EU / US Privacy Shield Affects Your Organisation

When you're choosing a cloud provider or a partner to work with, where you physically store your data probably isn't one of the first things that you think about. However, it should be, as exporting data to foreign countries can result in severe penalties and could see you in breach of EU law.

One big issue is the EU-US Privacy Shield, which came into effect on 12 July 2016. It governs data transfer of personally identifiable information (PII) between Europe and America. Under this directive, US companies have to be certified, guaranteeing that European data is adequately protected, processed and shielded from mass US surveillance. 
If you have any data storage or processing taking place on US servers, you need to ensure that the companies you're working with have the right certification.

Changing Tides

Of course, legislation can change, and you may suddenly find that a service is no longer compliant. The US, for example, may introduce new laws or executive orders that directly overrule the safeguards put in place for processing EU data. 
At the same time, if the EU rules that the Privacy Shield is no longer valid, data stored and processed on US servers would suddenly fall foul of European law again.

Even after Britain leaves the EU, any company processing European data will need to maintain levels of compliance.

The original agreement between the EU and the US, Safe Harbour, is a case in point; although it was initially implemented in 2000, Edward Snowden’s revelations about the US National Security Agency and its monitoring methods raised strong concerns that EU data was no longer safe from snooping in the US. So in 2015, the European Court of Justice ruled that the agreement was invalid. That said, it’s important to note that Brexit won’t change the situation. Even after Britain leaves the EU, any company processing European data will need to maintain the same levels of compliance. If you store or process data outside of the EU and US, then you still need the required level of protection. This makes physical location something that needs careful consideration to ensure that you maintain compliance with local and EU rules.

Stronger barriers

So even with full compliance, storing your data in a different country can add complication to your business. For a start, you have the added problem that your data is subject to foreign law enforcement agencies and laws. This may mean that you have to deal with legal challenges and law enforcement agencies that you find it difficult to communicate with.
Although we live in a world where data transfer is easier, location is increasingly important.

Data transfers are going to get even harder when the General Data Protection Regulation (GDPR) becomes law on 25 May 2018. Part of the new regulation is a restriction on how and when data can be moved outside the EU. According to the official guidelines from the Information Commissioner's Office (ICO): "Personal data may only be transferred outside of the EU in compliance with the conditions for transfer."

GDPR covers both the temporary transfer of data and long-term storage, through a cloud provider for example. From the terms of GDPR, it's clear that the EU intends to review agreements regularly, which may mean that what was legal one year is no longer legal in another year.

With GDPR allowing for bigger fines for companies in breach of the regulations, up to €20m or 4pc of worldwide turnover, whichever is greater, businesses simply cannot ignore where their data is stored, and must verify that all storage locations are compliant. 

Although we live in a world where data transfer is easier from a technical standpoint, location is increasingly important from a legal perspective. No matter who you do business with, you need to know where your data is physically stored, and that such storage and processing is compliant with current laws.

Privacy Shield:           Telegraph:

You Might Also Read:

Cyber Attacks On Banks Prompt New Regulatory Safeguards:

US and EU Implement Privacy Shield:

Eight Reasons Why US CEOs Care About New EU Privacy Laws:

What Does Brexit Mean For British Data Privacy?:

Tesco Could Have Been Facing £2bn Fine After The Bank Hack:


 

« Teenagers And Cybercrime
Snowden Can Stay In Russia For As Long As He Likes »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

CUIng.org

CUIng.org

The CUIng initiative was launched to tackle the problem of criminal exploitation of information hiding techniques.

SCIPP International

SCIPP International

SCIPP’s courses are based on internationally recognized best business practices for security awareness, for both technical and non-technical staff and to comply with regulatory mandates.

BehavioSec

BehavioSec

BehavioSec uses the way your customers type, swipe, and hold their devices, and enables them to authenticate themselves through their own behavior patterns.

AKATI Sekurity

AKATI Sekurity

AKATI Sekurity is a security-focused consulting firm providing services specializing in Information Security and Information Forensics.

CyberStream

CyberStream

CyberStream, a division of the TechStream Group, is an information & cybersecurity talent acquisition solution provider.

Risk Based Security (RBS)

Risk Based Security (RBS)

Risk Based Security provide the most comprehensive and timely vulnerability intelligence, breach data and risk ratings.

Eclypsium

Eclypsium

Eclypsium protects organizations from the foundation of their computing infrastructure upward, controlling the risk and stopping threats inside firmware of laptops, servers, and networks.

TechRate

TechRate

Techrate is an analytics agency focused on blockchain technology and engineering. Or expertise includes security and technical audits of projects.

Keyless Technologies

Keyless Technologies

Simple, secure, and interoperable authentication. Keyless offers unmatched security, privacy and usability, while reducing risk and infrastructure costs.

Envelop Risk

Envelop Risk

Envelop Risk is a global specialty cyber insurance firm, combining decades of insurance industry expertise with sophisticated cyber and artificial intelligence-based analytics.

CyberKnight Technologies

CyberKnight Technologies

CyberKnight Technologies is a cybersecurity focused value-added-distributor (VAD) headquartered in Dubai and covering the Middle East.

Terralogic

Terralogic

Terralogic is a software and IT services company, an expert in IoT, Cloud, DevOps, App development and Cybersecurity.

OX Security

OX Security

OX is a DevOps software supply chain security solution. Teams can verify the integrity and security of every artifact using a pipeline bill of materials (PBOM).

ZINAD IT

ZINAD IT

ZINAD is an information security company offering state-of-the-art cybersecurity awareness products, solutions and services.

Harbottle & Lewis

Harbottle & Lewis

Harbottle & Lewis is a leading UK-based law firm focused on the Private Client and Technology, Media and Entertainment sectors.

Positka FSI Pte Ltd

Positka FSI Pte Ltd

Positka, being a Splunk Singapore partner, provides Splunk & Phantom Services, Cybersecurity & Risk Management, Analytics & Big Data, Lean Process Optimization, and Managed Security Services.