Privacy Shield update

At dotdigital, we take our responsibilities around data protection very seriously and wanted to make sure that we address any immediate questions that our customers may have.

Last week, on Thursday 16 July, the European Court of Justice set out a judgement that has important implications for international data transfers. The main takeaway from the judgement was that the EU – U.S. Privacy Shield was held to be invalid.

At dotdigital, we take our responsibilities around data protection very seriously and wanted to make sure that we address any immediate questions that our customers may have.

Background

The EU – U.S. Privacy Shield was a mechanism where U.S.-based organizations could self-certify to comply with EU data protection requirements when transferring personal data from the European Union to the United States.

The decision in the Schrems II case last week focussed on whether U.S. laws ensured the adequate protection of data, looking at two widely relied-upon mechanisms of transferring data to the U.S. – the Privacy Shield framework and Standard Contractual Clauses (SCCs).

In summary, the court declared that the EU – U.S. Privacy Shield was insufficient to ensure the protection of EU personal data. Importantly, the court confirmed that the SCCs remained a valid mechanism for the transfer of data from the EU to the U.S.

What this means

The big impact is for any companies that until now have relied on the EU–U.S. Privacy Shield for data transfers from the European Union to the United States – as these are no longer valid.

Any organization relying on this mechanism alone should implement alternative safeguards.

Your data and dotdigital

dotdigital has maintained U.S. Privacy Shield certification and we do have a number of relationships with organizations in the United States. More details around these sub-processors can be found on our Trust Center pages here.

However, the Privacy Shield has been under scrutiny for some time and we have never relied on the Privacy Shield alone.

dotdigital has entered into contracts with the organizations listed on our Trust Center to ensure the safeguarding of personal data, including entering into Data Processing Agreements reflecting the obligations under the GDPR, passing down the measures of the EU Model Contract Clauses to ensure that all customer data is protected.

We will of course continue to monitor developments in relation to any transfers around personal data to make sure that any customer data is safeguarded.


If you have any questions relating to the above, please email privacy@dotdigital.com

This article should not be interpreted as legal advice and the contents are intended for informational purposes only.

What is the perfect ecommerce customer journey?

2020 sucked, right? I’m stating the obvious here, I know because it was a testing and interesting year for all. Browsing and buying habits changed as our customers adjusted to the “new norm.” I know, the new…

Top five content trends for 2021

Indeed, a recent Accenture poll concluded the average consumer has “dramatically evolved”, while a YouGov survey found 27% of consumers say that item cost is now a more important factor when shopping as half of workers have…

How to write the perfect email marketing copy

Email marketing requires you to wear many hats – you have to be a designer, a data analyst, a workflow expert, and more. And, after all of that, you’re left with one of the hardest jobs of all:…

This site uses cookies to improve your user experience. By using this site you agree to these cookies being set. To find out more see our cookies policy.