a decision exists, the Privacy Shield should give companies legal security when transferring data to the United States.

While a text of the new agreement is not yet published, European Commissioner Věra Jourvá stated that the Privacy Shield should be in place in the next few weeks. According to a press release from the European Commission, the new arrangement

…will provide stronger obligations on companies in the U.S. to protect the personal data of Europeans and stronger monitoring and enforcement by the U.S. Department of Commerce and Federal Trade Commission (FTC), including through increased cooperation with European Data Protection Authorities. The new arrangement includes commitments by the U.S. that possibilities under U.S. law for public authorities to access personal data transferred under the new arrangement will be subject to clear conditions, limitations and oversight, preventing generalized access. Europeans will have the possibility to raise any enquiry or complaint in this context with a dedicated new Ombudsperson.

One of the most known critics of the U.S. data processing practices and initiator of the ECJ Safe Harbor decision, Austrian Max Schrems, already reacted to the news. Schrems stated on social media that the ECJ Safe Harbor decision explicitly says that “generalized access to content of communications” by intelligence agencies violates the fundamental right to respect for privacy. Commissioner Jourová, referring to the Privacy Shield, stated that “generalized access … may happen in very rare cases”—which could be viewed as contradictory to the ECJ decision. Critics also argue that an informal commitment by the United States during negotiations with the European Union is not something on which European citizens could base lawsuits in the United States if their data is transferred or used illegally.

The European Commission will now prepare a draft text for the Privacy Shield, which still must be ratified by the Member States. The EU Parliament will also review the draft text. In the meantime, the United States will make the necessary preparations to put in place the new framework, monitoring mechanisms and new ombudsperson.

© 2019 McDermott Will & Emery

TRENDING LEGAL ANALYSIS


About this Author

Dr. Paul Melot de Beauregard, Labor Employment Attorney McDermott Will, law firm
Partner

Dr. Paul Melot de Beauregard is a partner in the law firm of McDermott Will & Emery Rechtsanwälte Steuerberater LLP, based in its Munich office. He is specialised in labour and employment law and is head of McDermott’s employment practice in Munich. His practice covers the entire spectrum of national and international labour and employment law. His special focus is on restructuring, close-downs, transactions and negotiations with works councils. Additionally, he also advises on benefits and service agreements with board members, managing directors and senior...

+498912712121
Maximilian Baur, McDermott Will Emery, Munich, Employment matters Lawyer, European Union Regulation Attorney
Associate

Maximilian Baur is an associate in the law firm of McDermott Will & Emery Rechtsanwälte Steuerberater LLP based in its Munich office. He is specialized in labor and employment law.

Maximilian studied at the University of Passau and attended his legal clerkship at the Higher Regional Court of Munich.

His key practice covers the entire field of individual and collective employment law, service, and termination agreements as well employment-related litigation. In addition, Maximilian advises companies on all aspects of data privacy law.

Maximilian is admitted to the German Bar. He is fluent in German and English.

49 89 12712 332