By Lisa Mays and Scott Maberry
Like a needle to a balloon, the Schrems decision has drastically altered the data privacy landscape. Who is affected? Everyone – consumers, corporations, employees. But who needs to take action? Any company with offices in the European Union and the United States, any European company that outsources work to the United States (do you know where your cloud is?), and any company that sends information from the EU to the United States.
The European Court of Justice’s Decision in Schrems v. Data Protection Commissioner
Before diving into the meat of the Schrems case, you may be asking yourself – who is Schrems? Who is behind this monumental shift in privacy law affecting businesses across the globe? Maximillian Schrems is an Austrian law student (never underestimate the power of a motivated law student), who is completing his Ph.D in law at Vienna University.
Also never underestimate the impact of some Silicon Valley exposure. Schrems’ interest in privacy law developed while spending a semester abroad at Santa Clara University in California. Concerned about the privacy of social media users messaging online, Schrems filed 23 complaints against Facebook in Ireland, targeting the activities of the company’s European headquarters. While the Irish Data Protection Commissioner wrote off the first 22 complaints, the 23rd complaint reached the European Court of Justice, which gave us the Schrems decision.
The Schrems Decision
On October 6, 2015, the European Court of Justice issued the Schrems decision declaring the European Commission’s 15-year-old “U.S. Safe Harbor decision” invalid. That earlier decision enabled U.S. companies to self-certify that company practices ensured an adequate level of protection for personal data under the EU Data Protection Directive, thus permitting the company to transfer data from the EU to the United States. The ECJ’s Schrems decision holds that U.S. law does not afford adequate protection to personal data. As a result, the safeguards of the U.S. Safe Harbor have been thrown to the wayside.
The Effect of the Schrems Case on Business Transactions
Where does this leave us?
First, it is necessary to determine where your company stores, transmits, and uses its data. Any company that has offices in both the EU and United States, any European company that outsources work to the United States, and any company that sends information from the EU to the United States, must reevaluate its policies and make necessary adjustments. Data transfers from the EU to the United States trigger the provisions of the EU Data Protection Directive and may come under scrutiny. Many companies utilize U.S.-based cloud services, so although you may assume that your company keeps all personal data outside of U.S. jurisdiction, now is the time to double-check.
Second, companies can no longer rely on Safe Harbor self-certification. Now companies need to independently verify that company transfers of personal data from the EU to the United States meet the level of data privacy protection considered adequate by the EU Data Protection Directive.
Solutions in a Post-Schrems Landscape
There are a variety of customizable solutions to fill the void created by the Schrems decision ranging from implementation of contract clauses, to adding encryption to data, to moving data centers to the EU. In a November 6, 2021 press release, the European Commission recommends that companies consider using the EU-approved standard contractual clauses, the EU-approved Binding Corporate Rules, or the enumerated derogations under which data can be transferred. While there are several possible solutions, what is certain is that immediate action is necessary as data regulators have indicated that we should expect more investigations in a post-Schrems world.
Enter: The Foreign Corrupt Practices Act (FCPA)
Complicating matters further, we must consider the impact of the Schrems decision on FCPA compliance and investigations. In broad summary, the FCPA comprises two components. First, the anti-bribery provisions prohibit paying foreign officials to obtain or retain business. Second, the recordkeeping and internal control provisions require accurate accounting and adequate internal controls. The jurisdiction of the FCPA is far-reaching and hinges on the use of interstate commerce by a U.S. or foreign person. As a result of the broad reach of the FCPA and its recent aggressive enforcement, companies need compliance policies to maintain watch over company actors to avoid inadvertently violating the FCPA.