Keywords: Privacy Shield, Safe Harbor, GDPR, CJEU, Data transfer, adequacy

What was Privacy Shield?

Privacy Shield was a program, agreed upon by the European Commission and the United States Federal Trade Commission, which set up a framework to guarantee adequate privacy protections for European resident data transferred to the United States. It replaced the previous EU-US data transfer framework, SafeHarbor, and set up several new mechanisms aimed at providing enhanced privacy protections for EU personal data, and supporting the individual privacy rights guaranteed by the General Data Protection Regulation. On July 16, 2020, the Court of Justice of the European Union (CJEU) ruled that Privacy Shield did not meet standards for adequate protection of EU individuals’ personal data.

With Privacy Shield invalidated, what data transfer mechanism will Vuture use to provide adequacy for transfers to the United States?

Vuture will utilize the controller-to-processor EU Standard Contractual Clauses for data transfers from the EU to US within all Data Protection Addendums going forward. The CJEU affirmed the adequacy of these clauses in its ruling, and though they may be amended in the near future, they represent our best path forward to maintaining our commitments to the privacy and security of personal data entrusted to us by customers. 

How will Vuture keep itself and its customers aware of developments for EU-to-US transfers?

Vuture's Global Data Privacy Manager is monitoring all developments related to the CJEU ruling cooperatively with our Data Protection Officer, HewardMills. As part of Vuture’s ongoing commitment to data privacy through its privacy governance structure, we will regularly evaluate the effectiveness of the Standard Contractual Clauses, implement guidance from EU regulators, and monitor our compliance with all obligations related to the transfer of EU personal data to third countries.