DATA PRIVACY & SECURITY SPECIAL REPORT SEPT. 24, 2020 After EU judges struck down the Privacy Shield data-transfer agreement, what’s next for US tech Making giants, thousands of other companies and regulatory the Cut? regimes around the world? INSIGHT | COMMENTARY | ANALYSIS Editor’s Letter Lewis Crofts MLex Editor-in-Chief We have arranged it in three thematic sections to reflect the multiple moving parts of the topic: 1) the EU court’s decision and immediate effects on Facebook and other companies; 2) the scramble by the US and EU to work out what to do about replacing the binned agreement and making SCCs more robust; and headache. A bombshell. A seismic shift. 3) the concerns and responses by other affected However dramatic you might like your countries around the world — including the UK, A metaphors, there is little doubt that EU Japan and Australia. judges delivered an extraordinarily significant We trust you enjoy reading this report and ruling on July 16. In striking down Privacy Shield, find it a useful guide to a complex, evolving issue. the EU-US data-transfer framework, they instantly The reporting here is a brief example of the threw into doubt the operations of more than insight and predictive analysis that MLex brings 5,000 US companies that relied on it. subscribers to our data privacy and security The ruling — essentially based on the failure service every day. of the mechanism to protect EU citizens’ data The stories included were all published from US government snooping — doesn’t as events unfolded, bringing our subscribers prevent companies transferring data between unrivalled insight into the significance of the EU and other foreign countries under developments and the likely next steps in an issue “standard contractual clauses.” But these can’t that will affect the operations of many thousands protect data in countries, including the US, that of businesses around the world. don’t have protections for citizens’ rights and Data privacy and security represent a new privacy as tough as those in the EU. That drives major front in regulation, enforcement and a cart and horses through the procedures of compliance worldwide. MLex has been at the thousands more US and European companies, forefront of providing forensic and predictive notably Facebook and other tech giants. insight, commentary and analysis on this This special report is a collection of key emerging area of regulatory risk for years. stories published by MLex in recent weeks To find out more about our range of areas making sense of this muddle, highlighting the of interest and subscriber services — and to ask areas of greatest regulatory risk for businesses for a trial — see the contact details on the back and looking ahead, where possible, to spot page of this report or visit our website directly at emerging fixes. mlexmarketinsight.com. n MLex is an investigative news agency solely dedicated to uncovering regulatory risk and uniquely positioned to provide exclusive, real-time market insights, news and analysis. We monitor the activity of governments, agencies and courts to identify and predict the impact of legislative proposals, regulatory decisions and legal rulings. MLex’s unique reporting by our journalists across 14 international bureaux. Antitrust • Data Privacy & Security • Financial Crime • M&A • Sector Regulation • State Aid • Trade MAKING THE CUT? | SPECIAL REPORT | SEPT. 24, 2020 2 << RETURN TO CONTENTS << Contributors Mike Swift Sachiko Sakamaki Laurel Henning Chief Global Digital Risk Correspondent Senior Correspondent, Tokyo Senior Correspondent, Sydney Formerly chief Internet reporter for the San Sachiko covers antitrust, anti-bribery & Laurel is a senior correspondent covering Jose Mercury News and SiliconValley.com, corruption, and privacy & cyber security. data privacy and security, antitrust Mike has covered Google, Facebook, Apple She has an undergraduate degree from and mergers and acquisitions across and other major Silicon Valley companies Waseda University in Tokyo and a Australia and New Zealand. Prior to that, closely as he followed trends in search, the master’s degree in communications from Laurel spent a year spearheading MLex’s mobile web and online social networks. He United States International (now Alliant activist investment coverage, looking helps coordinate MLex coverage of privacy International) University in California. She at boardroom disputes and shareholder and data security worldwide. A former John previously worked as a journalist for Time campaigns agitating for changes to S. Knight Fellow at Stanford University, he is magazine, the Far Eastern Economic Review, company strategy. Laurel joined MLex a graduate of Colby College. He is an award- Bloomberg News, and the Washington Post in 2013 and reported for five years on winning journalist with expertise ranging in Japan. European energy and climate policies from from the business of professional sports to Brussels. In that time, Laurel covered the computer-assisted reporting. regulation of emissions and technological Dave Perera developments pertaining to the energy Data Security & Privacy Reporter sector within the EU. A graduate of the Matthew Newman University of Liverpool, Laurel studied Dave joined the Washington DC office Chief Correspondent, Europe English and French before beginning a as our new technology reporter as we career in journalism with MLex. Matthew writes about mergers, antitrust built out that part of our coverage. He is a and cartel investigations as well as digital veteran cybersecurity reporter for Politico risk. Matthew began covering competition and a former editor for FierceMarkets Jakub Krupa at the Luxembourg courts in 2004 and publications. Dave studied Spanish and then moved to Brussels. After working as a Italian literature at the University of Digital Risk Correspondent spokesman for the European Commission Colorado, and has a Master’s degree Jakub joined MLex’s London team in until April 2012, he spent several months from the Columbia University School of August 2020 to handle data privacy in Washington, DC writing about mergers International and Public Affairs. and security. Based in the UK since for MLex. He spent a year studying French, 2012, he previously worked as the UK history and communications in Grenoble, correspondent for the Polish Press France and is a graduate of Boston Joanna Sopinska Agency, leading the coverage on Brexit, University with degrees in history and Trade Correspondent UK politics and relations with the EU. journalism. His stories also featured in other leading Joanna covers trade in Brussels. Formerly outlets, including The Guardian and the trade editor of EU Trade Insights, she Evening Standard. He is also a regular Vesela Gladicheva has many years’ experience reporting commentator on Poles in the UK. on trade, investment policy and foreign Senior Technology, Media affairs. Before that, she spent nine years and Telecom Correspondent at Europolitics news agency writing on Vesela reports on topics including telecom trade, agriculture policy and foreign affairs. regulation, privacy, cybersecurity and Before moving to Brussels in 2006, Joanna copyright, focusing on EU regulatory worked as an analyst at the Polish Institute and legal risk in the telecoms, media and of International Relations (PISM) in Warsaw. technology (TMT) sectors. She holds a She holds a postgraduate diploma in the Master’s degree in journalism from City European public affairs from Maastricht University London, and works in English, University in the Netherlands and an MA in Spanish, French and Bulgarian. international relations from University of Lódź in Poland. MAKING THE CUT? | SPECIAL REPORT | SEPT. 24, 2020 3 << RETURN TO CONTENTS << Introduction Mike Swift Chief Digital Risk Correspondent A data crisis erupted in July, when EU judges annulled the EU-US Privacy Shield and raised doubts about cross-border transfer mechanisms used by the likes of Facebook and other big Internet platforms. What happens next? ax Schrems just won’t go away. For the second time in five years, the legal basis M for much of the world’s data transfers has been thrown into question as a consequence of the Austrian privacy advocate’s relentless efforts; after EU judges’ invalidation in 2015 of the EU-US Safe Harbor trans-Atlantic data transfer framework in what became known as the “Schrems I” decision, this July came “Schrems II” that annulled that machanism’s successor, Privacy Shield. As EU and US officials this autumn negotiate a response to the EU Court of Justice’s latest decision, which also dented the viability of “standard contractual clauses,” or SCCs, as an international data transfer mechanism, their hope is to avoid experiencing déjà vu all over again, as baseball player Yogi Berra once put it in a trademark malapropism. “I don’t want to speak about a ‘Schrems III’ decision after another five years,” EU justice commissioner Didier Reynders said ruefully Double trouble: Austrian privacy during a recent video conference organized by campaigner Max Schrems. the Brookings Institution in Washington. “Please Photo: Manfred Werner not a Schrems III! So we need to find solutions.” Goodwill and rueful joking aside, crafting a trans-Atlantic data transfer system that will defeat or avoid a third challenge by Schrems won’t be easy. It certainly won’t be as MAKING THE CUT? | SPECIAL REPORT | SEPT. 24, 2020 4 << RETURN TO CONTENTS << straightforward as negotiations following the EU Court nation to permanently harmonize its local privacy laws of Justice’s Schrems I decision five years ago. That’s in with Europe’s General Data Protection Regulation. part because of the timing of the US national elections That goal has in recent years been on the minds this fall, the likely need for US legislation to create of lawmakers and regulators in Japan, Canada, New a more durable solution this time around, and the Zealand, South Korea and Brazil — countries that potential handover of power in the White House and have passed or are in the process of updating national Congress. privacy laws to be more in harmony with GDPR, with an The stakes are particularly high for US Internet eye to gaining an adequacy ruling with the EU.