EU / US Privacy Shield Affects Your Organisation

When you're choosing a cloud provider or a partner to work with, where you physically store your data probably isn't one of the first things that you think about. However, it should be, as exporting data to foreign countries can result in severe penalties and could see you in breach of EU law.

One big issue is the EU-US Privacy Shield, which came into effect on 12 July 2016. It governs data transfer of personally identifiable information (PII) between Europe and America. Under this directive, US companies have to be certified, guaranteeing that European data is adequately protected, processed and shielded from mass US surveillance. 
If you have any data storage or processing taking place on US servers, you need to ensure that the companies you're working with have the right certification.

Changing Tides

Of course, legislation can change, and you may suddenly find that a service is no longer compliant. The US, for example, may introduce new laws or executive orders that directly overrule the safeguards put in place for processing EU data. 
At the same time, if the EU rules that the Privacy Shield is no longer valid, data stored and processed on US servers would suddenly fall foul of European law again.

Even after Britain leaves the EU, any company processing European data will need to maintain levels of compliance.

The original agreement between the EU and the US, Safe Harbour, is a case in point; although it was initially implemented in 2000, Edward Snowden’s revelations about the US National Security Agency and its monitoring methods raised strong concerns that EU data was no longer safe from snooping in the US. So in 2015, the European Court of Justice ruled that the agreement was invalid. That said, it’s important to note that Brexit won’t change the situation. Even after Britain leaves the EU, any company processing European data will need to maintain the same levels of compliance. If you store or process data outside of the EU and US, then you still need the required level of protection. This makes physical location something that needs careful consideration to ensure that you maintain compliance with local and EU rules.

Stronger barriers

So even with full compliance, storing your data in a different country can add complication to your business. For a start, you have the added problem that your data is subject to foreign law enforcement agencies and laws. This may mean that you have to deal with legal challenges and law enforcement agencies that you find it difficult to communicate with.
Although we live in a world where data transfer is easier, location is increasingly important.

Data transfers are going to get even harder when the General Data Protection Regulation (GDPR) becomes law on 25 May 2018. Part of the new regulation is a restriction on how and when data can be moved outside the EU. According to the official guidelines from the Information Commissioner's Office (ICO): "Personal data may only be transferred outside of the EU in compliance with the conditions for transfer."

GDPR covers both the temporary transfer of data and long-term storage, through a cloud provider for example. From the terms of GDPR, it's clear that the EU intends to review agreements regularly, which may mean that what was legal one year is no longer legal in another year.

With GDPR allowing for bigger fines for companies in breach of the regulations, up to €20m or 4pc of worldwide turnover, whichever is greater, businesses simply cannot ignore where their data is stored, and must verify that all storage locations are compliant. 

Although we live in a world where data transfer is easier from a technical standpoint, location is increasingly important from a legal perspective. No matter who you do business with, you need to know where your data is physically stored, and that such storage and processing is compliant with current laws.

Telegraph:

You Might Also Read:

Cyber Attacks On Banks Prompt New Regulatory Safeguards:

US and EU Implement Privacy Shield:

Eight Reasons Why US CEOs Care About New EU Privacy Laws:

What Does Brexit Mean For British Data Privacy?:

Tesco Could Have Been Facing £2bn Fine After The Bank Hack:


 

« Teenagers And Cybercrime
Snowden Can Stay In Russia For As Long As He Likes »

Directory of Suppliers

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Clayden Law

Clayden Law

Clayden Law are experts in information technology, data privacy and cybersecurity law.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

DigitalStakeout

DigitalStakeout

A simple and cost-effective solution to monitor, investigate and analyze data from the web, social media and cyber sources to identify threats and make better security decisions.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Paladion

Paladion

Paladion is a provider of managed IT security services.

IDnext

IDnext

IDnext is the open and independent platform to support innovative approaches in the world of the Digital identity.

Roke Manor Research

Roke Manor Research

Roke Manor Research is a world-class electronics engineering consultancy. Areas of expertise include cyber security, cyber assurance and cryptographic solutions.

e-Crime Bureau

e-Crime Bureau

e-Crime Bureau is a specialized company offering cyber/computer forensics, cyber security consulting services, forensic audit and investigations services and training to clients across Africa.

Capula

Capula

Capula is a leading system integration specialist for control, automation and operational IT systems across all applications and industry sectors.

Scantist

Scantist

Scantist is a cyber-security spin-off from Nanyang Technological Universiy (Singapore) which leverages its expertise to provide vulnerability management solutions to enterprise clients.

Global Lifecycle Solutions EMEA (Global EMEA)

Global Lifecycle Solutions EMEA (Global EMEA)

Global EMEA provides full lifecycle services to corporate Clients covering procurement, configuration, support, maintenance and end-of-life asset management.

KrCERT/CC

KrCERT/CC

KrCERT/CC is the National Computer Emergency Response Team in Korea.