or practices involving foreign commerce that—“(i) cause or are likely to cause
reasonably foreseeable injury within the United States”; or “(ii) involve material
conduct occurring within the United States”.
307 Thus, if a foreign organization
engages in interstate commerce in the U.S., the FTC has jurisdiction.
The FTC and other U.S. regulators maintain that applicable U.S. laws and
regulations still apply to the data after it leaves the US.
308 In particular, regulated
entities remain liable for: “[d]ata exported out of the US, [t]he processing of data
overseas by subcontractors, and [s]ubcontractors using the same protections (such as
through the use of security safeguards, protocols, audits and contractual provisions)
for the regulated data when it leaves the country”.
309 In addition, the Department of
Defense requires require all cloud-computing service providers that work for the
department to store data domestically.
310 Under the Gramm-Bliley-Leach Act, a
financial institution must disclose its privacy notice and provide the individual with
the opportunity to opt out of certain non-affiliated third party sharing (whether the
transfer is within or outside of the US).
311
7.2 International Agreements
In 2016, the U.S. Department of Commerce, the European Commission, and the
Swiss Administration adopted the “Privacy Shield” framework with the goal of
strengthening enforceable rights regarding data transfers.
312 The goal of the Framework is to provide companies “with a mechanism to comply with data protection
requirements when transferring personal data”.
313 Pursuant to the Framework,
organizations based in the U.S. must self-certify to the Department of Commerce
and commit to comply with the Framework’s requirements.
314 Those requirements
include: data handling requirements, clear safeguards and transparency obligations
on U.S. government access, effective protection of individual rights, and an annual
joint review mechanism.
315 In addition, pursuant to the Judicial Redress Act citizens
307 Id. at §3.
308 Jolly (2016).
309 Id.
310 “Defense Federal Acquisition Regulation Supplement: Network Penetration Reporting and
Contracting for Cloud Services (DFARS Case 2013-D018)” (Washington, DC: Defense Acquisition Regulations System, Department of Defense, August 26, 2015), https://www.federalregister.
gov/documents/2015/08/26/2015-20870/defense-federal-acquisitionregulation-supplement-net
work-penetration-reporting-and-contracting-for.
311 Jolly (2016), p. 22.
312 Jolly (2016), p. 22.
313 “Privacy Shield Framework”, U.S. Department of Commerce—International Trade Administration. Available online at: https://www.privacyshield.gov/Program-Overview.
314 Id.
315 Id.
452
S. M. Boyne
reasonably foreseeable injury within the United States”; or “(ii) involve material
conduct occurring within the United States”.
307 Thus, if a foreign organization
engages in interstate commerce in the U.S., the FTC has jurisdiction.
The FTC and other U.S. regulators maintain that applicable U.S. laws and
regulations still apply to the data after it leaves the US.
308 In particular, regulated
entities remain liable for: “[d]ata exported out of the US, [t]he processing of data
overseas by subcontractors, and [s]ubcontractors using the same protections (such as
through the use of security safeguards, protocols, audits and contractual provisions)
for the regulated data when it leaves the country”.
309 In addition, the Department of
Defense requires require all cloud-computing service providers that work for the
department to store data domestically.
310 Under the Gramm-Bliley-Leach Act, a
financial institution must disclose its privacy notice and provide the individual with
the opportunity to opt out of certain non-affiliated third party sharing (whether the
transfer is within or outside of the US).
311
7.2 International Agreements
In 2016, the U.S. Department of Commerce, the European Commission, and the
Swiss Administration adopted the “Privacy Shield” framework with the goal of
strengthening enforceable rights regarding data transfers.
312 The goal of the Framework is to provide companies “with a mechanism to comply with data protection
requirements when transferring personal data”.
313 Pursuant to the Framework,
organizations based in the U.S. must self-certify to the Department of Commerce
and commit to comply with the Framework’s requirements.
314 Those requirements
include: data handling requirements, clear safeguards and transparency obligations
on U.S. government access, effective protection of individual rights, and an annual
joint review mechanism.
315 In addition, pursuant to the Judicial Redress Act citizens
307 Id. at §3.
308 Jolly (2016).
309 Id.
310 “Defense Federal Acquisition Regulation Supplement: Network Penetration Reporting and
Contracting for Cloud Services (DFARS Case 2013-D018)” (Washington, DC: Defense Acquisition Regulations System, Department of Defense, August 26, 2015), https://www.federalregister.
gov/documents/2015/08/26/2015-20870/defense-federal-acquisitionregulation-supplement-net
work-penetration-reporting-and-contracting-for.
311 Jolly (2016), p. 22.
312 Jolly (2016), p. 22.
313 “Privacy Shield Framework”, U.S. Department of Commerce—International Trade Administration. Available online at: https://www.privacyshield.gov/Program-Overview.
314 Id.
315 Id.
452
S. M. Boyne