Insights Association > old pages > Privacy Shield > About the Frameworks

Privacy Shield Frameworks

The U.S. Department of Commerce (DOC) worked closely with the European Commission and Swiss Government to create the EU-U.S. Privacy Shield and Swiss-U.S. Privacy Shield Frameworks to provide a mechanism to comply with EU and Swiss data protection requirements for transferring personal data from the European Union (EU) to the United States and from Switzerland to the United States.

On July 12, 2016 the European Commission announced the approval of the EU-U.S. Privacy Shield Framework, which replaces the U.S.-EU Safe Harbor Framework, as a valid mechanism to comply with EU data protection requirements when transferring personal data from the EU to the United States. Self-certifications to the EU-U.S. Privacy Shield Framework were first accepted on August 1, 2017. And, on January 12, 2017 the Swiss-U.S. Privacy Shield Framework was announced by the DOC and the Swiss government to provide organizations with a mechanism to comply with Swiss data protection requirements when transferring personal data from Switzerland to the United States. Starting April 12, 2017, organizations can self-certify to the Swiss – U.S. Privacy Shield Framework.

The Privacy Shield Frameworks are administered by the U.S. Department of Commerce and enable U.S.-based organizations to self-certify to the Frameworks in order to benefit from recognition of the use of valid data transfer mechanisms. This is based on the fact that the Frameworks themselves ensure an adequate level of protection for the personal data transferred to self-certified U.S.-based organizations.

To join the Privacy Shield frameworks administered by the DOC, a U.S.-based organization will be required to self-certify to the DOC and publicly commit to adhere to the Frameworks’ requirements. While joining either of these DOC-administered programs is voluntary, once an eligible organization makes the public commitment to comply with the Frameworks’ requirements, the commitment will become enforceable under U.S. law.

More information may be found on the DOC’s Privacy Shield website: www.privacyshield.gov.

 

Requirements

The EU-U.S. and Swiss-U.S. Privacy Shield Frameworks are made up of seven privacy principles and 16 equally binding supplemental principles, which add dimension to the first seven. Together, all 23 Privacy Shield Principles constitute the requirements that govern participating organizations’ use and treatment of personal data received from the EU and Switzerland under the Frameworks and the access and recourse mechanisms that participants must provide to individuals in the EU and Switzerland. Once an organization publicly commits to comply with the Privacy Shield Principles, that commitment is enforceable under U.S. law.

Differences between the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks:

  • The Principles under the two frameworks include the same requirements, with the only exceptions being:
    • The Swiss Federal Data Protection and Information Commissioner’s authority substitutes for that of the EU DPAs’ authority throughout the Swiss-U.S. Privacy Shield compared to the EU-U.S. Privacy Shield. 
    • The definition of sensitive data under the Choice Principle is modified slightly under the Swiss-U.S. Privacy Shield, including ideological views or activities, information on social security measures or administrative or criminal proceedings and sanctions, which are treated outside pending proceedings.
    • At the first annual review, the Department of Commerce will work with the Swiss Government to put in place the binding arbitration option in Annex I of the Swiss-U.S. Privacy Shield Framework.

Definitions:

• “Personal data” and “personal information” are data about an identified or identifiable individual that are within the scope of the Directive, received by an organization in the United States from the European Union, and recorded in any form.

• “Processing” of personal data means any operation or set of operations which is performed upon personal data, whether or not by automated means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure or dissemination, and erasure or destruction.

• “Controller” means a person or organization which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Principles:

1. Notice

a.  An organization must inform individuals about:

i.    its participation in the Privacy Shield and provide a link to, or the web address for, the Privacy Shield List,

ii.    the types of personal data collected and, where applicable, the entities or subsidiaries of the organization also adhering to the Principles,

iii.    its commitment to subject to the Principles all personal data received from the EU in reliance on the Privacy Shield,

iv.    the purposes for which it collects and uses personal information about them,

v.    how to contact the organization with any inquiries or complaints, including any relevant establishment in the EU that can respond to such inquiries or complaints,

vi.    the type or identity of third parties to which it discloses personal information, and the purposes for which it does so,

vii.    the right of individuals to access their personal data,

viii.    the choices and means the organization offers individuals for limiting the use and disclosure of their personal data,

ix.    the independent dispute resolution body designated to address complaints and provide appropriate recourse free of charge to the individual, and whether it is: (1) the panel established by DPAs, (2) an alternative dispute resolution provider based in the EU, or (3) an alternative dispute resolution provider based in the United States,

x.    being subject to the investigatory and enforcement powers of the FTC, the Department of Transportation or any other U.S. authorized statutory body,

xi.    the possibility, under certain conditions, for the individual to invoke binding arbitration,

xii.    the requirement to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, and

xiii.    its liability in cases of onward transfers to third parties.

b.    This notice must be provided in clear and conspicuous language when individuals are first asked to provide personal information to the organization or as soon thereafter as is practicable, but in any event before the organization uses such information for a purpose other than that for which it was originally collected or processed by the transferring organization or discloses it for the first time to a third party.

2. Choice

a.    An organization must offer individuals the opportunity to choose (opt out) whether their personal information is (i) to be disclosed to a third party or (ii) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individuals.  Individuals must be provided with clear, conspicuous, and readily available mechanisms to exercise choice.

b.    By derogation to the previous paragraph, it is not necessary to provide choice when disclosure is made to a third party that is acting as an agent to perform task(s) on behalf of and under the instructions of the organization.  However, an organization shall always enter into a contract with the agent.

c.    For sensitive information (i.e., personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual), organizations must obtain affirmative express consent (opt in) from individuals if such information is to be (i) disclosed to a third party or (ii) used for a purpose other than those for which it was originally collected or subsequently authorized by the individuals through the exercise of opt-in choice.  In addition, an organization should treat as sensitive any personal information received from a third party where the third party identifies and treats it as sensitive.

3. Accountability for Onward Transfer

a.    To transfer personal information to a third party acting as a controller, organizations must comply with the Notice and Choice Principles.  Organizations must also enter into a contract with the third-party controller that provides that such data may only be processed for limited and specified purposes consistent with the consent provided by the individual and that the recipient will provide the same level of protection as the Principles and will notify the organization if it makes a determination that it can no longer meet this obligation.  The contract shall provide that when such a determination is made the third party controller ceases processing or takes other reasonable and appropriate steps to remediate.

b.    To transfer personal data to a third party acting as an agent, organizations must: (i) transfer such data only for limited and specified purposes; (ii) ascertain that the agent is obligated to provide at least the same level of privacy protection as is required by the Principles; (iii) take reasonable and appropriate steps to ensure that the agent effectively processes the personal information transferred in a manner consistent with the organization’s obligations under the Principles; (iv) require the agent to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Principles; (v) upon notice, including under (iv), take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vi) provide a summary or a representative copy of the relevant privacy provisions of its contract with that agent to the Department upon request.

4. Security

a.    Organizations creating, maintaining, using or disseminating personal information must take reasonable and appropriate measures to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.

5. Data Integrity and Purpose Limitation

a.    Consistent with the Principles, personal information must be limited to the information that is relevant for the purposes of processing.2 An organization may not process personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual.  To the extent necessary for those purposes, an organization must take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current.  An organization must adhere to the Principles for as long as it retains such information.

b.    Information may be retained in a form identifying or making identifiable3 the individual only for as long as it serves a purpose of processing within the meaning of 5a. This obligation does not prevent organizations from processing personal information for longer periods for the time and to the extent such processing reasonably serves the purposes of archiving in the public interest, journalism, literature and art, scientific or historical research, and statistical analysis. In these cases, such processing shall be subject to the other Principles and provisions of the Framework. Organizations should take reasonable and appropriate measures in complying with this provision.

*****

2. Depending on the circumstances, examples of compatible processing purposes may include those that reasonably serve customer relations, compliance and legal considerations, auditing, security and fraud prevention, preserving or defending the organization’s legal rights, or other purposes consistent with the expectations of a reasonable person given the context of the collection.

3. In this context, if, given the means of identification reasonably likely to be used (considering, among other things, the costs of and the amount of time required for identification and the available technology at the time of the processing) and the form in which the data is retained, an individual could reasonably be identified by the organization, or a third party if it would have access to the data, then the individual is "identifiable."

6. Access

a.    Individuals must have access to personal information about them that an organization holds and be able to correct, amend, or delete that information where it is inaccurate, or has been processed in violation of the Principles, except where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the case in question, or where the rights of persons other than the individual would be violated.

7.  Recourse, Enforcement and Liability

a.    Effective privacy protection must include robust mechanisms for assuring compliance with the Principles, recourse for individuals who are affected by non-compliance with the Principles, and consequences for the organization when the Principles are not followed.  At a minimum such mechanisms must include:

    i.    readily available independent recourse mechanisms by which each individual’s complaints and disputes are investigated and expeditiously resolved at no cost to the individual and by reference to the Principles, and damages awarded where the applicable law or private-sector initiatives so provide;

    ii.    follow-up procedures for verifying that the attestations and assertions organizations make about their privacy practices are true and that privacy practices have been implemented as presented and, in particular, with regard to cases of non-compliance; and

    iii.    obligations to remedy problems arising out of failure to comply with the Principles by organizations announcing their adherence to them and consequences for such organizations.  Sanctions must be sufficiently rigorous to ensure compliance by organizations.

b.    Organizations and their selected independent recourse mechanisms will respond promptly to inquiries and requests by the Department for information relating to the Privacy Shield.  All organizations must respond expeditiously to complaints regarding compliance with the Principles referred by EU Member State authorities through the Department.  Organizations that have chosen to cooperate with DPAs, including organizations that process human resources data, must respond directly to such authorities with regard to the investigation and resolution of complaints.

c.    Organizations are obligated to arbitrate claims and follow the terms as set forth in Annex I, provided that an individual has invoked binding arbitration by delivering notice to the organization at issue and following the procedures and subject to conditions set forth in Annex I.

d.    In the context of an onward transfer, a Privacy Shield organization has responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf.  The Privacy Shield organization shall remain liable under the Principles if its agent processes such personal information in a manner inconsistent with the Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

e.    When an organization becomes subject to an FTC or court order based on non-compliance, the organization shall make public any relevant Privacy Shield-related sections of any compliance or assessment report submitted to the FTC, to the extent consistent with confidentiality requirements.  The Department has established a dedicated point of contact for DPAs for any problems of compliance by Privacy Shield organizations.  The FTC will give priority consideration to referrals of non-compliance with the Principles from the Department and EU Member State authorities, and will exchange information regarding referrals with the referring state authorities on a timely basis, subject to existing confidentiality restrictions.

Supplemental Principles:

1. Sensitive Data

2. Journalistic Exceptions

3. Secondary Liability

4. Performing Due Diligence and Conducting Audits

5. The Role of the Data Protection Authorities

6. Self-Certification

7. Verification

8. Access

9. Human Resources Data

10. Obligatory Contracts for Onward Transfers

11. Dispute Resolution and Enforcement

12. Choice-Timing of Opt Out

13. Travel Information

14. Pharmaceutical and Medical Products

15. Public Record and Publicly Available Information

16. Access Requests by Public Authorities

Learn more about the Privacy Shield requirements from the Department of Commerce

FAQs

Q. Does the fee cover our application process with the Department of Commerce as well, or is that handled separately?

A. Separately. You must register with the Department of Commerce in addition to enrolling in the Insights Association Privacy Shield Program. This is done by creating an online account at www.privacyshield.gov. You must pay the DOC fee directly to Commerce and it is separate from the fee paid to the Insights Association for the dispute resolution services provided through the Insights Association Privacy Shield Program.

Q. Once we begin the process through the Insights Association, how long does the review and certification typically take?

A. It typically takes the Insights Association between 2-3 days (depending on how quickly material is provided) to review your company's privacy policy. It will likely take 2-4 weeks, on average, to hear back from the Privacy Shield reviewer working on your application and policy.

Q. What are the steps involved to be accepted into the Insights Association Privacy Shield Program?

A.  You will have to:

  1.        Be a company member of the Insights Association (or have applied and have no apparent obstacles to membership)
  2.        Submit the application to the Insights Association Privacy Shield Program found here
  3.        Ensure that all relevant privacy policies are in compliance with the Framework(s) – There are a couple ways we can do this - we will send you a checklist and/or you send to us all relevant privacy policies for review and they will be returned with necessary changes indicated.
  4.        Once your privacy policies are approved and you are accepted into our program you go on to www.privacyshield.gov and register. The DOC will review your posted policies and check with the Insights Association to confirm your participation. If all is in order they will register you.

Q. Are there any other fees involved?

A. Yes. It is the member company’s responsibility to pay into the Arbitral Fund. This fee is outside of the Insights Association annual program fee. More information, and the payment portal, can be found here: http://go.adr.org/privacyshieldfund.html

Beyond those annual fees, the only additional fees would arise if you receive a complaint that persists to the arbitration stage, which is very unlikely.