Common use of Government Assurances Clause in Contracts

Government Assurances. The U.S. government has given the EU written assurance that any access by public authorities for national security purposes will be subject to defined limitations, safeguards, and supervision. An Ombudsperson within the Department of Commerce—independent from the national security agencies—will be appointed through whom EU citizens will be able to submit complaints or inquiries regarding possible access to personal information by U.S. intelligence services. Additionally, under the Judicial Redress Act, EU citizens will have access to U.S. courts to enforce privacy rights related to the transfer of personal information to the U.S. for law enforcement purposes. Interim Compliance Because the Privacy Shield has not yet been adopted, U.S. companies that received personal data of EU citizens under the Safe Harbor will need to use alternative mechanisms to comply with data sharing requirements of the Data Protection Directive 95/96/EC (“Directive”). The Directive regulates the export of personal data outside of the European Economic Area (“EEA”) and prohibits EU companies from transferring personal data to companies outside the EEA unless those companies ensure adequate protection for the data (such as under the Privacy Shield). The Directive is implemented through the local laws of the Member States. The relevant DPA could, if it sees fit, launch enforcement actions against companies that have not implemented alternative, compliant data transfer mechanisms. WHAT WILL U.S. COMPANIES HAVE TO DO TO COMPLY WITH THE EU PRIVACY SHIELD AGREEMENT? A U.S. company can continue receiving personal data by entering into certain standard forms of contracts known as EU Model Clauses or adopting so-called Binding Corporate Rules. Failure to comply with the Directive could result in the relevant DPA imposing monetary fines and sanctions, such as prohibiting future transfers of personal information (because the Directives are implemented through the laws of the Member States, the privacy laws of the Member State from which the data will be exported should be consulted).