Does your business process data in America? If so, read on...

Facebook has been in the news again this month, this time thanks to an Austrian citizen, a Mr Schrems, who claimed that his Facebook data should not be processed by the company’s servers in the United States of America. He argued that the so-called US “Safe Harbour” scheme, an internationally agreed set of rules which allowed data to be transferred out of the European Economic Area to participating US companies, did not adequately safeguard his data to an EU equivalent standard. The Court of Justice of the European Union agreed, and declared the Safe Harbour scheme, which had been running since 2000, invalid because it allowed interference by the United States public authorities.

The data protection laws in Jersey and Guernsey are similar to those in the EU. Anyone transferring personal data outside the EEA - including to America - must satisfy themselves that the data will be adequately protected when it gets there. Because America does not have any federally mandated data protection legislation, the Safe Harbour scheme was often relied upon as an assurance of adequacy afforded by those who voluntarily signed up to it.

Where, then, does this leave local businesses which transfer data to the US? The Office of the Information Commissioner in Jersey and Guernsey has announced that it will be working with its European colleagues to review the impact of the EU ruling but that, in the meantime, businesses should:

•   Review all data transfers to identify which data, if any, is transferred to the US;

•   Where data is transferred to service providers in the US, review the relevant contracts for any reference to the Safe Harbour scheme; and

•   Where these transfers are carried out in reliance on the Safe Harbour scheme, explore an alternative suitable mechanism to ensure the data is adequately protected in the US.

It is important that local businesses react now to these recommendations so that they are ready to take action when a further announcement is made by the Information Commissioner as to the full impact of the EU ruling in the islands.

For assistance or advice on this important development, please do not hesitate to contact us.