US relations with the European Union took another hit earlier this month, when the European Parliament voted to suspend Privacy Shield, the agreement between the US and the EU that allows companies to transfer the personal information of EU citizens out of the EU to US companies that have promised to adhere to the General Data Protection Regulation (GDPR). Between the Facebook-Cambridge Analytica scandal, the passage of the CLOUD Act, and the Russian hack (sorry–alleged Russian hack) of the 2016 election, the EP felt that Privacy Shield did not provide an adequate level of protection for EU citizens. The US has until September 1 to become compliant.
The good news is that the EP’s concerns largely relate to inadequate protections on the part of the US government, as opposed to any shortcomings with the scheme itself. This means that if the US addresses all of the EP’s concerns, those entities that have already applied for and been accepted into the Privacy Shield program will need to do very little to remain compliant (other than fully comply with the GDPR, but that’s another issue altogether).
