Changes in Global Privacy Affect Small Business Too

In case you missed it, on October 6, 2015 the Court of Justice of the European Union (CJEU) issued a long-awaited privacy ruling in the case involving Maximilian Schrems, the Ireland Data Protection Authority (DPA) and Facebook. Back in 2000, the EU Commission decided that personal data sent to US organizations that sign up to the Safe Harbor scheme is adequately protected. Safe Harbor organizations self-certify compliance with certain privacy principles, and the scheme is enforced by the US FTC.

Background

Simply put, Schrems sued to prohibit transfer of his personal data from Facebook Ireland to Facebook in the U.S. due to widely perceived flaws in U.S. data protection following the Edward Snowden NSA revelations.

Why it Matters

Over 5,000 U.S. companies “self-certify” under Safe Harbor, and their European partners and customers rely on Safe Harbor for data transfers into the U.S. The decision may impact many small to medium sized business who use social media for marketing and business development, as well as businesses that use cloud-based services for gathering, processing and sharing data. Transfers of Personally Identifiable Information (PII) from the EU to the U.S must either be authorized by national data protection authorities, or be able to rely on one of the legal exceptions.

Although the Safe Harbor companies publicly committed to apply the Safe Harbor Privacy Principles to the personal data they brought into the U.S. (and some companies passed these commitments on to other entities under Onward Transfer agreements), companies that disregard those commitments, with regard to either stored data or new data transfers, could expose itself to FTC enforcement against “unfair or deceptive practices” or judicial complaints based on U.S. contract, fraud, or tort law, as well as to enforcement in the EU – such as complaints before labor tribunals, courts, and data protection authorities.

Don’t Panic, Yet

While the decision is likely to have a significant impact on the transfer of personal data from the EU to U.S. recipients, EU leaders say it’s not time to panic yet. Experts have pointed out the alternative legal bases for transatlantic data transfers that exist, such as contracts, Binding Corporate Rules or actual, express consent. Many businesses may be able to use these methods and continue their transatlantic data transfers.

Domestic Developments

At the same time, California leads the U.S. in enacting new privacy legislation. Last week California passed legislation that may equate to what the EU wants to see on the federal level. According to §1546.1 b) of CalECPA any government entity must have a warrant, wiretap order, order of electronic reader or a subpoena if they want to compel any individual or a service provider to disclose information stored on their devices (mobile phones, computer, tablets, tv, servers you name it). §1546.1 c) states that government agencies cannot access, either physically or remotely, a device unless they have a warrant, wiretap order, consent of the authorized possessor of the device, if the government in good faith, believes there is an emergency that could jeopardize someone’s life or physical integrity (in which case they’ll have to get a warrant within 3 days later) or in case the devices are confiscated from inmates in state prisons.

Concerned about whether your business is at risk for violating EU data protection rules? Don’t be. We offer a FREE, no-obligation one (1) hour consultation to identify potential issues. The professionals at the Adler Law Group can help you review, enhance and adopt standardized contracts and implement methodologies for approaching these challenges by setting objectives, determining scope, allocating resources, and developing agreements that will efficiently and effective manage risks, while keeping pace with the business.

Please call: (866) 734-2568, click: http://www.adler-law.com, or write: David @ adler-law.com.