July 11. 2016 — The Privacy Shield, a transatlantic agreement that would regulate data transfers between the EU and U.S., has been approved by EU member states as one of the last steps in its process to implementation.

According to Reuters, the agreement will be implemented by this week. Almost all EU member states approved the agreement, with Austria, Slovenia, Bulgaria and Croatia abstaining from the vote and Austria and Slovenia expressing concerns that the agreement does not go far enough to protect EU citizens' privacy.

In a statement released online, European Commission Andrus Ansip and the European Union's Commissioner for Justice, Consumers and Gender Equality Vera Jourov' declared, 'Today Member States have given their strong support to the EU-U.S. Privacy Shield, the renewed safe framework for transatlantic data flows. This paves the way for the formal adoption of the legal texts and for getting the EU-U.S. Privacy Shield up and running. The EU-U.S. Privacy Shield will ensure a high level of protection for individuals and legal certainty for business.'

Among other changes from the now-defunct Safe Harbor'(see, “Safe Harbor European Court Data Protection Ruling,” in the November 2015 issue of e-Commerce Law & Strategy), the Privacy Shield requires notifying an EU citizen when their personal information is being transferred or processed, creates more remedies and arbitration methods through which EU citizens can seek modification or deletion of their data or lodge a complaint and brings tougher binding sanctions against organizations who mishandle data.

'[Privacy Shield] imposes clear and strong obligations on companies handling the data and makes sure that these rules are followed and enforced in practice,' Ansip and Jourov' said. 'For the first time, the U.S. has given the EU written assurance that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms and has ruled out indiscriminate mass surveillance of European citizens' data. And last but not least the Privacy Shield protects fundamental rights and provides for several accessible and affordable redress mechanisms.'

The agreements approval comes after months of uncertainly following a rebuke of by the EU's Article 29 Working Party group. The group chided the agreement over its 'overall lack of clarity,' lacking enforcement, inadequate protections for EU citizen's rights and shortcomings in addressing mass data collected by U.S. governmental agencies.

EU and U.S. officials finalized changes to the agreement on the eve of the Brexit vote, agreeing to require companies to delete personal data that no longer serves its collection purpose and hold third-party processers to the same standards as Privacy Shield certified companies, according to The Wall Street Journal. The U.S. government also outlined how it would go about its bulk collection of data for security purposes and explained the safeguards it had in place that govern how data is handled in a letter to EU officials.

Lisa Sotto, head of the global privacy and cybersecurity practice at the international law firm of Hunton & Williams called the approval of Privacy Shield a win for global commerce and for EU privacy rights.

'The text of the new Privacy Shield clearly was carefully crafted to satisfy EU concerns about its predecessor regime's lack of rigor in key areas, such as the ability of U.S. law enforcement to access EU personal data, redress for EU residents, and the onward transfer of data to third parties,' she said.

'The length and depth of the negotiations leading to the final version of the Privacy Shield reflects careful consideration of the EU's concerns about personal data transferred from the EU to the US via the shield. This sort of rigorous negotiation and focus by both sides was necessary to be able to successfully fend off future attacks regarding the level of protection offered to EU personal data by the Shield,' she added.

Ricci Dipshan is the Deputy Editor of this newsletter's ALM sibling, Legaltech News.

Safe Harbor European Court Data Protection Ruling