US relations with the European Union took another hit earlier this month, when the European Parliament voted to suspend Privacy Shield, the agreement between the US and the EU that allows companies to transfer the personal information of EU citizens out of the EU to US companies that have promised to adhere to the General Data Protection Regulation (GDPR). Between the Facebook-Cambridge Analytica scandal, the passage of the CLOUD Act, and the Russian hack (sorry–alleged Russian hack) of the 2016 election, the EP felt that Privacy Shield did not provide an adequate level of protection for EU citizens. The US has until September 1 to become compliant.

The good news is that the EP's concerns largely relate to inadequate protections on the part of the US government, as opposed to any shortcomings with the scheme itself. This means that if the US addresses all of the EP's concerns, those entities that have already applied for and been accepted into the Privacy Shield program will need to do very little to remain compliant (other than fully comply with the GDPR, but that's another issue altogether).

The bad news is that the Trump administration has shown very little interest in dealing with international privacy concerns. Hence, it is possible that the September 1 deadline will come and go without the US even attempting to come to some sort of understanding. Privacy Shield is up for review/renewal anyway in September, so both sides may simply look at this event as an opportunity to scrap Privacy Shield altogether and come up with a brand new agreement. If that happens, companies that already participate in Privacy Shield may find themselves in limbo once again, much like they were when the Safe Harbor program (the predecessor to Privacy Shield) was invalidated back in 2015.

Such limboesque companies have a couple of options. First, the other avenues for insuring the safety and security of onward transfers—standard contractual clauses and binding corporate rules—are still available under the GDPR (although a lawsuit is wending its way through the European courts on the validity of standard contractual clauses, so choose that option with care). Depending upon the corporate structure of the organization, the amount of EU data it collects and processes, as well as the number of third-party data processing vendors with whom it interacts, these options could either be easily implemented or prohibitively expensive.

Another option is consent. Article 49, Section (1)(a) of the GDPR allows for the transfer of personal data to a non-EU country if “the data subject has explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers for the data subject due to the absence of an adequacy decision and appropriate safeguards.” Again, this option could prove time-consuming and expensive if you need to obtain such consent from thousands of data subjects, but there are third-party options out there to manage that cost.

Of course, Article 49, Sections (1)(b) and (c) of the GDPR allow for these transfers to occur without any of the above safeguards or consent, if the transfer is necessary for the implementation, performance or conclusion of a contract between the data controller and the data subject or between the data controller and another legal or natural person if the contract is in the interest of the data subject. Thus if the transfers relate only to existing contractual business relationships with data subjects, the company can carry on regardless of what happens to Privacy Shield.

As with many other aspects of EU data protection regulations and decisions, there seems to be a lot of “hurry up and wait.” But if a US company maintains a strong presence in the EU and needs to transfer personal EU data back to the US, waiting to see what happens next may be a luxury that it simply cannot afford.

 

Eric Levy is senior counsel in Husch Blackwell LLP's Dallas office and belongs to the firm's Financial Services & Capital Markets industry group.