The new 'privacy shield' agreement on the transfer of personal data between the US and the European Union has become operational. The bilateral agreement replaces the previous 'safe harbour' designation for the US, which was struck down by the European Court of Justice for not meeting EU privacy standards.
As of 01 August, businesses can 'self-certify' through a special website set up by the US Department of Commerce to ensure they meet the criteria for protecting personal data transferred across the Atlantic. The certification must be renewed annually.
Each business wanting to make trans-Atlantic data transfers must develop its own privacy policy incorporating the 23 principles of data protection enshrined in the privacy shield and also set up an independent recourse mechanism, such as joining an alternative dispute resolution system, so data subjects may file and resolve complaints about how their data is handled.
The European Commission has also published a guide for citizens on the principles of the agreement, how they can expect their data to be handled by businesses and organisations and what to do if they suspect misuse. A new independent ombudsperson will also be available for complaints about alleged violations of privacy and misuse of personal data by national intelligence services.
Source: http://www.telecompaper.com/news/us-starts-certification-for-new-privacy-shield-terms--1155840