Article

• Jurisdiction: United States,Federal,European Union
• Citation: Vol. 36 No. 1 Pg. 44
• Pages: 44
• Publication year: 2023

Article Vol. 36 No. 1 Pg. 44 Utah Bar Journal January, 2023

January, 2023

US Intelligence Laws & EU Data-Transfer Requirements: Tools for Assessing US Law & Implementing Supplementary Measures to Meet EU Protection Levels

by Ryan Beckstrom and Kyle Petersen

As companies become more data driven and the global economy becomes increasingly interconnected, US-based companies that process data of European Union (EU) data subjects must carefully evaluate whether the mechanism of their transfer of that data to the US adequately protects it. This is because there is now greater emphasis under EU law on ensuring the protections available to personal data within the EU travel with the data wherever it goes.

Companies transferring data from the EU to another country must evaluate the laws and practices of that country to determine if they provide an "essentially equivalent" level of protection to that provided by EU law. If they do not, the company must implement additional safeguards to fill the gaps in the protection left or created by the country's laws and elevate it to the level required by EU law. This article provides background and context on the genesis of these requirements, tools for completing an assessment of US laws that may threaten the level of protection for EU personal data, and an overview of the process for identifying and implementing additional safeguards for that data.

BACKGROUND AND CONTEXT

In 2011, an Austrian college student named Max Schrems initiated a series of court cases before the Court of Justice of the European Union (CJEU) that would eventually upend existing mechanisms for data transfers between the United States and the EU. When Facebook's lawyer, Ed Palmieri, spoke to Schrems's college class at Santa Clara University, Schrems was appalled at Palmieri's lack of knowledge about European data protection laws. Kashmir Hill, Max Schrems: The Austrian Thorn in Facebook's Side, Forbes (Feb. 7, 2012), https://www.forbes.com/sites/kashmirhill/ 2012/02/07/the-austrian-thorn-in-iacebooks-side. Schrems determined to write a paper about Facebook's ignorance of European law and as part of his research requested Facebook's records on him. Id. In response, Facebook provided over a thousand pages of documents about him - all his past messages and chats, every "poke" he ever received, every event he attended - including many that he believed had been deleted. Id.

Schrems filed complaints with the Irish Data Protection Agency that resulted in a sequence of cases and opinions from the CJEU. In the most recent decision, Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (Schrems II), the CJEU expressed particular concern about US surveillance laws and modified two important mechanisms for transfers of data from the EU to the US - (1) invalidating the EU-US Privacy Shield and (2) imposing enhanced restrictions on the use of the EU Standard Contractual Clauses (SCCs) for transfers to the US. See generally Case No. 311-18, EU:C:2020:559 (July 16, 2020), https://eur-lex.europa.eu/leg3l-content/EN/TXT/HTML/?uri= CELEX:62018CJ0311&from=en. Now, companies transferring

RYAN BECKSTROM is Corporate Counsel at Domo, Inc. He is a Certified Information Privacy Professional (CIPP/E).

KYLE PETERSEN is Senior Counsel, Data Privacy & Product at O.C. Tanner. He is a Certified Information Privacy Professional (CIPP/E).

data from the EU to the US pursuant to SCCs must verify, on a case-by-case basis, whether the law of the United States ensures an adequate level of protection for the data and impose additional safeguards where it does not.

The European Data Protection Board (EDPB) has adopted post-Schrems II recommendations for undertaking this evaluation, including a blueprint for assessing transfers and implementing, where necessary, additional safeguards to protect personal data. The heart of this blueprint is what's commonly called a Transfer Impact Assessment (TIA), which for US-based companies involves an...