EU / US Privacy Shield Affects Your Organisation
When you're choosing a cloud provider or a partner to work with, where you physically store your data probably isn't one of the first things that you think about. However, it should be, as exporting data to foreign countries can result in severe penalties and could see you in breach of EU law.
One big issue is the EU-US Privacy Shield, which came into effect on 12 July 2016. It governs data transfer of personally identifiable information (PII) between Europe and America. Under this directive, US companies have to be certified, guaranteeing that European data is adequately protected, processed and shielded from mass US surveillance.
If you have any data storage or processing taking place on US servers, you need to ensure that the companies you're working with have the right certification.
Changing Tides
Of course, legislation can change, and you may suddenly find that a service is no longer compliant. The US, for example, may introduce new laws or executive orders that directly overrule the safeguards put in place for processing EU data.
At the same time, if the EU rules that the Privacy Shield is no longer valid, data stored and processed on US servers would suddenly fall foul of European law again.
Even after Britain leaves the EU, any company processing European data will need to maintain levels of compliance.
The original agreement between the EU and the US, Safe Harbour, is a case in point; although it was initially implemented in 2000, Edward Snowden’s revelations about the US National Security Agency and its monitoring methods raised strong concerns that EU data was no longer safe from snooping in the US. So in 2015, the European Court of Justice ruled that the agreement was invalid. That said, it’s important to note that Brexit won’t change the situation. Even after Britain leaves the EU, any company processing European data will need to maintain the same levels of compliance. If you store or process data outside of the EU and US, then you still need the required level of protection. This makes physical location something that needs careful consideration to ensure that you maintain compliance with local and EU rules.
Stronger barriers
So even with full compliance, storing your data in a different country can add complication to your business. For a start, you have the added problem that your data is subject to foreign law enforcement agencies and laws. This may mean that you have to deal with legal challenges and law enforcement agencies that you find it difficult to communicate with.
Although we live in a world where data transfer is easier, location is increasingly important.
Data transfers are going to get even harder when the General Data Protection Regulation (GDPR) becomes law on 25 May 2018. Part of the new regulation is a restriction on how and when data can be moved outside the EU. According to the official guidelines from the Information Commissioner's Office (ICO): "Personal data may only be transferred outside of the EU in compliance with the conditions for transfer."
GDPR covers both the temporary transfer of data and long-term storage, through a cloud provider for example. From the terms of GDPR, it's clear that the EU intends to review agreements regularly, which may mean that what was legal one year is no longer legal in another year.
With GDPR allowing for bigger fines for companies in breach of the regulations, up to €20m or 4pc of worldwide turnover, whichever is greater, businesses simply cannot ignore where their data is stored, and must verify that all storage locations are compliant.
Although we live in a world where data transfer is easier from a technical standpoint, location is increasingly important from a legal perspective. No matter who you do business with, you need to know where your data is physically stored, and that such storage and processing is compliant with current laws.
You Might Also Read:
Cyber Attacks On Banks Prompt New Regulatory Safeguards:
US and EU Implement Privacy Shield:
Eight Reasons Why US CEOs Care About New EU Privacy Laws:
What Does Brexit Mean For British Data Privacy?:
Tesco Could Have Been Facing £2bn Fine After The Bank Hack:
