This article explains the recent changes that affect the Privacy Shield program and why protecting the privacy and security of personal data is of utmost importance.

Privacy Shield Then and Now

Privacy Shield was a program, agreed upon by the European Commission and the United States Federal Trade Commission, which set up a framework to guarantee adequate privacy protections for European resident data transferred to the United States. It replaced the previous EU-US data transfer framework, SafeHarbor, and set up several new mechanisms aimed at providing enhanced privacy protections for EU personal data, and supporting the individual privacy rights guaranteed by the General Data Protection Regulation.

On July 16, 2020, the Court of Justice of the European Union (CJEU) ruled that Privacy Shield did not meet standards for adequate protection of EU individuals’ personal data.

The Privacy Shield program was developed between the EU and US governments as a way to ensure that EU residents’ personal data received appropriate protection when processed within the US. While much of this framework achieved the stated goal, there were outstanding concerns about US transfers, and the CJEU recently ruled that Privacy Shield could no longer provide adequate protection for EU personal data. In the same ruling, the CJEU has also given support to the Standard Contractual Clauses as a valid mechanism for data transfers out of the EU. Understanding that questions about this might arise, we've addressed a few of them below. Should you have any further concerns, please reach out to our Support team by clicking on the Get Support icon found in the bottom right corner of the page.

Frequently Asked Questions about Privacy Shield

With Privacy Shield invalidated, what data transfer mechanism will Emma use to provide adequacy for transfers to the United States?

Emma will utilize the controller-to-processor EU Standard Contractual Clauses for data transfers from the EU to US within all Data Protection Addendums going forward. The CJEU affirmed the adequacy of these clauses in its ruling, and though they may be amended in the near future, they represent our best path forward to maintaining our commitments to the privacy and security of personal data entrusted to us by customers.

How will Emma keep itself and its customers aware of developments for EU-to-US transfers?

Emma's parent company, Marigold, has a designated Global Data Privacy Manager who is monitoring all developments related to the CJEU ruling cooperatively with our Data Protection Officer, HewardMills. As part of Marigold’s ongoing commitment to data privacy through its privacy governance structure, we will regularly evaluate the effectiveness of the Standard Contractual Clauses, implement guidance from EU regulators, and monitor our compliance with all obligations related to the transfer of EU personal data to third countries.

What does all of this mean, and how will Emma respond to inquiries about Privacy Shield?

Emma is committed to meeting its obligations as a data processor under GDPR. We are taking several key steps to ensure that we continue to meet these obligations for the protection of personal data:

• We’re reviewing our standard DPAs to replace any application of our Privacy Shield participation with the EU Standard Contractual Clauses.
• Our customer-facing teams are prepared to answer customer questions about changes to Emma's compliance with GDPR’s data transfer rules.
• Emma’s data privacy and legal teams continue to monitor developments and seek the guidance of our DPO and regulators as more information is available.

As we take these necessary steps to continue providing service in compliance with the GDPR, we’ll continue to provide updates that are relevant to our Privacy Notices and services.