This Month Only! >> $20 off and a FREE SHRM tote with your membership and code TOTE2018!
Sign up for free email newsletters and get more SHRM content delivered to your inbox.
Is your employee handbook keeping up with the changing world of work? With SHRM's Employee Handbook Builder get peace of mind that your handbook is up-to-date.
Build competencies, establish credibility and advance your career—while earning PDCs—at SHRM Seminars in 12 cities across the U.S. this spring.
#SHRM18 will expand your perspective – on your organization, on your career, and on the way you approach HR. Join us in Chicago June 17-20, 2018
Members may download one copy of our sample forms and templates for your personal use within your organization. Please note that all such forms and policies should be reviewed by your legal counsel for compliance with applicable law, and should be modified to suit your organization’s culture, industry, and practices. Neither members nor non-members may reproduce such samples in any other way (e.g., to republish in a book or use for a commercial purpose) without SHRM’s permission. To request permission for specific items, click on the “reuse permissions” button on the page where you find the item.
The United States and the European Union are negotiating a new data transfer agreement to replace the “Safe Harbor” agreement that the European Court of Justice invalidated in Schrems v. Data Protection Commissioner. The Article 29 Working Party (comprised of representatives of European Data Protection Authorities (DPAs) and the European Commission) has given negotiators until Jan. 31, 2016, to create a new cross-border data sharing framework, after which the DPA’s may begin to take enforcement action against companies who do not have a transfer mechanism in place that complies with the EU’s privacy laws and regulations.
In Schrems v. Data Protection Commissioner, Maximillian Schrems, an Austrian national, filed a complaint with the Irish Data Protection Commissioner (Irish DPC) asking it to prohibit Facebook Ireland Ltd. from transferring his personal data to Facebook Inc. in the United States. Schrems asserted that U.S. law and practice did not ensure “adequate protection” -- the key measure of privacy protection under the EU Directive 95/46 -- of his personal data, based in part on the revelations made by Edward Snowden regarding surveillance activities by U.S. intelligence services. The Irish DPC rejected Schrems’ complaint as unfounded because there was no evidence that his personal data had been accessed. Further, the Irish DPC determined that the Safe Harbor agreement provided that an adequate level of protection existed for any personal data transferred to the U.S. Schrems challenged the ruling before the European Court of Justice.
The European high court struck down the Safe Harbor agreement, in part, because the U.S. government retains the right to access data in the U.S. for national security and law enforcement purposes and does not permit EU citizens to make complaints regarding the misuse of their personal data. The decision authorizes each DPA to consider individual claims asserting that the transfer of personal data from the EU to other countries violates EU privacy laws.
Negotiations for New Safe Harbor Agreement
Prior to, and now with increased urgency following the decision, U.S. and EU negotiators have been negotiating to develop solutions enabling data transfers to the U.S., while protecting the personal data of European citizens from perceived “massive and indiscriminate surveillance.” To address the high court’s concerns that EU citizens have no avenues for redress regarding any misuse of personal data, the negotiators are examining ways to provide mechanisms for EU citizens to make complaints directly to the national DPAs. Under the Safe Harbor, a similar procedure existed for complaints regarding human resources data, and U.S. companies handling such data were required to cooperate with DPAs regarding any complaints.
However, there are currently no complaint mechanisms in the U.S. to address claims by EU citizens regarding the misuse of their personal data. While the U.S. Federal Trade Commission monitors companies’ compliance with the Safe Harbor, it does not address individual complaints. The U.S. and EU negotiators have not yet reached an agreement regarding cooperation between the European privacy regulators and the FTC in the U.S. that would avoid giving the EU extraterritorial powers. Further, legislation passed by the U.S. House of Representatives, the “Judicial Redress Act of 2015” (H.R. 1428), which would provide citizens of certain foreign countries with the ability to bring suit in federal court for Privacy Act violations, has not been passed by the Senate.
If no agreement is reached between the U.S. and the EU, companies that previously relied on the Safe Harbor will need to develop alternate methods for complying with EU’s data privacy laws or be exposed to hefty non-compliance fines.
Next Steps for Companies
For those companies reliant on Safe Harbor as a mechanism to transfer employee data out of the EU, it is difficult to determine the path forward before the outcome of the current negotiations. In the meantime, it is prudent to assess the feasibility of other transfer mechanisms such as Standard Contractual Clauses or Binding Corporate Rules, as well as other means of handling data which reduce the need to transfer out of the EU.
John Sander is an attorney in the New York City office of Jackson Lewis. Republished with permission. © 2016 Jackson Lewis. All rights reserved.
You have successfully saved this page as a bookmark.
Please confirm that you want to proceed with deleting bookmark.
You have successfully removed bookmark.
Please log in as a SHRM member before saving bookmarks.
Please sign in as a SHRM member before saving bookmarks.
Please purchase a SHRM membership before saving bookmarks.
An error has occurred
Recommended for you
SHRM Member Discounts Program
SHRM’s HR Vendor Directory contains over 10,000 companies