Embed Size (px)
Citation preview
7/27/2019 U.S.-EU Safe Harbor Agreement: Recent Developments and Implications
http://slidepdf.com/reader/full/us-eu-safe-harbor-agreement-recent-developments-and-implications 1/21
U.S.-EU Safe Harbor AgreementRecent Developments and Implications
The Champion Brand | Global is Local | Know What’s Next | Integrated Insights | Return on Reputation
The U.S.-EU Safe Harbor Framework 1 serves as astreamlined process or U.S. companies to
comply with the EU Directive 95/46/EC on data
protection, which is the current data protectionramework in place in the EU. Some Europeanand global companies are part o it too, e.g.,Alcatel-Lucent.
In the context o the revision o the 95Directive (and the proposed Regulationpublished in January 2012 that the EuropeanUnion is currently discussing), some U.S.ocials raised concerns that the new EU DataProtection Framework could potentially render“Sae Harbor” obsolete.
At that time, the EU did not intend tosignicantly alter Sae Harbor, and they wereengaged in regular discussions with U.S.ocials on data protection. Vice-President Viv iane Reding o the European Commission,responsible or the dossier, declared in 2012that it was both sides’ intention to pursueeorts to achieve “mutual recognition” in thisdomain.
In 2013, the dynamics changed aterrevelations o the U.S. data surveillanceprogram PRISM, providing a catalyst or EUpolicymakers and others critical or opposedto the Transatlantic Trade and InvestmentPartnership (TTIP), to raise their oppositionand work to increase their infuence in thesecurrent debates. >>
1 Please note that at the time o publication,many U.S. government websites are closed or runningat limited capacity due to the shutdown o the ederalgovernment.
Background:
7/27/2019 U.S.-EU Safe Harbor Agreement: Recent Developments and Implications
http://slidepdf.com/reader/full/us-eu-safe-harbor-agreement-recent-developments-and-implications 2/22
Recent developments: some EUpolicymakers call to suspend Sae Harbor:
The European Parliament, more specically the Committeeor Civil Liberties, Justice and Home Aairs (LIBE), hasbeen at the oreront o the PRISM debate investigatingwhat these revelations mean or U.S.-EU- data protectionagreements. Recently on Oct 7, 2013, they held a publichearing on the matter titled “Inquiry on Electronic Mass
Surveillance o EU Citizens.”
At this hearing, which gathered Members o the EuropeanParliament (MEPs), Heads o EU Data Protection Authorities(DPAs), Representatives o the European Data ProtectionSupervisor (EDPS) and some members o industry;participants discussed the eectiveness o Sae Harbor.Some attendees were relatively positive about theramework, such as the German DPA and the EDPS, whobelieve that even though the ramework is not perect, itprovides signicant saeguards to enable DPAs to intervenei necessary, e.g., stop data transers. Others, particularlyLIBE Committee MEPs, strongly questioned its eectiveness
and even appropriateness. At the end o the hearing,the LIBE Committee announced that it would call uponthe European Commission to suspend the Safe Harborframework until a solution is found.
Commercial and political consequences:This announcement, though limited to some LIBE Committeemembers, may have signicant commercial consequencesas such a suspension would have a negative impact ontransatlantic business or both EU and U.S. companies.Indeed, the EU prohibits the transer o personal data to thirdcountries that it considers “inadequate” in terms o data
protection standards, and the U.S.’s standards are deemed“inadequate” by the EU. Since Sae Harbor has been themain ramework used to allow data transers between thetwo regions, a suspension would mean that these datatransers would no longer be legal rom the EU’s perspective.
There would still be the possibility or some companies touse internal processes approved by the EU such as ModelContract Clauses or Binding Corporate Rules (BCRs).However, BCRs only allow or intra-organizational transers.Moreover, very ew companies are large enough to usethese mechanisms, while the Sae Harbor is used by smallor medium sized enterprises (SMEs) in addition to largeenterprises. Any enterprise operating on both sides o the Atlantic would then need to make a heavy nancialinvestment, e.g., or legal advice, to put in place suchinternal practices to ensure compliance. Regardless, largeenterprises, even i equipped with internal processes, arestill very much dependent on Sae Harbor to comply with EUrules.
A potential suspension o Sae Harbor would also havesignicant political consequences i the European Parliamentadopts this suspension, and considering Vice-PresidentReding’s position on the issue, the European Commission
would probably have to ollow this decision – though some
Commissioners, such as Karel De Gucht (trade) might expressdivergent opinions.
Implications or the relationships between the U.S. andMember States with U.S. ties are uncertain. However, wecan expect countries such as the United Kingdom, Ireland,Poland and the Czech Republic, among others, to besympathetic to the U.S.’s position and potentially interveneon its behal within the EU.
What are the likely scenarios?
The LIBE Committee is probably planning to put a “Motionor Resolution” orward which would have to be adoptedby a majority o MEPs in plenary. Thus ar, this call has onlyoriginated rom one Committee, but it will be importantto assess other Committees’ opinions in the uture andencourage them to “weigh in.” Namely, these would be thecommittees or Industry, Foreign Aairs and InternationalTrade, should the LIBE Committee take such action.
In this case, industry should consider increasing its lobbying
efforts, and rearm the eectiveness o Sae Harbor topolicymakers. Thus ar, industry’s reaction is viewed as timid,but it needs to push out the message that a suspensionwill also aect business in Europe, and not just Americanbusinesses. Currently, there are many on-going discussionsconcerning the idea o developing an “EU Cloud.” This EUCloud would not prevent large European companies romoering cloud services in the U.S., especially i they areestablished there, but data in the cloud would not be subjectto American legislation including the Patriot Act.
Next milestones:
• Week of 21 October: LIBE Committee vote on theproposed General Data Protection Regulation
• 24-25 October: European Digital Summit (with EU Headso States): Data Protection to be on the Agenda
• 09 December: Next LIBE public inquiry: dedicated to theSae Harbor
• End of 2013? (delayed): European Commissions’ report/assessment on the Sae Harbor to be published
To learn more about how APCO Worldwide can help younavigate the EU Data Protection debate, please contact:
Amélie [email protected]
Alex Whalen
project [email protected]
www.apcoworldwide.com
