It was nice while it lasted. The US-EU Safe Harbor system, a triumph of diplomacy, commonsense, and rationality, was a simplified process that US companies were able to adopt to comply with the EU Directive 95/46/EC on the protection of personal data.
A product of the US Department of Commerce and the European Union, Safe Harbor was a boon to all until earlier this month. Driven by Edward Snowden’s exposure of the NSA’s domestic data gathering activities, the European Court of Justice invalidated the measure (Maximillian Schrems v. Data Protection Commissioner). Of concern was the possibility that under US law, federal agencies could potentially access and utilize the data, contravening European privacy laws.
Of course, Safe Harbor had been intended to allay such concerns in the first place, by preventing accidental information disclosure or loss by US companies holding data from Europe, which generally has stricter laws on the subject. Unanticipated at the time of the Law’s creation was a scenario in which the threat to the data’s privacy would be the US Government, a reality surfaced by Snowden’s actions.
The complete implications of this decision are not yet clear, but already, huge tech companies such as Facebook and Google are facing disruption. Optimists see a potential for governments on both sides of the Atlantic to administer an orderly retreat toward some new common ground, but others see a potential disaster that could result in the loss of billions of dollars in bilateral trade.
For Life Sciences organizations, which have often made large investments in consolidating information technology resources globally, this decision could be particularly painful. For example, companies that transfer personal data — health data in particular — between jurisdictions may now have to stop the practice or constrain it in an as yet undetermined way. This, of course, potentially undoes the data consolidation, not to mention the widespread adoption of compliant public cloud resources for storage and computing. Much of this technology was put in place to meet expanding global compliance guidelines regarding payments to their customers, healthcare professionals. The inability for one region to have visibility that a key thought leader physician is being utilized and paid by another region makes regulated transfer of value reporting a manual effort.
Guidance on this matter is expected from the European Commissioners in the near future. For now, U.S. Secretary of Commerce Penny Pritzker released the following statement (reproduced in part) in response to the European decision:
“The court’s decision necessitates release of the updated Safe Harbor Framework as soon as possible. We are prepared to work with the European Commission to address uncertainty created by the court decision so that the thousands of U.S. and EU businesses that have complied in good faith with the Safe Harbor and provided robust protection of EU citizens’ privacy in accordance with the Framework’s principles can continue to grow the world’s digital economy.”
To be sure of what?, the Commerce Department had been working on improvements to Safe Harbor prior to this ruling. Presumably, some of that work can be salvaged and built upon. It is hard to imagine that mutual interest wouldn’t lead to a solution. In the meantime, however, Life Sciences companies must deal with consequence of this European court decision, namely tracking how healthcare professionals are utilized and paid around the world; which is a direct fruit of the ability to share data seamlessly.
No doubt, lawyers will be working double time, and IT people, too, in an effort to avoid running afoul of the law as it stands. The more cost effective world of third-party Software as a Service (SaaS) beckons, with the potential to actually improve security and allow Life Sciences companies to focus on what they do best, namely R&D related to improving healthcare.
In the meantime, as they say, “stay tuned.”
Susan Hill, SVP, Global Products & Solutions, AHM
Susan joined AHM in June of 2013 and is responsible for the oversight and management of AHM’s Global Business Development and Solutions and Marketing team. With over nineteen years of experience in the Life Science industry, Susan brings experience in business development, product marketing, and new technology investment and optimization.