EU: European Court of Justice Decision Invalidates Privacy Shield

In July, the European Court of Justice released a major privacy decision invalidating an agreement between the EU and US companies doing business in the region on data sharing. Known as the Privacy Shield, the agreement served as a bridge between companies outside the US, subject to less restrictive data collection and sharing regulations, to operate in the region under more stringent EU measures.

The result, for US companies, is that they can no longer depend on their voluntary participation in the Privacy Shield agreement to protect them from scrutiny by EU regulators, and going forward, customer data transfer will typically be blocked for US companies doing business in the region if they are solely relying on this transfer mechanism. However, the Standard Contract Clauses, which AGS deploys, were upheld as valid, subject to certain safeguards, which will be implemented by national data regulators in EMEA. The ruling came about through a challenge based on the lack of strong federal privacy law in the US, along with previous issues with surveillance of data by the US government.

Takeaway: The change will likely have implications for employers doing business between the US and EU, particularly on the systems, processes, and policies surrounding the collection and sharing of employee and candidate data. Since the ruling is recent, the major implications will be coming to light over the next several months. Companies that are affected by the ruling should monitor progress, seek specialist advice, and plan early to review and adjust their approaches to utilizing data across regions.

EU: European Court of Justice Decision Invalidates Privacy Shield

COVID-19

North America

EMEA

APAC