In July, the EU Court of Justice invalidated the Privacy Shield - an agreement that had regulated the transfer of data between EU countries and the USA for four years. It also applied to European e-businesses that use the services of American technology companies, such as Google and Facebook. The ruling means that online stores must change the provisions in their terms and conditions.
Every online store collects the personal data of its customers. And every store that uses tools from US companies, for example to run advertising campaigns, is subject to international regulations on the transfer of that data. Just a few weeks ago, the most important of these regulations was the Privacy Shield - an agreement that both internet giants and the e-businesses working with them had to comply with.
On 16 July, the CJEU, ruling in a dispute between an Austrian citizen and Facebook, found that the Privacy Shield does not ensure adequate protection of his and other Europeans' data, since it is processed outside the EU, and therefore declared it invalid. Consequently, all provisions in the terms and conditions of websites, applications or online stores that relied on the Privacy Shield also ceased to apply. Under the law, the transfer of personal data to the USA can no longer take place on that basis.
What do the legal changes mean for store owners?
What do the legal changes mean for store owners?
However, the court's ruling does not automatically mean that all e-stores in Poland that run campaigns with Google Ads or send newsletters through a platform based in the USA are acting illegally.
New regulations for e-stores: how to adapt your terms and conditions after the CJEU ruling
- We are monitoring the situation and so far we have no information that the police or the relevant authorities have started pursuing sellers on our platform and punishing them for acting in breach of regulations that changed suddenly, after all. We also do not expect such actions in the near future. It is worth remembering, however, that every seller may one day find themselves in a legal dispute with a customer or business partner, and then referring to terms and conditions based on non-existent regulations will clearly work against them. So it is worth making sure, sooner or later, that the legal issues are formally settled - explains Oliwia Tomalik, Marketing Manager at Shoper.
- If you use the services of companies that process the data you provide (e.g. of customers or employees) in the United States, you must find a legal basis other than the Privacy Shield for continuing to transfer such data as soon as possible, or give up those services that involve the transfer of personal data to the United States – advises sellers a lawyer from the Legal Geek law firm.
How to adapt your store to the new regulations?
How to adapt your store to the new regulations?
In practice, finding another legal basis means identifying still-valid provisions that can be cited as governing the store's cooperation with American technology companies and including a reference to them in the store's updated terms and conditions. Sellers may decide to change the existing terms and conditions themselves or consult a lawyer, preferably one specialising in technology issues. Changing regulations require the store owner to constantly monitor the law and adapt all documents to the new legal reality.
Summary
After the EU Court of Justice invalidated the Privacy Shield, e-stores must find a new legal basis for transferring data to the USA. Experts from the Shoper platform and the Legal Geek law firm advise updating terms and conditions quickly, before disputes with customers arise. In practice, this means reviewing contracts with American companies and consulting a lawyer. It is worth remembering that although authorities do not pursue violations immediately, the legal risk grows with each passing day.
