New FPF Study: More Than 250 European Companies are Participating in Key EU-US Data Transfer Mechanism

Co-Authored by: Drew Medway & Jeremy Greenberg

European Companies’ Participation in Privacy Shield Up Nearly 30% from the Past Year.

EU-US Privacy Shield Remains Essential to Leading European Companies.

From Major Employers such as Logitech and Siemens to Leading Technology Firms like Telefónica and SAP, European Companies Depend on the EU-US Agreement.

The Privacy Shield Program Supports European Employment While Adding to Employee Data Protections—Nearly One-Third of Privacy Shield Companies Rely on the Framework to Transfer HR Information of European Staff.

With the future of the US/EU Privacy Shield framework awaiting the Court of Justice of the European Union’s (CJEU) Schrems II decision, the Future of Privacy Forum conducted a study of the companies enrolled in the cross-border privacy program and determined that 259 European headquartered companies are active Privacy Shield participants. This is a nearly 30% increase from last year’s total of 202 EU companies in the data transfer framework. These European firms rely on the program to transfer data to their US subsidiaries or to essential vendors that support their business needs. Nearly one-third of Privacy Shield companies use the mechanism to process human resources data—information that is crucial to employ, pay, and provide benefits to workers.

Thousands of major companies, many of which are headquartered or have offices in Europe, rely on the protections granted under the data transfer agreement. With a majority of companies surveyed in a recent IAPP study relying on Privacy Shield to transfer data out of the EU, and dozens of new companies joining each week to retain and pay their employees or create new job opportunities in Europe, the agreement is an integral data protection mechanism for European consumers and companies and the European marketplace as a whole.

The Numbers:

Overall, FPF found that more than 5,400 companies have signed up for Privacy Shield since the program’s inception – more than 1,000 participants joined in the last year.

Leading European companies that rely on Privacy Shield include:

–     ALDI, German grocery market chain

–     Eaton Corporation, Irish multinational management company

–     Ingersoll-Rand, Irish globally diversified industrial company

–     Jazz Pharmaceuticals, Irish biopharmaceutical company

–     Lidl, German grocery market chain

–     Logitech, Swiss computer peripherals manufacturer and software developer

–     SAP, German multinational software corporation

–     Siemens, German computer software company

–     TE Connectivity, Swiss consumer electronics company

–     Telefónica, Spanish mobile network provider

FPF research also determined that more than 1,700 companies, nearly one-third of the total number analyzed, joined Privacy Shield to transfer their human resources data.

The research identified 259 Privacy Shield companies headquartered or co-headquartered in Europe. Top EU locations for Privacy Shield companies include Germany, France, the Netherlands, and Ireland.  This is a conservative estimate of companies that rely on the Privacy Shield framework—FPF staff did not include global companies that have major European offices but are headquartered elsewhere. The 259 companies include some of Europe’s largest and most innovative employers, doing business across a wide range of industries and countries. EU-headquartered firms and major EU offices of global firms depend on the Privacy Shield program so that their related US entities can effectively exchange data for research, to improve products, to pay employees and to serve customers. 

The conclusions follow previous FPF studies, which highlighted similar increases in participation and reliance by EU firms on the Privacy Shield program over time.  

Methodology:

• FPF staff recorded a list of 5,348 active EU-US Privacy Shield companies as of June 2019 from https://www.privacyshield.gov.
• FPF staff performed a web search for each current company by name, checking the location of the company’s headquarters on a combination of public databases such as LinkedIn, CrunchBase, Bloomberg, and companies’ own websites.
• A company that listed its headquarters in an EU member state, the United Kingdom, or Switzerland was counted as a match; companies that merely had a prominent EU office or were founded in an EU member state were not counted.
• 259 total EU-headquartered companies were identified using this method.

Note Regarding Brexit: Given the 130-plus UK companies reliant on Privacy Shield, we encourage the continued enforcement of the framework with the UK after the conclusion of the UK-EU Transition Period on December 31st, 2020. Companies reliant on the transfer of data between the UK and US would be wise to review the Department of Commerce’s Privacy Shield and the UK FAQs for guidance on UK-US data transfer during, and after, the Transition Period.

For the full list of European companies in the Privacy Shield program, or to schedule an interview with Jeremy Greenberg, John Verdi, or Jules Polonetsky, email [email protected].

For more information about FPF in Europe, visit https://fpf.org/eu.