EU-US Privacy Shield update. What does Privacy Shield mean for my business?

What's happened, and what does it mean for my business?

So, Safe Harbor 2.0 has arrived and it's called the EU-US Privacy Shield. I suspect that it will be regularly shortened to the Privacy Shield, Shield or #privacyshield!

Every thing's back to normal then? 'Marketers can reinstate transfers of data between the EU and the US'? [ED: like we ever stopped]. No, not quite; the proverbial 'plus size lady has not yet sung'.

The new data transfer era has a brand name, political will, and some important new US legislation (Judicial Redress), but that's about it for substance!

The EU Commission has promised to deliver the full text of the agreement by the end of February 2016, and the Article 29 Working Party has reiterated the four essential guarantees for intelligence activities, which have to be met by Privacy Shield. No guarantee this has been achieved; yet.

Only when the European Court of Justice rules on the Shield, will we know if the transfer of data has recovered back to pre-Shrems days. Until then, marketers will probably sleep a 'tad' easier at night, but do expect a few more nervous moments.

What should I do?

What you've been doing for the last few months!  'Actively investigating and seeking to instigate' Binding Corporate Rules, Model Contracts (which the German Authorities said were also insufficient to meet legal requirements), or other consent-based models and hoping the dust settles before either an individual or a data protection authority (DPA) questions the validity of your US data transfer protocol.

Until an ECJ ruling on Privacy Shield has been received (March 2016?) all of us who continue to transfer data are clearly still at risk, however as there seems little appetite amongst the DPAs for punitive action, this risk is arguably acceptable.

<h4>Further reading</h4>

-For a great recap of how we got to this point, including some insight into the negotiations; have a read of Zoya Sheftalocich's article here