More than two-thirds of Irish businesses want the Government to act to provide an interim solution that will allow companies to continue international data transfers following the recent ruling that invalidated the Privacy Shield agreement.
A new study finds that not only is it seen as impacting on Irish companies’ ability to do business in the US, but could also affect how they operate in Britain, following Brexit.
The survey, conducted by the Association of Compliance Officers in Ireland (ACOI), shows that most Irish businesses have been left confused by the decision, known as the Schrems II ruling, and want greater clarity.
Invalid
The Court of Justice of the European Union (ECJ) in July declared the EU-US Privacy Shield transfer mechanism invalid as it fails to guarantee the fundamental data protection and privacy rights of EU citizens. The Schrems II ruling followed an earlier judgment in 2015 that invalidated its predecessor, Safe Harbour, on similar grounds.
According to the ACOI survey, the lack of clarity on data transfers is the biggest challenge facing 65 per cent of respondents currently, with four in ten companies saying it will affect their ability to do business in the US and an even greater number concerned about its possible impact with Britain.
Many survey respondents also referred to significantly higher costs arising due to the ruling.
"All sectors of business have or will be affected by the Schrems II ruling on international data transfers and, in an already challenging business environment, this is an obstacle which is going to be very difficult for many to overcome. The message from businesses is that the most pressing and immediate concern is the lack of clarity on how the ruling should be applied," said Michael Kavanagh, chief executive of the ACOI.
Business group Ibec recently warned the ruling would have a significant impact on the Irish economy and called for the State to lead European efforts to negotiate an effective substitute with the US to Privacy Shield. It also urged the Government to come up with an interim solution to support Irish businesses.
Respondents to the ACOI survey said they wanted the Government to intervene by providing a temporary grace period while Irish and EU supervisory authorities work to provide a longer term fix.
Measures
“The ruling wasn’t black and white and so it will take some time before the issues are ironed out and definitive guidance can be given. But we can’t leave firms in limbo until then. The powers that be need to address this and give these businesses a way to proceed with their daily business activities when it comes to data transfer,” said Mr Kavanagh.
The ACOI say that the requirement in particular for companies to put in place additional supplementary measures where Standard Contractual Clauses (SCCs) do not provide sufficient privacy guarantees, will be onerous for the SME sector.
“This ruling affects a range of industries, not just those directly involved in the digital sector. It’s critical that we address the significance of this ruling for Irish businesses, and that the Government work to acknowledge the complexity of the impact it will have. Businesses urgently need guidance and clarity to help them operate compliantly in the interim, while an alternative arrangement is being negotiated,” said Mr Kavanagh.
