Privacy Shield: The Six Things You Need to Know That Might Affect Your Company

Privacy Shield is a legal framework that has been designed to regulate the exchange of personal and commercial information between countries on both sides of the Atlantic. Privacy Shield or EU-US and Swiss-US. Privacy Shield Frameworks have been designed by the US Department of Commerce, the European Commission, and the Swiss Administration as a protocol for transatlantic exchanges of data.

Privacy Shield: Impact On Data Companies

KOL (Key Opinion Leader), as an example, is a data aggregator company that collects data from the internet about social media influencers and key opinion leaders in academia. Since KOL processes data from users in different European countries, they may need to get certified by the Privacy Shield program. 

Data companies like KOL can only collect data that has been voluntarily shared by users and non-users, but according to the Privacy Shield program, KOL must provide all individuals with a way to resolve complaints. The intricacies of these mechanisms (escalations and dispute resolution) is what the Privacy Shield program seeks to regulate and standardize.

To be precise, Privacy Shield is a mechanism devised by the EU-US and Swiss-US that every business must comply with when transferring personal data from the European Union and Switzerland to the United States. This framework has been approved by both governing bodies of the European Union and Switzerland. In the United States, the program is administered by the International Trade Administration (trade.gov).

The enforcement of Privacy Shield by the US, European Union, and the Swiss government has impacted several businesses that need to collect or transfer users data. 

Here are 6 significant criteria of the Privacy Shield that every individual or business should know, especially if it is involved in transatlantic data exchanges.  

1. Data Certification: One of the principles stated in the Privacy Shield allows data companies to self-certify what types of data they collect, use, and share with their clients and business associates. If the company has limitations in self-certifying their data processes and practices, they can hire third-party auditors to help with the certification process. 
2. External complaint handling service: All companies certified by Privacy Shield to exchange data between countries on both sides of the Atlantic must have a dedicated system or mechanism to address outside complaints. This has further equipped users with the right to own their data and control its transfer and usage. 
3. Transparency: Every individual should be informed about data that has been collected from them. Individuals also have the right to know how their data will be used and where to contact for further queries or complaints. 
4. Data from third-party organizations: Individuals have the right to transfer the data to third-party data companies. In such cases, these companies should be certified by Privacy Shield for adhering to the data protection principles set out in the Privacy Shield. 
5. Data integrity: Only relevant data should be collected from individuals that will suffice the purpose of its requirement. Privacy Shield does not permit the collection, storage, and sharing of sensitive information like payment data from individuals. 
6. Surviving liability after a merger or acquisition: Even after a merger an acquisition, your company may still be liable for damages caused to an individual due to mishandling their data.

Final Thoughts: Certify or Not Certify?

While the Privacy Shield protects individuals by safeguarding their private information, it also imposes significant challenges for businesses of all sizes. While choosing to not get certified is a valid option, it is advisable to speak with your legal counsel about the implications and liabilities of choosing one way or the other.