Penny Pritzker, Vera Jourová :
Two weeks ago, the European Union and the United States adopted an innovative framework that will support the transfer of data across the Atlantic while maintaining rigorous privacy standards: the EU-US Privacy Shield. In addition to ensuring a high level of data protection for individuals, the Framework provides certainty for participating companies whose businesses rely on the transatlantic flow of personal information.
This week, the Privacy Shield “opens for business”. Businesses in the United States can now self-certify their adherence to the Privacy Shield Principles with the US Department of Commerce through the new Privacy Shield website.
The Privacy Shield is the result of several years of negotiations, which have resulted in a robust new framework that addresses the concerns of European stakeholders about how data is moved between the EU and the United States and reflects the jurisprudence of the European Court of Justice.
The new arrangement provides Europeans with the reassurance that their personal data will be protected by participating US companies, and that companies’ commitments to the Framework are enforceable under US law. Based on the work we have done together and the material in the Privacy Shield package, stakeholders in Europe can have confidence that there are strict and privacy-protective safeguards around any access to data by US law enforcement and national security agencies and that redress mechanisms are readily available to address any individual concerns.
With the Privacy Shield framework in place, companies in both Europe and America can seize the opportunities inherent in the transatlantic digital economy. Data flows are essential for global commerce and investment. Companies that have facilities and employees across the Atlantic rely on their ability to move information between the US and Europe to do things like pay their employees and process benefits. The flow of data between the EU and the US is also critical to smart manufacturing, research and development and product testing. Already, more than $260 billion in digital services trade takes place across the Atlantic every year, but there is significant potential for that figure to increase. Consumer trust is key to unlocking this growth.
Starting this week, European companies “exporting” personal data can verify the participation of US businesses by checking the Department of Commerce’s public list of firms that have certified. It is just that easy. If their business partner is on the list, a European company can safely transfer personal data in full compliance with EU data protection law.
In addition, the US Department of Commerce’s Privacy Shield website is a resource to help businesses and individuals on both sides of the Atlantic understand the framework. This week, the European Commission is also issuing a citizen’s guide, so that individuals have transparent information about how their fundamental right to data protection under EU law is guaranteed under the Privacy Shield and know who to turn to in the case of any problems. The US will work closely with Europe’s independent data protection authorities, as data protection authorities will play a key role in assisting individuals and ensuring the framework serves them as intended.
Building a bridge between two legal systems was no easy task. Yet the Privacy Shield was well worth the time spent at the negotiating table. And it will be a dynamic process with a strong annual joint review to ensure that the system functions as intended and to address any concerns.
Simply put, the Privacy Shield is a 21st century solution to strengthen the protection of personal data that moves between the United States and the European Union.
We are confident that the Privacy Shield will open a new era for transatlantic privacy and commerce, delivering concrete and practical results for our citizens and companies.
(Penny Pritzker is US Commerce Secretary and Vera Jourová is EU Justice Commissioner).
