Privacy Shield Fails to Protect

The EU-US Privacy Shield Framework was designed to govern the transfer of EU citizens' data to the United States. However, in July 2020, the European Court of Justice struck down the agreement, ruling that it did not offer adequate protection. Although the UK is no longer part of the EU, this is still an important decision for UK businesses to be aware of. Businesses in the UK may deal with the data of EU consumers, or they might consider using EU services that may handle their data. It's important to know what protections may or may not be in place in these circumstances.

What Is the EU-US Privacy Shield Framework?

The EU-US Privacy Shield is a data transfer agreement created in 2016 between the EU and the US. It was designed to restrict the US government from accessing the private data of EU citizens with provisions for EU citizens to refer complaints to a regulator. It also requires companies wishing to transfer data to a third party to make sure that the third party also follows the rules of the Privacy Shield.

Why Was Privacy Shield Struck Down By the ECJ?

Privacy Shield was ruled as invalid by the European Court of Justice on July 16th, 2020. The framework was included in a complaint against Facebook by the Austrian lawyer and privacy rights advocate, Max Schrems. Schrems has been fighting a battle against Facebook for a decade. In 2013, he made a complaint to the Irish Data Protection Commission, arguing that Facebook was aiding the NSA in surveilling EU citizens. After his complaint was rejected, he then took it to the High Court, and it was referred to the European Court of Justice. This resulted in the existing EU-US data transfer agreement, Safe Harbour, being demolished.

After Safe Harbour was no longer valid, US companies began using standard contractual clauses (SCCs), an EU-approved template to transfer data between the EU and the US. However, Schrems submitted a new complaint to the Irish Data Protection Commissioner concerning Facebook's use of SCCs, which was again referred to the High Court and then the ECJ.

Privacy Shield was not initially part of this complaint, but it was pulled into the case. The ECJ then ruled that Privacy Shield fails to protect EU citizens, although they chose not to abolish SCCs. Organisations that are affected by the end of Privacy Shield must now rely on SCCs to manage the transfer of EU citizens' data between the EU and US. No longer having Privacy Shield means that SCCs are also more closely scrutinised to ensure they put adequate protections in place.

Do SCCs Offer Protection?

New standard contractual clauses were published in June 2021. They are designed to legitimise the transfer of personal data originating in the EEA to countries outside the EEA and can also be used by companies in the UK. They allow organizations to take a risk-based approach. However, both the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) have disputed this approach, considering even theoretical access to data to be a concern.

What Is the Best Way to Protect Data?

If you want to protect your business's data and keep it within the UK, the best thing to do is to choose UK providers for any services that you use. Privacy Shield would have required any third-party companies to follow the guidelines of the agreement, but still would not have provided enough protection.

A UK provider will keep your business data within the UK. There won't be any need for the transfer of data to the US, especially if your clients or customers are in the UK too. Using a US company or even an EU company that could share your data with the US could leave your business vulnerable.

Click4Assistance processes and stores all data within the UK, ensuring complete compliance with GDPR. While the EU GDPR no longer applies to the UK itself (UK businesses must follow the Data Protection Act 2018), the rules have been incorporated in UK regulations to create the UK GDPR. Additionally, businesses in the UK offering goods or services to, or monitoring the behaviour of, EU residents need to comply with the EU GDPR.

Click4Assistance owns servers in the UK, which are used to process and store any data. We don't ever send any data outside of the UK, so there is no need to be concerned with data being sent to the US or any other country. We work with organisations including the police, NHS, and local authorities, which means that we are trusted to keep sensitive data secure. Complying with all of the important data rights and regulations is made possible with our software. You get full control over how you collect data and can be sure that any data from your live chats are kept secure.

Keeping data within the UK protects your company and your customers or clients. You can feel confident that your data will remain secure, guided by UK regulations, and not at risk of surveillance or other issues from foreign governments or organisations. Many experts believe that there are no adequate protections currently in place for people in Europe whose data may be transferred to the US.

Data laws in the UK may also be reformed, with the Digital Secretary Oliver Dowden promising that the government would develop a "world-leading data policy" post-Brexit. Changes made would still need to be in line with the EU adequacy ruling which allows data to be shared with non-member states. Dowden has also said that the UK would continue to align with the EU GDPR.

Use a UK Provider to Protect Your Data

The Privacy Shield has been ruled as an inadequate framework to protect data going to the US. However, there is debate about whether there is really any way to protect data that is sent to US organisations. Therefore, the best way to keep your data safe is to use UK providers for products and services that won't send your data elsewhere.