Practising Law Institute: Privacy Shield Boot Camp

Transcription

1 Practising Law Institute: Privacy Shield Boot Camp Substantive Differences Between Safe Harbor and Privacy Shield Panel 2 September 12, 2016 Baker & McKenzie LLP is a member firm of Baker & McKenzie International, a Swiss Verein with member law firms around the world. In accordance with the common terminology used in professional service organisations, reference to a "partner" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm Baker & McKenzie LLP

2 Agenda Privacy Shield Principles Notice Requirements Consent Requirements Onward Transfer Requirements Information Security/ Other Developments

3 Key Privacy Shield Requirements

4 Privacy Shield Principles In order to self-certify to the Privacy Shield, U.S. companies must publicly declare adherence to seven Privacy Shield Principles: Notice Choice Accountability for Onward Transfer Security Data Integrity and Purpose Limitation Access Recourse, Enforcement and Liability The U.S. companies must also adhere to sixteen (16) Supplemental Privacy Principles that explain and augment the seven core principles, namely: (1) Sensitive Data, (2) Journalistic Exceptions, (3) Secondary Liability, (4) Performing Due Diligence and Conducting Audits, (5) The Role of the Data Protection Authorities, (6) Self-Certification, (7) Verification, (8) Access, (9) Human Resources Data, (10) Obligatory Contracts for Onward Transfers, (11) Dispute Resolution and Enforcement, (12) Choice - Timing of Opt Out, (13) Travel Information, (14) Pharmaceutical and Medical Products, (15) Public Record and Publicly Available Information, and (16) Access Requests by Public Authorities

5 Notice Principle Enhanced notice requirements include thirteen specific information points that must be provided in privacy notices to data subjects, such as: Types of personal data collected and purposes of use Types or identity of third parties to which personal data disclosed Rights of access and correction Opt-in/opt-out rights for certain processing of personal data Recourse mechanisms, including direct recourse, independent dispute resolution body, and binding arbitration Requirements to disclose personal data in response to lawful requests for national security and law enforcement Liability for onward transfers to third parties Data subjects right to access their personal data

6 Choice Principle The choice principle requires companies give data subjects choices regarding certain processing of their personal data: Opt-out for disclosures of non-sensitive personal data or changes of purposes of use Opt-in for disclosures of sensitive personal data or changes of purposes of use for such data

7 Accountability for Onward Transfer Principle Privacy Shield provides a limited transition period with respect to third party contractual relationships If an organization certifies to Privacy Shield within two (2) months following the framework's effective date (i.e., by September 30, 2016), then the organization will have up to nine (9) months from the date upon which they certify to bring such relationships with third parties in line with the Onward Transfer Principle: Obligations to impose contracts on data controller recipients that impose the same privacy protections as the Privacy Shield Principles and requires adherence to the terms of individual consent, subject to certain exceptions for intragroup transfers Accountability for onward transfers to agents including assuring that disclosures are for limited and specified purposes only, taking steps to stop any inappropriate processing, and remaining responsible for the handling of personal data

8 Security Principle and Data Integrity and Purpose Limitation Principle Similar to Safe Harbor, companies are required to provide reasonable precautions to protect personal data Heightened appropriate standard under Privacy Shield In order to implement appropriate security, companies must consider the nature of the personal data (e.g., sensitive vs. nonsensitive) and how it will be processed. In addition, U.S. companies must implement reasonable and appropriate measures to retain personal data only for as long as needed to serve the identified purposes of processing

9 Recourse, Enforcement, and Liability Principle Duty to self-certify compliance Expanded oversight by Department of Commerce ( DOC ) Provide DOC with copies of vendor agreements, human resources privacy policies, and other materials upon request Privacy Shield establishes significant procedural oversight for the program, including: Obligations to respond to individual complaints within 45 days Obligations to comply with DPA advice within 25 days Department of State Ombudsperson for National Security complaints Referrals to the Federal Trade Commission Back-stop arbitration of unresolved residual claims

10 Questions? Brian Hengesbaugh Baker & McKenzie, LLP Partner, Chicago T: (312) E: Harry Valetk Baker & McKenzie, LLP Partner, New York T: (212) E: Michelle Perez Interpublic Group Assistant General Counsel and Chief Privacy Officer New York, New York James Byrne Lockheed Martin Corporation Associate General Counsel and Chief Privacy Officer Washington, DC