Safe Harbour Successor to 'Shield' EU Citizens' Privacy

Last week, the European Commission and the US agreed a new framework for the transfer of data between the two, known as the EU-US Privacy Shield. Under this, US companies and government agencies will have new obligations to guarantee protection for personal data.

In a statement, the EU said the new framework 'will protect the fundamental rights of Europeans where their data is transferred to the United States and ensure legal certainty for businesses'. The deal follows the decision on 6th October by the Court of Justice that the previously existing 'Safe Harbour' arrangement was invalid, and had not ensured a sufficient level of data protection as required by EU law. Since then, businesses have to an extent been working in limbo, although told to continue abiding by Safe Harbour principles until a new framework was finally agreed.

The new deal - framed in the aftermath of the revelations of Edward Snowden about mass surveillance by US government agency the NSA - combines stronger obligations on US companies to protect the personal data of Europeans and stronger monitoring and enforcement by the US Department of Commerce and FTC. The latter includes increased co-operation with European Data Protection authorities, and requires that US public authorities needing to access such personal data do so under 'clear conditions, limitations and oversight, preventing generalised access'. A dedicated Ombudsman will review complaints from individuals over the way this has been applied to their personal data.

Under the framework, US companies will be required to publish their commitments, which will then be enforceable under U.S. law, monitored by the Department of Commerce and FTC. In addition, any company handling human resources data from Europe must commit to comply with decisions by European DPAs.

EU Vice-President and former Prime Minister of Estonia Andrus Ansip said of the framework: 'Our people can be sure that their personal data is fully protected. Our businesses, especially the smallest ones, have the legal certainty they need to develop their activities across the Atlantic. We have a duty to check and we will closely monitor the new arrangement to make sure it keeps delivering'. Ansip said the decision 'further strengthens our close partnership with the US' and concluded: 'We will work now to put it in place as soon as possible'.