News
It’s begun. The first GDPR complaints.
So it didn’t take long for Max Schrems to use the GDPR to file his first complaint. For those of you who don’t know Max Schrems, he’s the privacy...
In a move that spotlights the accelerating importance of data protection and privacy worldwide, Ireland’s High Court will ask the EU’s Court of Justice for a ruling on whether business enterprises operating via the Internet, such as social media giant Facebook, will be allowed to transfer users’ data to the United States.
Needless to say, a ban on data transfers would have huge consequences not only for social media, but for all US enterprises that process data on EU residents, whether for online purchases, accommodation bookings or moving employee data between countries. Just think of all the US websites that are used heavily by Europeans every day: Amazon, Google, HomeExchange, Airbnb, Whatsapp and Booking.com.
The Irish High Court Judge Caroline Costello pointed out that European Union law guarantees a high level of protection to EU residents of their data not only in the European Economic Area, but also when that data is transferred outside it.
When the General Data Protection Regulation (GDPR) comes into effect in May 2018, it will have specific rules regarding the transfer of personal data outside the EU. The GDPR stipulates that any organisation holding or processing personal information belonging to the residents of EU member states must abide by the GDPR rules, and it gives the EU supervisory authorities the ability to enforce these rules.
The US has made efforts to demonstrate their willingness to make some changes by appointing an ombudsperson to deal with Europeans’ complaints about US surveillance, but Costello said that this has not eliminated European concerns.
Reuters reports Irish lawyer Max Schrems as saying he hoped the EU’s Court of Justice would use the request as an opportunity to bridge the gap between the privacy rules of the EU and the US. He also said he didn’t expect the EU to enforce an actual ban.
What is certain, is that business eyes will be on the decision. It’ll probably take 18 months to wind its way through the legal system, but it could mean big changes in terms of how personal data is transferred internationally, not to mention the costs involved in making these changes. So watch this space!
Feel free to make contact with us if you have further questions.
image credit: https://www.irishtimes.com/