Cynthia J. Rich
Privacy + Data Security
The EU regulators’ recent report on the second annual review of the EU-US Privacy Shield provides some valuable compliance reminders for organizations that have certified or intend to certify to the Privacy Shield program. The report, which mainly focuses on the EU regulators’ ongoing concerns about the US government’s access to personal data and their desire to see more substantive certification reviews by the US government, details oversight efforts currently being undertaken by the Department of Commerce (Commerce) and the Federal Trade Commission (FTC). As the report makes clear, both Commerce and the FTC have significantly increased their oversight and enforcement of the Privacy Shield program. The report provides a useful roadmap for organizations to avoid getting caught in the US government’s enforcement crosshairs.
This alert highlights some of the key findings of the European Data Protection Board’s Report on the Second Annual Review of the EU-US Privacy Shield (EDPB Report) with respect to the commercial functioning of the Privacy Shield, reviews the US government’s current Privacy Shield compliance oversight initiatives, and provides a list of compliance tips for Privacy Shield-certified organizations.
THE EDPB REPORT
Commercial Aspects of the Privacy Shield While commending the actions taken by US authorities to implement the Privacy Shield program, the European Data Protection Board (EDPB) expressed its ongoing concerns about the commercial aspects of the Privacy Shield.
The EDPB welcomed Commerce’s new guidance (FAQs) on the Accountability for Onward Transfer Principle and Processor obligations under the Privacy Shield which discusses the need for contracts when transferring personal data to controllers and agents and clarifies how a Privacy Shield-certified Processor should comply with the Principles. It also laid down a marker that it expects Commerce to issue further guidance on the Notice and Choice Principles (e.g., how individuals can opt-out of processing for new purposes and the timing of the provision of notices) and a clarification of the scope of access rights. With respect to the access issue, the EDPB is concerned about access rights being limited to stored data.
The EDPB expressed dissatisfaction with Commerce’s certification and re-certification process because it focuses more on the formal rather than substantive requirements. Specifically, the checks conducted by Commerce do not examine the substance of the principles, such as, for example, checking to see if the data transferred to a US controller are necessary and proportionate to the stated purpose. Instead, for example, Commerce reviews certifications and re-certifications to ensure that the companies have registered with an independent recourse mechanism, paid their contribution to the Arbitral Fund, comply with the Privacy Shield Supplemental Principle 6 (Access), provided complete and consistent certification information, and addressed the 13 required elements in their privacy notices and policies.
To prevent organizations from naming non-US subsidiaries as entities covered by the Privacy Shield, Commerce has produced more internal guidance for reviewing applications in order to identify foreign entities.
The EDPB welcomed the increased compliance oversight and supervision by US authorities but stated that it would like to see Commerce undertake more substantive checks, particularly with regard to onward transfers. In particular, it would like Commerce to make use of its ability to request copies of relevant privacy provisions of companies’ contracts with agents.
Privacy Shield Compliance Oversight by the US Government The EDPB highlighted the following compliance oversight and supervision measures taken by Commerce, the FTC, and the Department of Transportation (DoT):
PRIVACY SHIELD COMPLIANCE TIPS
The EDPB Report provides a useful roadmap for organizations to avoid getting caught in the US government’s enforcement crosshairs. To reduce the chances that an organization’s certification will be rejected, delayed, marked as “inactive,” and/or referred to the FTC for enforcement review and action, organizations should take the following steps:
At The Time of Certification or Annual Re-certification
©1996-2019 Morrison & Foerster LLP. All rights reserved.