Privacy Shield (Safe Harbour's successor) not yet the answer

Further to our article published recently regarding the potential successor to Safe Harbor, the ‘EU-US Privacy Shield’ framework (see here), the UK data protection regulator, the ICO, has today confirmed in a blog that it is still too early to say whether the new EU-US Privacy Shield will provide adequate protection for personal data transferred from the EU to the USA.  The ICO’s blog confirms the process laid out in our article in that: (i) the Article 29 Working Party have to provide an opinion on the Shield (estimated before the end of April 2016) and, assuming a positive opinion is given (ii) the European Commission will need to issue an adequacy decision.  This is potentially a 6-9 month process, assuming a similar length of time is spent as with the original Safe Harbor decision issued in 2000.

The ICO has confirmed its position from October 2015 relating to enforcement action against companies transferring data to the USA.  The ICO will not be seeking to expedite enforcement complaints about Safe Harbor while the process to approve a replacement continues. However, it will consider complaints on a case by case basis dependent on risk posed to individuals.