Date: 24 July 2020
Response to media enquiry on invalidation of the EU-US Privacy Shield
Thank you very much for your enquiry about the invalidation of the EU-US Privacy Shield (Privacy Shield). Our response to your enquiry is as follows:
Enquiry
“We wonder what the implications of the decision are for EU and the US as well as on data transfer at large.
-
Has PCPD reviewed the decision? If so, how PCPD has reacted to the decision that does not seem to be too pro-globalisation
-
What implications may arise for HK businesses which have operations in the EU? How should companies react and what steps should they undertake?
-
Should this be an alert for HK to apply for an adequacy decision?”
Answer:
-
The Privacy Commissioner for Personal Data, Hong Kong (PCPD) notes that the European Court of Justice (CJEU) handed down a landmark judgment in Case C-311/18 Data Protection Commissioner v. Facebook Ireland and Maximillian Schrems (“Judgment”) on 16 July 2020, in which the Court found that the Standard Contractual Clauses (“SCCs”) issued by the European Commission were valid in principle but declared the EU-US Privacy Shield invalid. The CJEU ruled that the protection provided by the Privacy Shield was inadequate for two principal reasons, namely the absence of clear limitations imposed upon the access to personal data transferred from the EU by the U.S. surveillance authorities and the lack of avenues of judicial redress in the U.S. for the data subjects from the EU.
-
The CJEU did not outright ban the transfer of personal from the EU and the U.S. As noted from the Judgment, other avenues for data transfers from the EU to the U.S. are still available (such as the SCCs and Binding Corporate Rules), but additional safeguards would have to be implemented.
-
The PCPD is aware that the Privacy Shield replaced the pre-GDPR Safe Harbour Framework, which was invalidated in 2015. Needless to say, individuals’ expectations to their personal data privacy right have been rising, particularly after the implementation of GDPR in May 2018. The PCPD takes the view that the Judgment reflects a balance among the principles of personal data protection, the rising privacy expectation and the free flow of information facilitating business operations for the stakeholders concerned.
-
While the Judgment is not directly applicable to Hong Kong, the PCPD would continue to monitor the latest developments of the issues involved as well as the consequences and impact of the Judgment to be brought to the global privacy landscape. As always, the PCPD stands ready to support Hong Kong organisations and will collaborate with our counterparts to ensure that global data flows will continue while people’s personal data is adequately protected.