Tag: Brexit

CJEU Invalidates EU-US Privacy Shield Data Transfers

The Court of Justice of the European Union (CJEU) struck down the EU-US Privacy Shield that allows firms to transfer EU citizen’s private data to the United States for data processing.  The EU maintains higher consumer data privacy laws that conflict with US security and legal policies.

“Today’s decision effectively blocks legal transfers of personal data from the EU to the US.  It will undoubtedly leave tens of thousands of US companies scrambling and without a legal means to conduct transatlantic business, worth trillions of dollars annually,” said Caitlin Fennessy, research director at the International Association of Privacy Professionals (IAPP).

The CJEU held that “the requirements of US national security, public interest and law enforcement have primacy, thus condoning interference with the fundamental rights of persons whose data are transferred to that third country.”

“In the absence of an adequacy decision, such transfer may take place only if the personal data exporter established in the EU has provided appropriate safeguards, which may arise, in particular, from standard data protection clauses adopted by the Commission, and if data subjects have enforceable rights and effective legal remedies…

The Court considers, first of all, that EU law, and in particular the GDPR, applies to the transfer of personal data for commercial purposes by an economic operator established in a Member State to another economic operator established in a third country, even if, at the time of that transfer or thereafter, that data may be processed by the authorities of the third country in question for the purposes of public security, defence and State security. The Court adds that this type of data processing by the authorities of a third country cannot preclude such a transfer from the scope of the GDPR.

Regarding the level of protection required in respect of such a transfer, the Court holds that the requirements laid down for such purposes by the GDPR concerning appropriate safeguards, enforceable rights and effective legal remedies must be interpreted as meaning that data subjects whose personal data are transferred to a third country pursuant to standard data protection clauses must be afforded a level of protection essentially equivalent to that guaranteed within the EU by the GDPR, read in the light of the Charter. In those circumstances, the Court specifies that the assessment of that level of protection must take into consideration both the contractual clauses agreed between the data exporter established in the EU and the recipient of the transfer established in the third country concerned and, as regards any access by the public authorities of that third country to the data transferred, the relevant aspects of the legal system of that third country.

Regarding the supervisory authorities’ obligations in connection with such a transfer, the Court holds that, unless there is a valid Commission adequacy decision, those competent supervisory authorities are required to suspend or prohibit a transfer of personal data to a third country where they take the view, in the light of all the circumstances of that transfer, that the standard data protection clauses are not or cannot be complied with in that country and that the protection of the data transferred that is required by EU law cannot be ensured by other means, where the data exporter established in the EU has not itself suspended or put an end to such a transfer.”

“Data Protection Commissioner Ireland v Facebook Ireland Limited, Maximillian Schrems,” 16 July 2020

The EU-US Privacy Shield was implemented several years ago after the CJEU held that the prior US Safe Harbor regime was insufficient.

Privacy advocate Max Schrems brought the cases that invalidated Safe Harbor and EU-US Privacy Shield.  Following the ruling, he stated:

“It is clear that the US will have to seriously change their surveillance laws, if US companies want to continue to play a role on the EU market…The Court clarified for a second time now that there is a clash of EU privacy law and US surveillance law.  As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people — including foreigners.  Surveillance reform thereby becomes crucial for the business interests of Silicon Valley…

This judgment is not the cause of a limit to data transfers, but the consequence of US surveillance laws.  You can’t blame the Court to say the unavoidable — when shit hits the fan, you can’t blame the fan.”

Privacy Advocate and Plaintiff Max Schrems

“This leaves a huge question mark over data transfers to the US, said Tanguy Van Overstraeten, partner and global head of privacy and data protection law at the law firm Linklaters.  “The Court has struck down the EU-U.S. Privacy Shield because it considers the US state surveillance powers are excessive.  For the thousands of businesses registered with the US Privacy Shield, this will be groundhog day; this is the second time the FTC operated scheme has been struck down after the Shields predecessor — the Safe Harbor — was struck down in 2015.  Businesses will now look to EU regulators to propose some form of transition to allow them to move away from Privacy Shield without the threat of significant sanctions and civil compensation claims.”

The ruling also puts in question data transfers to Russia, China, and potentially the UK post-Brexit.

“The CJEU’s judgment could have implications for the UK’s prospects of gaining adequacy at the end of the Brexit transition period,” said Peter Church, counsel at Linklaters.  “This will necessarily involve an assessment of the UK’s surveillance powers under the Investigatory Powers Act 2016.  However, there are a number of differences between the UK and US regimes.  For example, the UK regime has already been reviewed by the European courts and a number of amendments have been made to bring it into line with European law.  In addition, the UK regime does not have the same distinction between UK and foreign nationals, unlike US law which does not grant the same rights to non-US citizens.”

“This is a bold move by Europe,” said Jonathan Kewley, co-head of technology at law firm Clifford Chance.  “What we are seeing here looks suspiciously like a privacy trade war, where Europe is saying their data standards can be trusted but those in the US cannot.”

Standard Contract Clauses (SCCs) may also be insufficient.  “If the law in the relevant country – let’s say the USA – could override what the contract says, they don’t work,” said Kewley.  “I don’t know how much appetite they have to do this, but it’s hard to imagine that any European regulator would say that SCCs work for the US, and the pressure will pile on for them to make the assessment.  I don’t think SCCs escaped the court’s judgement – for some key countries, it’s probably just a stay of execution.”

One likely impact will be the localized processing of EU consumer data within EU data centers.  Over 5,300 companies rely upon the EU-US Privacy Shield as part of their GDPR and broader EU compliance.  Companies that rely upon the Privacy Shield span a broad set of B2B data, DaaS, social networking, CDPs, and cloud companies [searchable list].  These include Zoominfo, Dun & Bradstreet (including Lattice Engines), Experian, Infogroup, TechTarget, Microsoft (including LinkedIn), Facebook, Twitter, Google, Amazon (including AWS), Oracle, Salesforce, HubSpot, Adobe (including Marketo), LiveRamp, Melissa, TowerData, 6Sense, Leadspace, SalesLoft, Outreach, Groove, VanillaSoft, Yesware, and ConnectLeader.

Firms are also likely to ramp up their GDPR and CCPA compliance messaging, but that does not address the weaker data privacy structures of US law.

Brexit and Sales Intelligence Vendors

BrexitBrexit happened.  Most of us didn’t think it would, but it did.  As an outsider, I’m not going to address the foolishness of the vote and the harm it is already doing to British financial and currency markets.  That would simply be piling on.

But as an analyst of the sales intelligence space, I can make some observations about how it is likely to impact my industry.  The short-term impact will mostly be financial as US firms find that H2 revenue will decline due to the fall in the Pound (and less so the Euro).  Sales Intelligence products are priced in Pounds and do not float so the impact will likely be felt by American vendors reporting lower revenue from their European operations.  I expect the term “currency headwinds” will again become popular on earnings calls.  This situation may be compounded by British firms being more conservative in H2 due to political and economic uncertainty.  They may choose to license fewer seats or hold off on licensing a service.

The British Pound is down ten percent vs. the US Dollar since the Brexit vote (Source: XE.com)
The British Pound is down ten percent vs. the US Dollar since the Brexit vote (Source: XE.com)

Should the pound remain weak going forward, vendors may raise sterling-denominated prices in 2017; but this decision is somewhat dependent upon the location of staff, denomination of licensing contracts, and degree of Brexit economic contraction.  As UK company content is mostly licensed from UK vendors, it is likely to be denominated in Pounds so content licensing expenses are also likely to drop for American vendors.  (US companies will often sign licensing deals in pounds as it provides a partial hedge against currency fluctuation).

Britain is the second most important market for sales intelligence services after the United States.  While other markets may be growing faster, Britain has long been either the home of sales intelligence products (Bureau van Dijk, DueDil, Artesian Solutions) or the logical second market for American firms.  US firms have long enjoyed access to the European market via offices in London and some even configure their products with regional UK and European editions.  Britain will remain a critical market for these companies and there is little reason to believe that American firms cannot continue to sell into the EU via these offices.

But a long-term problem may be staffing their British offices with multi-lingual sales, support, marketing, and editorial staff.  The status of EU citizens working in Britain is unclear and may not be resolved for two years.  A study by Wayra UK found that 34% of British start-up employees are not British citizens with 20.7% of employees carrying EU passports.  Whether EU citizens will continue to freely live and work in Britain is an open question subject to negotiation over the next two years.

Wayra UK found that British startups have a built in competitive advantage from this diversity.  They found that 79% believe that cultural diversity helped them compete while 75% said it helped them overcome challenges and 72% argued that it assisted with new market entry.  However, if EU work visas become an issue, the British will lose this competitive edge.  There is also the negative impact of reduced work and study opportunities for British citizens which will erode British understanding of individual country markets.  In the context of information services, the cost and difficulty of maintaining a multi-lingual research and support staff in Britain may increase.

“Without access to Europe the pool of applicants shrinks dramatically,” DueDil founder Damian Kimmelman told Forbes. “We are a venture-backed business, and a venture-backed business means we are invested in to create super growth. But you can’t create super growth if it’s so difficult to hire the people that can create that super growth. People in tech are the number one commodity.”

DueDil is in the middle of building out its sales intelligence coverage of Europe so multi-lingual staff is critical.  Kimmelman is already looking at expanding operations outside of Britain and will be spending the next few weeks researching options with DueDil executives.  “We’re going to be opening up new offices.  We have to. We’re scaling far too quickly to jeopardize our ability to scale because we have to hire people in the U.K.”

One area of benefit for UK information services may be around Safe Harbour.  The EU is moving towards greater restrictions around personal information and it has always been difficult to gather and market emails.  However, the British have been an exception to this rule with vendors including UK business emails in their products.  A Brexit suggests that the EU Safe Harbour negotiations may become more difficult as continental sensitivities will no longer be balanced by British openness.  The net is emails and executive profiles are likely to remain available in the UK but that complying with EU Safe Harbour restrictions could greatly limit access to executive information and create issues for American multinationals and cloud vendors.

As a shorthand, I’ve color (or should I write colour for the Brits?) coded my analysis to highlight the benefits and drawbacks to Sales Intelligence vendors.  The net is rather negative.  Unless you are marketing British contact files for email campaigns and teleprospecting, it is unlikely that you would welcome the vote’s outcome.  For vendors providing global information services, Brexit provides additional financial and planning challenges in the number two sales intelligence market.