The Next Phase of Privacy Shield

Jun 16, 2022 by Rebecca Knight, CIPP/E, CIPP/US, Counsel, Policy Privacy Initiatives, BBB National Programs

On March 25, 2022, the EU Commission and the US announced they had agreed, in principle, on a new Trans-Atlantic Data Privacy Framework (TADPF). The announcement of TADPF begins to lift the cloud of uncertainty that has been hanging over Privacy Shield for nearly two years since the July 2020 Court of Justice of the European Union’s Schrems II judgment. Additionally, TADPF serves as a foundation for a US adequacy decision reinstituting trans-Atlantic data flow. 

As BBB National Programs’ Global Privacy Division continues to prepare for this next phase of Privacy Shield, we want to highlight several key details regarding the substance of TADPF and the EU’s adequacy decision process.

 

The Substance 

The details are still being hashed out, but so far, we know TADPF will include the following commitments:  

  1. Strengthening individual privacy and civil liberties safeguards by limiting access to data by US intelligence agencies to what is necessary and proportionate for national security. 
  2. The establishment of an independent and binding multi-layered redress mechanism, which will include a Data Protection Review Court composed of individuals outside of the US, to adjudicate claims and direct remedial measures.
  3. The adoption of oversight procedures by US intelligence agencies to ensure privacy is strengthened and civil liberties safeguards are maintained.  

 

Notably, these commitments all fall squarely on the US government to implement. The lift seems to be much lighter for businesses.  

As reported, it appears the commercial data protection obligations, Privacy Shield Principles, and even the name Privacy Shield will remain the same. As such, it is anticipated that businesses currently certified under Privacy Shield will remain certified once TADPF receives an adequacy decision, eliminating the need to complete the certification process again.  

 

The Adequacy Process  

As indicated by the March 25 joint announcement and accompanying fact sheet, the return of Privacy Shield through TADPF will be effectuated through an Executive Order and requires no legislative action. And according to a recent report, the Executive Order is expected later this month (June 2022). After the Executive Order is signed, there will be a need to complete the EU’s adequacy process.  

This process is completed in five distinct steps:  

  1. EU Commission drafts an adequacy determination and provides it to the European Data Protection Board (EDPB) for review. 
  2. EDPB reviews the adequacy determination and issues a non-binding opinion.
  3. European Parliament can adopt a non-binding resolution of its position.
  4. EU Member States must approve. 
  5. Finally, if approved by the Member States, the adequacy determination will be adopted and take immediate effect.  

 

Based on previous adequacy decisions, if the Executive Order is signed this month as anticipated, the process for the return of Privacy Shield could be completed by the end of the year. For example, after Schrems I and the invalidation of Safe Harbor on October 6, 2015, Privacy Shield was announced on February 2, 2016. The Privacy Shield legal documents were published on February 29, 2016, and the EU Commission’s adequacy decision was provided and took effect on July 12, 2016 – a period of approximately five months. Similarly, the UK’s adequacy process was completed in four months, beginning on February 19, 2021, and ending on June 28, 2021.  

 

Our Promise to You 

Undoubtedly, the return of Privacy Shield will present a number of questions. But the Global Privacy Division is here to help. In fact, we have never stopped serving as an independent resource for businesses and consumers with data privacy concerns. 

Over the past two years, BBB EU Privacy Shield has continued to maintain our Independent Recourse Mechanism (IRM) program, ensuring businesses remained in compliance with the GDPR. If you have questions for us about this next phase of Privacy Shield, whether you are a current, previous, or prospective Privacy Shield participant, let us know here.   

Suggested Articles

Blog

What All Businesses Can Learn From Recent Missteps In Crypto

While the crypto market itself is quite revolutionary, its challenges in introducing a new concept to consumers are not new. In every emerging market, business leaders should take steps to generate excitement while being careful to avoid pitfalls by making advertising claims that they can support with evidence.
Read more
Blog

Expanding SWIFT: What’s New for 2023

NAD is expanding Fast-Track SWIFT so that all single-issue claims, express and implied, that do not require review of complex evidence or substantiation are eligible. In SWIFT, challenges are limited to issues that do not require review of complex evidence or substantiation, such as clinical or technical testing or consumer perception evidence, and cases are resolved within 20 business days or less.
Read more
Blog

FTC’s New Health Claims Guidance: What You Need to Know

Health-related claims remain a priority for the Federal Trade Commission (FTC), signaled by the release of important new guidance at the end of 2022: Health Products Compliance Guidance, replacing the Dietary Supplements: An Advertising Guide for Industry. Get to know these changes for health-related claims.
Read more
Blog

2023 Trends: Big Game Ad Claims

What makes the Super Bowl “super”? The commercials. In recent years the explosion of increased marketing channels has led marketers to flock to targeted advertising, but the big game stage provides an important opportunity to reach millions of consumers at the same time. This article takes a look at some of the trends from this year’s big game.
Read more