Councils affected by EU data privacy ruling


A ruling by the European Court of Justice means local councils need to undertake a risk assessment if they use Cloud storage services based in the USA.

The Court has declared the 'Privacy Shield', which is an agreement between Europe and the USA on how personal data is managed and protected, is invalid because US law does not provide adequate protections for the privacy and data protection rights of people whose personal information are transferred to the USA from Europe.

The Court found that the surveillance laws in the USA allow for the US Government to access the personal data of Europeans that has been transferred, and that the personal data of European citizens is therefore not protected.

Additionally, the Court found that Europeans are not afforded the right to bring actions in American courts to prevent this type of access, as they coan in the EU. 

The Society of Local Council Clerks recommends that, as a matter of urgency, all parish and town councils undertake a risk assessment to confirm the type of data that they may be storing cloud facilities located in the USA.   I

Brexit is likely to create further complexities for the transfer of personal data betwee the UK and other countries.   At present, the UK is bound to support the Privacy Shield under the terms of the EU Withdrawal Agreement.   After the end of the Transition Period, the UK and the USA could agree a new Privacy Shield framework on broadly similar lines.  

The ruling will also affect social media networks such as Facebook, Twitter and Google.

Further advice will be published in due course by the Government's Information Commissioner's Office.

The link below is to an article published by The Independent Online on 25 September 2020.