US companies have been given the go-ahead to digitally transfer consumers’ personal data from the United Kingdom under a new arrangement that avoids additional protective measures. The newly revised compliance framework came into operation on Thursday, enabling companies satisfying eligibility criteria to use the international data bridge. The conditions for eligibility include companies’ self-certification of adherence to a privacy protection standard that aligns with the European Union’s 2016 data privacy law.
The UK Extension of the EU-US Data Privacy Framework emerged after President Joe Biden issued an executive order augmenting privacy protections linked to intelligence-gathering. Companies headquartered in the US that choose to participate stand to gain from this by smoothly transporting data belonging to UK citizens to the US.
Building on the Privacy Shield, the prior trans-Atlantic data-sharing arrangement that a European court invalidated in 2020, the agreement stipulates a more efficient method for data transfer. It delineates the responsibilities of federal regulators for oversight and sets boundaries for US government surveillance. In addition to these, the more than 2,500 US companies already engaging with the refreshed EU program are eligible to certify for the UK extension.
Brian Hengesbaugh, a key contributor to the development of the EU-US Safe Harbor, the precursor to the Privacy Shield, opined that this extension grants a “significant legal advantage” over other data-sharing modes. According to him, companies can use this to underscore their commitment to European privacy compliance, in addition to easing the “administrative burden” that comes with devising standard contractual clauses for each international data transfer.
Over 800 companies, including Google and Microsoft, havealready certified for the UK framework extension. Businesses in sectors such as banking, insurance, and telecommunications, which fall outside the regulatory purview of the FTC or the Transportation Department, are currently ineligible to participate in the frameworks.
While the privacy protections framed under the President’s executive order could be easily revoked or altered, David Aaron, partner at Perkins Coie LLP, believes a future administration is unlikely to rescind it due to its foundational importance for the intelligence community. However, concerns over the framework’s viability have led to apprehensions among some companies about their participation.