On 16 July 2020, the European Court of Justice (“ECJ”) ruled that the EU Commission’s 2016 decision regarding the adequacy of data protection in the United States and the EU-US Privacy Shield (“Privacy Shield”)* are invalid. As a result, companies in the EU and United States relying on the Privacy Shield program are scrambling to determine the impact on their operations.
Many US companies grant share-based awards to employees of their subsidiaries in the EU as a discretionary incentive separate from the employees’ local compensation and employment relationship with the respective EU subsidiary.
To administer such awards, companies have to collect, process and transfer employees’ personal data, including transferring such data to the United States. The transfer of personal data from the EU to the United States is permissible only if a valid justification exists, and one of such justifications was Privacy Shield.