U.S.-EU Safe Harbor Replacement Viewed Positively

    Feb 10, 2016

    European Union (EU) and U.S. negotiators announced on February 2 that they reached an agreement in principle on a new privacy protection program that will allow the continued transfer of personal data out of Europe to the United States. The so-called “EU-U.S. Privacy Shield” will replace the U.S.-EU Safe Harbor framework that was invalidated by the European Court of Justice in October.

    The agreement in principle came five days after the Senate Judiciary Committee approved a bill (H.R. 1428) to grant EU citizens limited access to U.S. courts for the government misuse of their personal data transferred to the United States. Progress on that legislation, which is expected to be enacted in the next few weeks, was critical to resolving the negotiations to replace the Safe Harbor Program.

    While the details of the Privacy Shield still need to be written, the agreement in principle was met with significant support by policymakers in Washington.

    “I applaud the European Union and United States negotiators in reaching this important agreement, which is crucial to American business interests,” said Senator Orrin Hatch (R-Utah), who has been a strong advocate for American high tech companies.   

    “This historic agreement is a major achievement for privacy and for businesses on both sides of the Atlantic,” said U.S. Commerce Secretary Penny Pritzker. “It provides certainty that will help grow the digital economy by ensuring that thousands of European and American businesses and millions of individuals can continue to access services online.”

    “Our focus now turns to understanding the finer details and enforcement mechanisms of the new deal, which hopefully won’t temper today’s good news,” said Rep. Fred Upton (R-Mich.), chairman of the House Energy and Commerce Committee.

    According to the European Commission, the EU-US Privacy Shield will ensure that U.S. protections of European personal data will be equivalent to that provided in Europe. This would be achieved by, among other things, requiring companies to publish commitments setting out robust obligations on how personal data is processed and individual rights are guaranteed; requiring U.S. companies to comply with decisions of European data protection authorities; increasing monitoring and enforcement of U.S. companies by the U.S. Federal Trade Commission (FTC), including given European citizens the right to file complaints with the FTC; and limiting the application of U.S. law enforcement and intelligence access to the data of European citizens.

    FTC Chairwoman Edith Ramirez said the commission will be a strong enforcement agency.

    “Under the new agreement, the EU-U.S. Privacy Shield, the Federal Trade Commission will continue to prioritize enforcement of the framework as part of our broader commitment to protect consumers' personal information and privacy,” she said in an online statement. “We will continue to work closely with our European partners to ensure consumer privacy is protected on both sides of the Atlantic.”

    The agreement must navigate a number of difficult implementation steps before U.S. companies can feel confident that they have a sustainable path for data transfers out of the EU. The European Commission must prepare and adopt the new agreement after obtaining the advice of data protection officials from the 28 EU member states. In the United States, Congress must enact the Judicial Redress Act, and the administration will be setting up an ombudsman office in the U.S. State Department that would follow up on referrals from EU data protection authorities regarding cases involving law enforcement or national security access to data.

    The Washington Policy Brief is an online advisory that contains brief summaries of recent legislative and regulatory issues that may affect the records and information management profession. Further information about the issue is accessed by clicking on the link provided at the end of each summary.


    Want to sign up to receive an e-mail version of the Washington Policy Brief? It's free! Just tell us a little about yourself and you'll receive a monthly dose of the latest in legislation, regulation, and more.



    © 2017, ARMA International