The first quarter of each year is always a good time for many businesses to get their IT strategies in place.
However, there has been one issue in the past few months that may potentially cause a lot of complications in IT departments across the US and EU; the implications for cloud compliance of the recent nullification of the EU Safe Harbour Ruling. Safe Harbour, used by over 4,000 firms to move EU data to the US for the past 15 years, was declared invalid by the European Court of Justice (ECJ) back in October 2015.
Companies on both sides of the Atlantic have been left questioning what impact this will have on IT procedures. This ruling has implications for those organisations that transfer customer data across borders, which is increasingly done via a public cloud.
There are many questions that have been left unanswered for many businesses, as IT and compliance leaders alike are grappling with how to ensure compliance when transferring customer data between the EU and the US.
A rather old framework of regulations, the Safe Harbour Ruling was established in 2000 as a bridge for US and EU firms to share personal data. This was prompted by the EU’s move in 1998 to solidify and unify member states’ personal data regulations; and for many years -15 to be exact - this worked fairly well. As long as both sides of the Atlantic had proper and audited controls in place, personal data moved rather freely.
However, 2015 saw challenges to the framework emerge in the EU courts that resulted in the Safe Harbour provisions being nullified and, in turn, forcing many companies to evaluate their data controls and the geographical location of that data.
So, what does this mean?
Unfortunately, this means a lot on both sides of the pond. If your business has been operating in a multinational fashion, shifting data might have been very trite in the past - it is no longer so.
It is imperative that you begin reviewing your privacy policies and statements as well as HR activities and determine whether you should have EU and US versions. Additionally, data collection requirements are now vastly different.
EU regulations require an informed opt-in whereas in the US the process usually works with an informed opt-out. This is a significant change for many companies that sell, market and do business internationally, which can be onerous and time consuming for companies not used to operating in that fashion. If you are working from the EU side, now is the time to start looking at local cloud service provider options, since US data centres may be violating EU laws and regulations.
Does all of this mean the end of transfers of personal data?
No, business still needs to be done!
Methods and options are available - Model Contract Clauses as well as binding corporate rules can be used to make a transition. However, there can be a substantial overhead cost to mid-sized and smaller organisations. Additionally, both the US and EU governments are working to address the issues with the Safe Harbour framework, but legislation takes time and will most likely lag behind some enforcement activities that are occurring after the January deadline.
Data sovereignty is ever-changing and new rules are being implemented constantly, and while these rulings will immediately affect US companies doing business in Europe, in the coming months this type of ruling will spread through other countries quickly. In the end, this is a disruptor but not a destroyer for business. If you make sure your business is staying on top of the regulations, you’ll not get caught out when the new laws come into play in the near future.
One final note; as with all international laws and frameworks, it is highly recommended that you engage a subject matter expert for more detailed options and plans - or your cloud provider’s compliance and IT security teams. That way you can be assured that you understand all the implications before you determine your strategy.
