Privacy Shield update

At dotdigital, we take our responsibilities around data protection very seriously and wanted to make sure that we address any immediate questions that our customers may have.

Last week, on Thursday 16 July, the European Court of Justice set out a judgement that has important implications for international data transfers. The main takeaway from the judgement was that the EU – U.S. Privacy Shield was held to be invalid.

At dotdigital, we take our responsibilities around data protection very seriously and wanted to make sure that we address any immediate questions that our customers may have.

Background

The EU – U.S. Privacy Shield was a mechanism where U.S.-based organizations could self-certify to comply with EU data protection requirements when transferring personal data from the European Union to the United States.

The decision in the Schrems II case last week focussed on whether U.S. laws ensured the adequate protection of data, looking at two widely relied-upon mechanisms of transferring data to the U.S. – the Privacy Shield framework and Standard Contractual Clauses (SCCs).

In summary, the court declared that the EU – U.S. Privacy Shield was insufficient to ensure the protection of EU personal data. Importantly, the court confirmed that the SCCs remained a valid mechanism for the transfer of data from the EU to the U.S.

What this means

The big impact is for any companies that until now have relied on the EU–U.S. Privacy Shield for data transfers from the European Union to the United States – as these are no longer valid.

Any organization relying on this mechanism alone should implement alternative safeguards.

Your data and dotdigital

dotdigital has maintained U.S. Privacy Shield certification and we do have a number of relationships with organizations in the United States. More details around these sub-processors can be found on our Trust Center pages here.

However, the Privacy Shield has been under scrutiny for some time and we have never relied on the Privacy Shield alone.

dotdigital has entered into contracts with the organizations listed on our Trust Center to ensure the safeguarding of personal data, including entering into Data Processing Agreements reflecting the obligations under the GDPR, passing down the measures of the EU Model Contract Clauses to ensure that all customer data is protected.

We will of course continue to monitor developments in relation to any transfers around personal data to make sure that any customer data is safeguarded.


If you have any questions relating to the above, please email privacy@dotdigital.com

This article should not be interpreted as legal advice and the contents are intended for informational purposes only.

New release: How to manage the shift from offline to online

Check out all the ins and outs of our new product release, and how our upgraded features can help you drive success during the holiday season.

What is B2B marketing?

In this article, you’ll discover what B2B marketing is, understand the difference between B2B marketing strategies, and learn how to engage and convert your business audience.  What is B2B marketing? B2B marketing refers to the marketing of…

7 ways that AI improves ecommerce in 2020

Discover how AI-powered tools can transform your marketing efforts into effective customer engagement opportunities at scale.

This site uses cookies to improve your user experience. By using this site you agree to these cookies being set. To find out more see our cookies policy.