According to a press release of the Data Protection Supervisory Authority in the Land Mecklenburg Vorpommern of November 3, German supervisory authorities have randomly selected 500 companies in Germany and sent them requests for information on their international data transfers. The German supervisory authorities are undertaking this coordinated action in order to increase awareness among companies of the need to ensure data privacy compliance of international data transfers.
In the 1969 film Butch Cassidy and the Sundance Kid, after Butch and Sundance rob Union Pacific Railroad (“Union Pacific”) the first time, Union Pacific employs a stronger safe. After Butch and Sundance rob Union Pacific a second time, Union Pacific forgoes the safe and hires a posse of unrelenting gunmen, hell bent on capturing and/or killing the duo. The posse ultimately forces Butch and Sundance to flee to Bolivia—where they resume their bank-robbing antics. Ultimately, it takes the Bolivian army to stop them. In their case, albeit fictional, the active deterrent (the posse) was more effective at protecting Union Pacific’s money than the passive deterrent (the safe), in part, because Butch and Sundance were highly-motivated actors.
Data breach notification requirements are going global. By spring 2018, companies operating in the European Union must comply with the new General Data Protection Regulation’s (GDPR) data breach notification requirements and the Network and Information Security (NIS) Directive’s security incident notification requirements. Stricter and more far-reaching notification obligations underscore the importance of establishing a proactive Security Incident Response Policy to analyze potential legal obligations and prepare to respond to incidents long before they occur.
Happy U.S. National Cybersecurity Awareness Month! One year ago, in recognition of the Department of Homeland Security’s annual campaign to raise awareness about cybersecurity, Orrick’s Cybersecurity & Data Privacy Group launched its award winning blog Trust Anchor.
Almost daily we hear news about data breaches, cybersecurity and privacy enforcement proceedings, litigation, and new laws and regulations. Trust Anchor covers it all: recent cases, legislative and regulatory developments, emerging compliance standards and best practices for cybersecurity and privacy risk management, insurance trends and more! But, we don’t just report on these events, we highlight key takeaways and what these developments mean for you.
On September 12, 2016, the Data Protection Authority of the German Federal State of North Rhine-Westphalia (“DPA NRW”) became one of the first EU data protection authorities to issue guidance on the implementation of the Privacy Shield. Although the guidance is primarily directed at German companies that engage U.S. providers (any third party service providers), U.S. providers should understand the guidance to better understand what German and EU customers may ask of them in addition to EU/U.S. Privacy Shield certification.
The DPA NRW raised the following issues that U.S. companies should consider:
1. Privacy Shield Alone May Not Be Sufficient For Transfers of Personal Data
Pursuant to the guidance, European companies considering transfers of personal data abroad must make a two-step assessment of data privacy compliance.
First, there must be a statutory basis for the transfer that is consistent with the local law of the concerned EU Member State, and as of May 2018, also with the EU General Data Protection Regulation. Second, the personal data held by EU companies should only be transferred to countries with an adequately high level of data protection comparable to the protection in the EU.
Privacy Shield, however, only addresses the latter. More specifically, the EU Commission’s adequacy decision of July 12, 2016 held that U.S. companies certified under the Privacy Shield provide an adequate level of protection.
Practically, what does this mean? In addition to the Privacy Shield certification, U.S. companies may need to enter into a data processing agreement with their EU partner that satisfies the relevant EU Member State statutory provisions that apply to data processing agreements. One example of such statutory provisions is Section 11 of the German Federal Data Protection Act, which contains fairly detailed requirements on the content of data processing agreements. In particular, it requires both parties to agree on rather specific technical and organizational measures that the processor has implemented to protect the security of the data to be processed.
2. Data Controllers Transferring Personal Data under the Privacy Shield Have Additional Duties
Under the guidance, even if a U.S. company is Privacy Shield certified, data controllers are still responsible for independently verifying that data privacy protections are upheld. That means that before transferring personal data to a Privacy Shield certified U.S. company the data controllers must confirm that:
- the Privacy Shield certification actually exists;
- the Privacy Shield certification is up to date (the certification has to be renewed annually); and
- the personal data the data controller intends to transfer is covered by the certification.
Thus, U.S. companies should expect that data controllers will ask the U.S. company questions regarding these points, and likely require the U.S. company to attest that it complies with its privacy obligations with respect to the concerned data subjects. For verification of the status of a Privacy Shield certification, the U.S. Department of Commerce keeps and updates a list of certified companies https://www.privacyshield.gov/list.
For U.S. companies that are using the nine month grace period for compliance with the onward transfer principle of the Privacy Shield, the guidance indicates that the EU data controller should have the U.S. company confirm when it has completed compliance with the onward transfer principle. For U.S. companies, this will underscore the importance of reviewing, and where necessary updating, vendor and service provider contracts to ensure compliance with the Privacy Shield’s onward transfer principle by, among other things, contractually restricting the vendor or service provider’s data processing activities and requiring protection consistent with the Privacy Shield Principles.
3. Employee Data is Special
The Privacy Shield contains special provisions regarding transfers of employee data. If the Privacy Shield certification covers employee data, the company must agree to cooperate and comply with the EU DPAs with respect to such data. This means that the use of such data will still remain subject to EU law, and complaints from data subjects about the use of the data will be adjudicated by the EU DPAs. In addition, the following principles must also be followed by the EU companies transferring employee data to the United States:
- The Privacy Shield Principle of choice may be impacted by generally applicable regulations from EU Member States that do not allow for the continued processing of employee data for purposes other than the purpose for which they were collected. EU data controllers (e.g. in general, the employing entities) may further restrict U.S. companies from such uses and require contractual restrictions.
- U.S. companies and/or the data transferring EU entity (employer) need to respect an employee’s exercise of his/her right of choice against processing their personal data and must not disadvantage the employee in any way.
- If specific protection for employee data is needed, appropriate measures have to be taken, e.g. pseudonymization or anonymization of data should be considered.
4. Privacy Shield May Not Be a Long Term Solution.
Despite raising various concerns about the EU/U.S. Privacy Shield, the DPA NRW agreed to give the program one year to address those concerns. After this initial year, the Article 29 Working Party plans to review whether its concerns have been addressed, and if the Privacy Shield is effective and functioning. Depending on the outcome of this annual assessment, the DPA NRW reserves the right to reevaluate and potentially stop data transfers under the Privacy Shield. Accordingly, U.S. companies relying on the Privacy Shield should carefully weigh the uncertainty it offers as a long term solution.
At the same time, the DPA NRW guidance points out that the outcome of this assessment will also have an impact on other methods of transatlantic data flows such as binding corporate rules and EU model contractual clauses which are currently likewise under scrutiny.
For more details on the Privacy Shield, or for help exploring whether it is appropriate for your company, please contact any member of Orrick’s Cybersecurity and Privacy team.
As of, August 1st, 2016, U.S. companies can now join the Safe Harbor successor EU-U.S. Privacy Shield (the “Privacy Shield”) for personal data transfers from the EU to the U.S.
This post gives a high level summary of what companies should consider with the Privacy Shield.
On July 12, 2016, the European Commission (the “Commission”) formally adopted the adequacy decision necessary to implement the Privacy Shield. This means that transfers of personal data from the EU to the U.S. that are made pursuant to the Privacy Shield’s requirements are lawful under EU law. The Privacy Shield replaces the EU-U.S. Safe Harbor Framework, which was invalidated by the Court of Justice of the European Union (“CJEU”) on October 6, 2015.
On July 6, 2016, the European Parliament passed the Network and Information Security (“NIS”) Directive, over three years after the initial draft was proposed. The Directive will enter into force in August 2016. EU Member States will then have 21 months to transpose the Directive into their national laws and 6 additional months to identify the operators of certain essential services that are subject to the Directive’s requirements.
After receiving the approval of the EU Member States, through the Article 31 Committee, last Friday, the European Commission has today, July 12th, 2016, formally adopted the Adequacy Decision necessary to implement the EU-U.S. Privacy Shield (the Decision).
The Decision will be notified to Member States today and, as such, will be effective immediately.
The adoption process had stalled in recent months due to ongoing concerns about the access to personal data by public authorities in the U.S. You can read about some of these concerns in our previous blog post.
The European Commission has received further commitments from the U.S. and has agreed clarifications and improvements on the bulk collection of data, strengthening the Ombudsperson mechanism and more explicit obligations on companies as regards limits on retention and onward transfers. Those commitments and clarifications have been sufficient to allay the EU member states, at least for now.
The Privacy Shield is subject to an annual review mechanism.
Today the EU-U.S. Privacy Shield was approved by the EU Member States, which sets the stage for the European Commission to grant final approval to the Privacy Shield as a basis for EU-U.S. transfers of personal data.
This development follows criticisms of the Privacy Shield this past April from the Article 29 Working Party, an advisory group comprised of the EU privacy regulators. We summarized the primary criticisms in a prior blog post. The Working Party was responding to the draft adequacy decision that was released by the European Commission on February 29, 2016, which we summarized here. The revisions to the Privacy Shield are intended to address the criticisms of the Working Party but it is not yet clear if the criticisms have been fully reflected.
Orrick Attorneys Aravind Swaminathan, Kolvin Stone and Christian Schröder recently discussed how impending changes to EU data privacy laws will fundamentally change how European companies respond in the face of a cyber attack or data breach. The article examines the cyber threat landscape and suggests how EU companies should assemble the right individuals into an incident response team for dealing with a data breach. Drawing on their experience managing client data breaches in the United States, the authors provide concrete strategies for EU companies to deal with a data breach—before, during, and after the event. For more on how to prepare for the impending changes to EU data privacy laws, click here.