Knowledge

Click here to read online.

A new set of regulations now governs the transfer of data between the US and Europe, in the wake of changes that followed an EU court case resulting from the 2013 Edward Snowden data leak case. Here, Rebecca McNulty, a senior associate with the Bedell Cristin law firm in Jersey, considers the new “EU-US Privacy Shield”, and whether, as some say, it might one day be successfully challenged, amid calls for something still more robust…

Year on year, we generate more data, use more electronic devices, and take advantage of the latest technological developments to transfer still more data.

As a result, the scope and significance of transatlantic data transfers have increased, but so too have the risks. And getting it wrong can be costly, both financially as well as reputationally.

Handling personal data appropriately and carefully, therefore, should be high on the list of any company’s priorities.

Global offshore finance centres such as Jersey and Guernsey, although not part of the European Union, nevertheless have to monitor developments within the EU, including in the rapidly evolving data protection sphere, to ensure they continue to meet international standards. And in this area, one of the latest developments to have emerged is the so-called “EU-US Privacy Shield”.

The Channel Islands and the EU
To best understand this privacy shield, we need to go back and look at the existing legal relationship between the Channel Islands and the EU. This relationship is enshrined in what is known as Protocol 3 of the UK’s Accession Treaty 1972, under which Jersey and Guernsey are part of the EU’s customs union.

What this means is that the two Channel Islands are essentially regarded as being within the EU’s Single Market for the purpose of trading in goods, but are regarded as “third countries”  in all other respects.

Both jurisdictions benefit from a close relationship with the EU, and as a result, they voluntarily implement appropriate EU legislation, or, where applicable, apply the international standards on which such legislation is based.

Laws are also in place representing the voluntary implementation of the European Data Protective Directive, which concerns the protection of the individual in respect of processing personal data, and the free movement of such data.

This European Data Protective Directive places restrictions on the transfer of data outside the European Economic Area (EEA), so that data may only be transferred to countries outside the EEA that can ensure an adequate level of protection for any personal data transferred. (There is no reason for this to change as a consequence of Brexit, by the way.)

As major international finance centres, both Jersey and Guernsey naturally have to meet the international “gold standard” in data protection. And in fact, they have been included among a number of non-EEA countries that the European Commission has certified as providing “adequate protection” for such data.

This ensures that personal data can flow to and from EU countries to third countries like Jersey and Guernsey, without further safeguards being necessary.

Safe Harbor not ‘safe’
The US, of course, isn’t part of the EU, and has its own set of data transfer rules.

It used to operate under what was known as the so-called “Safe Harbor arrangement”. That arrangement was declared invalid and non-compliant in October 2015 by the European Court of Justice, in a case known as “Schrems v Data Protection Commissioner”, which was sparked by the Edward Snowden revelations in 2013, of the US government’s global surveillance programmes.

The decision in Schrems left the world of transatlantic personal data transfers, at least temporarily, in a state of legal limbo.

One of the biggest issues with the Safe Harbor arrangement was the US government’s mass surveillance of data, revealed by Edward Snowden, which could be accessed and further processed by US authorities in a way that the EU regarded as incompatible with the grounds under which the data was originally collected, and the purpose for which it was transferred to the US.

The Privacy Shield
This brings us to the “Privacy Shield”. This is what has effectively replaced the Safe Harbor arrangement in overseeing the way data transfers are carried out across the Atlantic, between the US and EU member states, as well as non-EU jurisdictions like Jersey and Guernsey that are able to participate.

It was approved in July, and aims to reflect the requirements of the European Court of Justice in the Schrems case.

It is the result of a collaborative effort by the European Commission, European Data Protection Authorities, European Parliament, the EU member states themselves, and their US counterparts.

In the words of the US Department of Commerce, it was designed by that US government department and the European Commission to “provide companies on both sides of the Atlantic with a mechanism to comply with EU data protection requirements when transferring personal data from the European Union to the United States in support of transatlantic commerce”.

According to the US Department of Commerce, the Shield:

• provides a set of robust and enforceable protections for the personal data of EU individuals in the US;
• provides transparency regarding how participating companies use personal data, strong US government oversight, and increased cooperation with EU data protection authorities;
• offers EU individuals access to multiple avenues to address any concerns regarding participants’ compliance with the framework, including free dispute resolution;
• ensures a continuing level of protection when personal data is collected under the Shield and transferred to third parties; and
• makes it easier for EU individuals to understand and exercise their rights in the US.

Joining the Shield is voluntary, and requires that a US company self-certify to the US Department of Commerce that it commits to complying with the Shield’s requirements.

The self-certification process will involve a participating company confirming the company’s eligibility to participate in the Shield; developing a Shield compliant privacy policy statement; identifying the company’s independent recourse mechanism; ensuring a verification mechanism is in place to confirm compliance with the Shield; designating a contact within the company regarding the Shield and finally, reviewing the information required to self-certify and submitting it.

Long term solution or short term fix?
Concerns have been expressed over the self-certification process involved in signing up to the Shield. Specifically, questions are being asked about whether the Shield offers a long term solution to the gap left by the departure of the Safe Harbor arrangement, or whether it represents nothing more than a short-term fix.

The Safe Harbor arrangement also involved a self-certification process, critics note, and ultimately that arrangement proved not to be so “safe” after all, in terms of personal data protection, both as a result of commercial parties’ own failures as well as the US authorities’ practice of taking advantage of the data it was able to access.

With no compulsory independent testing, no sampling and no obvious compliance requirements, there are, these critics maintain, justifiable concerns over whether the Shield will provide adequate protection.

Current thinking, therefore, suggests that the Shield could be subject to challenge at some point, perhaps in the not too distant future.

The US factor
Meantime – and possibly adding to the concerns surrounding the Shield – is the fact that this is an arrangement with the US, a country whose authorities have in the past demonstrated an apparent indifference to the data protection rights of individuals, and a country that has just witnessed the biggest upset in modern political history, with Donald Trump overcoming all the odds to become the 45th US President.

Trump, of course, as some of those concerned about trans-Atlantic data protection standards point out, is someone who, during the campaign, invited the Russians to hack Hilary Clinton’s emails, and whose own company, Trump International Golf Course Scotland, recently found itself in trouble for not being registered under the Data Protection Law in England.

Regulation and protection
The question, then, is this: Does the Shield protect financial intermediaries, service providers and advisory firms in jurisdictions such as Jersey and Guernsey in their dealings with US commercial entities?