This presentation provided an overview of the proposed Privacy Shield to ease the transfer of personal information of EU citizens to the US for processing as a response to the European Court of Justice opinion invalidating its predecessor, the U.S. - EU Safe Harbor. The presentation examined the new standards, procedural requirements and compliance obligations of US companies and the new dispute resolution mechanisms available to EU citizens.

1. The New Privacy Shield for Trans-Atlantic Data
Cyberspace Law Committee
Business Law Section
State Bar of California
Is the Shield Better, Different Or Just New?
Mark B. Aldrich© 2016 Aldrich Law Group All Rights Reserved

2. The New Privacy Shield
The History
The New Provisions
© 2016 Aldrich Law Group All Rights Reserved

3. Privacy Shield
The History
© 2016 Aldrich Law Group All Rights Reserved

4. Privacy Shield – The History
• EU Data Protection Directive 94/46/EC
- Established in 1998
- Prohibits Transfer of Personal Information
Without Meeting EU “Adequacy” Standard
© 2016 Aldrich Law Group All Rights Reserved

5. Privacy Shield – The History
- October 6, 2015 – ECJ Opinion
- Article 29 Working Party Grace Period to Feb. 1, 2016
• The Schrems Case
- German Data Protection Authority Protectionism
© 2016 Aldrich Law Group All Rights Reserved

6. Privacy Shield
An Overview
© 2016 Aldrich Law Group All Rights Reserved

7. Privacy Shield:
An Overview
• Transfers to Third Parties
© 2016 Aldrich Law Group All Rights Reserved
• Safeguards against Intelligence Agencies
• Dispute Resolution
• Enforcement Authorities
• Compliance and Reporting Obligations

8. Privacy Shield
Transfers to Third Parties
© 2016 Aldrich Law Group All Rights Reserved

9. Privacy Shield:
Transfers to Third Parties
• Transfers to Agents
- Safe Harbor Required Notice and Choice Prior to Disclosure
- Additional Notice Not Required if Agent to Perform Tasks
- Recipient Required to Comply with Safe Harbor in Written
Agreement
© 2016 Aldrich Law Group All Rights Reserved

10. Privacy Shield:
Transfers to Third Parties
- Privacy Shield Imposes New Requirements:
- Purpose Limitation
- Compliance with Shield Privacy Standards
- Stopping and Remediating Unauthorized Processing
- Must Provide Summary or a Representative Copy of
Privacy Provisions of Its Contract With the Agent to
Dept. of Commerce “Upon Request”
- Transferring Company Remains Liable
• Transfers to Agents
© 2016 Aldrich Law Group All Rights Reserved

11. Privacy Shield:
Transfers to Third Parties
• Transfers to Affiliates
- Lessened Restrictions Where Recipient is Within a
“Controlled Group of Corporations or Entities.”
- Can Use BCR’s and Intra-Group Policies
- Transferring Company Remains Liable
© 2016 Aldrich Law Group All Rights Reserved

12. Privacy Shield
Safeguards Against Intelligence Activities
© 2016 Aldrich Law Group All Rights Reserved

13. Privacy Shield:
Safeguards Against Intelligence Activities
• February, 2016 EU Declaration
- U.S. Government Assurances Given
- Access to EU Citizen Data Subject to “Clear Limitations,
Safeguards and Oversight Mechanisms”
- Ombudsman in Dept. of State to be Created to review
and Investigate Claims
- No Independent Investigative or Enforcement
Powers
- Applies to BCR’s and SCC’s
© 2016 Aldrich Law Group All Rights Reserved

14. Privacy Shield
Dispute Resolution
© 2016 Aldrich Law Group All Rights Reserved

15. Privacy Shield:
Dispute Resolution
• Multiple Avenues for EU Citizens
- Direct Complaints to Company
- Independent Recourse Mechanism
- Can Be Private ADR or a Panel of EU DPA’s
- Private ADR Must:
- Respond Promptly to Inquiries and Info. Requests
from Dept. of Commerce;
- Issue Annual Reports With Aggregate Stats
- Panel Empowered to Hear Unresolved Private Disputes
© 2016 Aldrich Law Group All Rights Reserved

16. Privacy Shield:
Dispute Resolution
• Multiple Avenues for EU Citizens
- DPA Panel
- Parties Able to Provide Evidence Prior to Decision
- DPA Will ‘Try’ to Issue ‘Advice’ Within 60 Days
- Organizations Must Comply Within25 Days
- If No Compliance, Panel Refers Matter to FTC for
Enforcement and Inform Dept. of Commerce for
Revocation of Compliance Cert.
© 2016 Aldrich Law Group All Rights Reserved

17. Privacy Shield:
Dispute Resolution
• Multiple Avenues for EU Citizens
- Binding Arbitration by Privacy Shield Panel
- Must Exhaust Other Avenues First
- No Damage Award, Only Equitable Remedies
- Decisions Within 90 Days
- Damage Recover Allowed by Later Court Action
- Judicial Review Permitted under US Federal Arb. Act
© 2016 Aldrich Law Group All Rights Reserved

18. Privacy Shield
Enforcement Authorities
© 2016 Aldrich Law Group All Rights Reserved

19. Privacy Shield:
Enforcement Authorities
• Department of Commerce
• Federal Trade Commission
• Organizations with Statutory Authority
– Dept. of Transportation
• European Data Protection Authorities
• Private Sector Independent Recourse
Mechanisms and Self-Regulating Bodies
© 2016 Aldrich Law Group All Rights Reserved

20. Privacy Shield
Compliance Obligations
© 2016 Aldrich Law Group All Rights Reserved

21. Privacy Shield:
Compliance Obligations
• Recertification on Annual Basis
• Record Retention Re: Implementation of Privacy Program
– Must Provide to Regulators Upon Request
• Data Must be Protected After Leaving Privacy Shield
Program
– Same as Safe Harbor
– Adds Annual Reporting Requirement to Dept. of Commerce
So Long As information Retained
– Alternatively, Return or Delete Info or Provide ‘Adequate’
Protection by Other Means (SCC’s, BCR’s)
© 2016 Aldrich Law Group All Rights Reserved

22. The New Privacy Shield for Trans-Atlantic Data:
Is the Shield Better, Different or Just New?
Mark B. Aldrich
maldrich@algapc.com
© 2016 Aldrich Law Group All Rights Reserved