Agreement Reached on New EU-U.S. Safe Harbor: the EU-U.S. Privacy Shield

On February 2nd, 2016, the European Commission and U.S. Government reached political agreement on the new framework for transatlantic data flows.  The new framework – the EU-U.S. Privacy Shield – succeeds the EU-U.S. Safe Harbor framework (for more on the Court of Justice of the European Union decision in the Schrems case declaring the Safe Harbor invalid, see our earlier post here).  The EU’s College of Commissioners has also mandated Vice-President Ansip and Commissioner Jourová to prepare the necessary steps to put in place the new arrangement.

The EU-U.S. Privacy Shield

According to the Commission press release, there will be several new elements to the EU-U.S. Privacy Shield, as compared with the invalidated EU-U.S. Safe Harbor framework.  For instance, in addition to subjecting participating U.S. companies to certain as-yet unspecified safeguards, the Privacy Shield will include:

  • An annual joint review of the program performed by the European Commission and U.S. Department of Commerce – to which European data protection authorities will be invited – to ensure its proper functioning.  This will include a review of access by U.S. intelligence agencies to EU-originating data.

  • Enhanced rights of redress for European data subjects, including (i) subjecting U.S. organizations to firmer deadlines when responding to complaints, (ii) allowing EU citizens and EU data protection authorities to refer complaints to the U.S. Department of Commerce and the U.S. Federal Trade Commission, (iii) establishing, as a last resort, a new binding alternative dispute resolution mechanism to resolve complaints that will be voluntary and free to data subjects, capable of issuing binding injunctive orders, and subject to judicial review consistent with the U.S. Federal Arbitration Act, and (iv) creating a new “Ombudsperson” within the U.S. State Department to handle complaints – channeled through EU Member State representatives – that relate to U.S. intelligence agencies’ access to data.  Disputes relating to human resources/employee data will remain subject to an alternative process that entails somewhat closer involvement of EU data protection authorities, similar to the current Safe Harbor.

Moreover, it is reported that the U.S. Director of National Intelligence will confirm by official letter to the EU that U.S. intelligence agencies do not engage in “indiscriminate mass surveillance” of data transferred under the new arrangement.

The Privacy Shield is expected to retain or enhance many of the elements contained in the original Safe Harbor framework, including substantive commitments made by U.S. companies on such matters as furnishing appropriate notices to EU citizens, maintaining the security of transferred data, and tightened restrictions on onward transfers.  The precise nature of these obligations is not yet known, but will become clearer in the weeks ahead.

Next steps

The EU College of Commissioner’s has mandated Vice-President Ansip and Commissioner Jourová to, over the coming weeks, prepare a draft Decision declaring the U.S. to ensure an adequate level of protection.  The adoption of such a Decision by the Commission must follow a “comitology” procedure which will involve:

  • a proposal from the Commission;

  • an opinion by EU Member States’ data protection authorities and the European Data Protection Supervisor (“EDPS”), in the framework of the Article 29 Working Party;

  • an approval from the “Article 31 Committee”, composed of representatives of Member States, under the comitology “examination procedure”;

  • the formal adoption of the Decision by the College of Commissioners;

  • at any time, the European Parliament and the Council may request the Commission to maintain, amend or withdraw the adequacy decision on the grounds that its act exceeds the implementing powers provided for in the Directive.

The effect of such a Commission Adequacy Decision is that personal data can flow from the 28 EU countries and three EEA member countries (Norway, Liechtenstein and Iceland) to the U.S. without any further safeguards being necessary.

Commissioner Jourová hopes for the new arrangement to be in force in approximately 3 months’ time.  The U.S. Government, in the meantime, will make the necessary preparations to put in place the new framework, monitoring mechanisms, and new Ombudsperson.

Tomorrow (February 3rd, 2016), Commissioner Jourová will attend the plenary meeting of the Article 29 Working Party to discuss the role of the EU data protection authorities under the EU-U.S. Privacy Shield.  The U.S. Department of Commerce is, in parallel, planning further briefings about the text.

New Draft EMA-Guideline On Clinical Development Of Fixed Combination Medicines

The European Medicines Agency (EMA) has recently published for public consultation its draft guideline on clinical development of fixed combination medicinal products (Draft Guideline), which is intended to replace CHMP/EWP/240/95 Rev. 1 (Existing Guideline).  The Draft Guideline applies to fixed combination medicinal products containing two or more active substances within a single pharmaceutical form.  The active substances may be known active substances or substances that have yet to be authorised in the EU.

An EMA concept paper on the Existing Guideline suggested that it be revised in order to suppress regulatory aspects and restrict it to the scientific requirements for clinical development of fixed combination products.  The Draft Guideline therefore contains a number of changes from the Existing Guideline, including:

  • It no longer describes the applicable legal basis for approving marketing authorisation applications for fixed combination products. The Existing Guideline places a strong link between Article 10b of Directive 2001/83/EC and the development of fixed combination products.  However, the Draft Guideline provides that “The legal basis for applications concerning fixed combination medicinal products may vary depending on the particularities of the active substances in combination and the development undertaken.  The choice of legal basis lies with the applicant…”  The Draft Guideline, as is the case with the Existing Guideline, does not discuss data exclusivity in respect of fixed combination products.  The European Commission’s guidance contained in its Notice to Applicants, Volume 2 A continues to apply in this regard.  It is worth noting that Teva has recently withdrawn its application and has discontinued proceedings in litigation before the General Court of the European Union (Case T-547/12) concerning regulatory data exclusivity for fixed combination products.

  • The Draft Guideline no longer addresses requirements for combination packs (i.e., where active substances are included in separate pharmaceutical forms marketed in the same package). The Existing Guideline states that scientific principles applicable to fixed combination products will also be applied in the assessment of combination pack medicinal products.  However, the EMA has subsequently recognised that from a regulatory point of view combination packs are not the same as fixed-dose combinations.  As such, reference to combination packs has been removed from the Draft Guideline.

  • The Draft Guideline contains more detail on the scientific aspects relevant for approval of fixed combination products. In summary, it provides that the basic requirements for a marketing authorisation application for a fixed combination product are: (1) justification of the pharmacological and medical rationale for the combination, (2) establishment of the evidence base for the: (a) relevant contribution of all active components to the desired therapeutic effect; and (b) positive risk-benefit for the combination, and (3) verification that the evidence base presented is relevant to the product applied for.

The deadline for submitting comments on the Draft Guideline is 15 November 2015.  Comments should be sent to FDCguideline@ema.europa.eu, and should be submitted using this template.

© 2015 Covington & Burling LLP

European Union’s New Regulation to Attach Bank Accounts Pre and Post Judgment

HMB Chartered B

Applicable as of January 18, 2017, a recently adopted European regulation facilitates cross-border debt recovery by enabling creditors to obtain a “European Account Preservation Order” (the “EAPO”) given by one judge in a member state and attach a debtor’s bank accounts in another EU member state without further court proceeding. The EAPO will enable creditors to obtain an order (i) before the creditor initiates proceedings on the merits against the debtor, (ii) at any stage during the proceedings until a judgment or settlement is entered, and (iii) after a judgment or court settlement that requires the debtor to pay a claim. Before a judgment is entered, the national courts that have jurisdiction to rule on the merits will also have jurisdiction to issue an EAPO. If the creditor has already obtained a judgment, then jurisdiction lies with the courts of the member state where the judgment was obtained.

An EAPO is an alternative remedy. The order will only be available in matters that have cross-border implications and may only serve preservation purposes. This means the debtor’s bank account is provisionally frozen and the amount seized is transferred to a dedicated account kept by the competent enforcement authority. To get the pre-judgment order, the creditor must show that he will probably obtain a favorable judgment against the debtor in the proceedings on the merits. No notice is given in seeking the order. The debtor may also not be informed of the order before it is enforced. An EAPO will not apply where claims are against a debtor in bankruptcy and where funds are exempt from attachment under the laws of the member state of enforcement.

OF

EU Sanctions And The International Oil And Gas Industry

Andrews Kurth

The international oil and gas industry is continuously tasked with adapting to an ever evolving sanction-regulated environment. The level of sanction activity and implementation in recent years has been unprecedented, partly as a result of the political events which gave rise to the Arab Spring and the opposition to Iran’s nuclear programme. The recent crisis in the Ukraine, and associated sanctions against Russia, have sparked further debate around the need for effective, targeted punitive measures and the consequences they may have for Europe.

This article considers the EU’s sanction regime, explores the effect it has on international oil and gas companies and addresses the short-comings of the EU’s decentralised system.

What are sanctions?

Sanctions are political policy instruments used to encourage jurisdictions acting in contravention of international law to adopt standards supported by the wider global community. They impose measures designed to cause damage to the targeted government, non-state entity or individual (“Target”) in order to force it to undertake, or prevent it from undertaking, certain behaviour. They may inhibit the Target from accessing foreign markets for trade or deny it from pursuing financial and other forms of commerce. The professed ultimate objective of a sanction is to preserve or restore global peace and security.

What is the source of EU sanctions?

The UN Security Council imposes sanctions through Security Council resolutions which are binding on the EU. The EU implements all sanctions imposed by the UN Security Council through legislation enacted by the European Council. The process typically results in a European Council regulation which has direct effect in EU member states’ separate legal systems, creating rights and obligations for those subject to them, and overrides national law. Additionally, the EU may decide to impose self-directed sanctions or restrictive measures which go further than a UN Security Council resolution in circumstances in which the EU deems such action to be necessary.

Why do EU sanctions affect international oil and gas companies?

Over the past two decades, the EU has engaged in an active use of restrictive measures in the form of economic and financial sanctions, embargoes and restrictions on admission to a country. Economic and financial sanctions typically take the form of asset-freeze measures which involve the use of funds and economic resources by Targets or persons acting for and on behalf of Targets, and the provision of funds and economic resources to designated Targets. Embargoes may prohibit trade in certain goods, and activities relating to such trade, with Targets (including the flow of arms and military equipment). Visa or travel bans can be imposed preventing certain persons from entering the EU or transit through the territory of EU member states. These sanction measures are part of the EU’s strategy to support the specific objectives of the Common Foreign and Security Policy.

At the time of writing, the EU has announced asset freezes and travel bans against around twenty individuals in Russia and the Ukraine. Companies conducting their business in the oil and gas sector should be particularly vigilant to ensure they act in compliance with EU sanctions, as Ukrainian and Russian entities and individuals who operate in this industry may increasingly become sanction targets.

US sanctions are questionable under international law because they apply extra-territorially to third state parties involved in business activities with the Target. Unlike the US, the EU has refrained from adopting legislation with extra-territorial effect. However, the EU’s recent sanctions against Iran displayed a greater resemblance to those levied by the US than had previously been the case. For example, sanctions were imposed prohibiting the provision of key resources to various parts of the Iranian oil and gas industry, as well as the provision of financial services to that sector. As a result of EU financial sanctions most, if not all, banks and other financial institutions have declined from conducting any business relations with the Iranian regime.

It is clear that EU sanctions are wide reaching and their scope has a significant impact on business activities. They will apply to international oil and gas companies in the following situations:

  • within EU territory, including its airspace;
  • on board of aircrafts or vessels under the jurisdiction of an EU member state;
  • to EU nationals, whether or not they are in the EU;
  • to companies and organisations incorporated under the law of a member state, whether or not they are in the EU (this captures branches of EU companies in non-EU countries); and
  • to any business done in whole or in part within the EU.

The corporate behaviour, performance and conduct of international companies are powerful channels through which the objectives of sanctions against Targets are achieved. Since an international oil and gas company has little option but to observe EU sanctions to the extent such company falls within the EU’s jurisdiction, these restrictive measures are likely to play a big part in a company’s commercial decision making processes.

Why are EU sanctions difficult to manage?

A principal reason why EU sanctions are difficult for international oil and gas companies based in various EU member states to manage largely stems from the fact that the European Union lacks a centralised licensing body. Instead, the responsibility for implementing and enforcing EU sanctions is delegated to the relevant competent authorities of the EU member states. The potential for variance and discrepancy is rife in a system where there are twenty-eight EU member states, each with their individual national resource constraints and self-centred policy objectives.

Typically, the competent authorities of EU member states are responsible for:

  • granting exemptions and licences;
  • establishing penalties for sanction violations;
  • coordinating with financial institutions; and
  • reporting upon the implementation of sanctions to the European Commission.

There have been calls for a central EU licensing body which would produce a single licensing and exemption policy for EU member states. Although EU guidelines on sanctions and best practices for the effective implementation of restrictive measures go some way to plug the gap, arguably a more comprehensive regime for implementing sanctions is required to provide a better level of certainty to international businesses operating in the realms of the EU.

Managing the risks

International oil and gas companies have always had to function in politically active climates. As sanctions initiated by multilateral organisations such as the UN and EU become more fashionable, so too does the exposure to political risk that these companies will face. Given the considerable levels of investment that can only be recouped over extended periods of time, and in accordance with pre-determined contractual apportionments, international oil and gas companies need to be able to recognise, assess and manage these political risks effectively.

Oil and gas companies can relieve the risks imposed on them by sanctions through political lobbying, taking pre-emptive measures and by reacting quickly to sanctions once they are implemented. Commercial negotiations will need to focus on the allocation of risk as a result of one party’s failure to perform or withdrawal from the contract on the grounds of applicable sanctions.

International oil and gas companies need to be proactive and consider both the legal solutions and pre-cure safeguards. Time and effort should be spent focusing on drafting and negotiating the relevant contractual documentation, following a careful risk assessment, instead of deferring to dispute resolution provisions. For instance, careful construction of force majeure provisions can allocate each party’s obligations in the circumstance where an event outside of a party’s control causes contractual performance to become impossible. Thus, whilst conventional force majeure clauses relating to physical events afford relief to an affected party from its liabilities under the contract, oil and gas companies should consider expanding such contractual provisions to cover sanctions and other restrictive measures imposed on them by the UN and EU.

To avoid falling foul of existing EU sanctions, oil and gas companies should also consider putting in place comprehensive compliance procedures and systems to implement applicable sanction regimes. Penalties for breach of sanctions can be severe; a person guilty of a sanction-related offence may be liable on conviction to imprisonment and/or a fine. Falling foul of sanctions also means that a transaction can immediately become unlawful.

Conclusion

In view of the economic significance of the EU, the application of economic financial sanctions can be a powerful tool. But like a chain is no stronger than its weakest link, the effectiveness and success of the EU’s sanction regime depends on all EU member states applying, implementing and enforcing EU sanctions in a consistent manner.

The current EU sanction regime warrants a fully integrated approach which would undoubtedly benefit its policy objectives and move some way to reducing the unduly high economic cost that international oil and gas companies face when operating their businesses in the EU.

In voicing the sentiments of Henry Kissinger: “No foreign policy – no matter how ingenious – has any chance of success if it is born in the minds of a few and carried in the hearts of none”, perhaps now, in the dawn of the recent events which have taken place in the EU’s backyard in the Ukraine and Russia, the EU should further global security measures by tightening its ranks and implementing a more centralised, and better monitored, sanction regime.

Article By:

Of:

Dealing with Personal Information at the Water’s Edge… Re: U.S. Safe Harbor Program

Jackson Lewis Logo

 

Privacy and data security issues and concerns do not stop at the water’s edge. Companies needing to share personal information, even when the sharing will take place inside the same “company,” frequently run into challenges when that sharing takes place across national borders. In some ways, the obstacles created by the matrix of federal and state data privacy and security laws in the U.S. are dwarfed by the matrix that exists internationally. Most countries regulate to some degree the handling of data, from access, to processing, to disclosure and destruction. And, the law continues to develop rapidly, sometimes due to unexpected events. Take, for example, the U.S. Safe Harbor programthat was designed to facilitate the transfer of personal data of individuals in the European Union (EU) to the United States. Because the EU believes that the law in some countries, including the U.S., fails to provide “adequate safeguards,” the general rule is that personal data of EU persons cannot be sent to the U.S. unless an exception applies. One exception is based on a negotiated deal between the EU and the U.S., commonly known as the U.S. Safe Harbor, a program which currently is in some jeopardy due to the recent reports of NSA monitoring, Snowden, etc.

data information EU European Union world

Currently, to meet the Safe Harbor, a company must take certain steps, including (i) appointing a privacy ombudsman; (ii) reviewing and auditing data privacy practices; (iii) establishing a data privacy policy that addresses the following principles: notice, choice, onward transfer of data, security, integrity, access and enforcement; (iv) implementing privacy and enforcement procedures; (v) obtaining consents and creating inventory of consents for certain disclosures; and (vi) self-certifying compliance to the U.S. Department of Commerce.

A recent statement from Viviane Reding, European Commissioner for Justice, Fundamental Rights and Citizenship, quoted in The Guardian, October 17, 2013, signals some changes may be in store for the Safe Harbor:

The Safe Harbour may not be so safe after all. It could be a loophole because it allows data transfers from EU to US companies, although US data protection standards are lower than our European ones,” said Reding. “Safe Harbour is based on self-regulation and codes of conduct. In the light of the recent revelations, I am not convinced that relying on codes of conduct and self-regulation that are not policed in a strict manner offer the best way of protecting our citizens.

At the same time, the EU continues to update and strengthen its protections for personal data. Companies that operate globally need to be sensitive to not only complying with the laws specific to activities within a jurisdiction, but also to activities between jurisdictions. Common business decisions such as deciding where data will be stored, setting up global databases for employees medical, personnel and other information, arranging for enterprise-wide employee benefits or monitoring programs, can face significant obstacles relating to the interplay of the data privacy and security laws of the countries involved.

Article by:

Joseph J. Lazzarotti

By:

Jackson Lewis P.C.

A Giant Leap: EU-China Bilateral Investment Treaty Negotiations to Be Launched Formally

McDermottLogo_2c_rgb

 

Negotiations for a bilateral investment treaty between the European Union and China are expected to be formally launched during the EU-China Summit next week. Though the launch would be just the first step in a long negotiation process, it would also be a giant leap for upgrading the investment relationship between the EU and China.

On 24 October 2013, the fourth meeting of the EU-China High Level Economic and Trade Dialogue was held in Brussels.  Among other points, the most recent talk between the world’s two biggest traders reaffirmed the willingness to formally launch negotiations for a bilateral investment treaty (BIT) during the EU-China Summit to be held in Beijing later this month.

This move is significant for several reasons.

  • There is huge potential for investment flow between the European Union and China.

According to provisional Eurostat data, in 2012 Chinese investments into the EU(27) amounted to €3.5 billion, and only accounted for 2.2 per cent of total foreign direct investment (FDI) flowing into the EU. By contrast, in the same year EU firms invested €9.9 billion in China, accounting for approximately 11.4 per cent of all China’s inward FDI. It is worth noting that the EU’s outward FDI to China only accounted for 2.4 per cent of total outbound investment flowing from the EU to the rest of world in 2012. By contrast, bilateral trade in goods and services is more than €1 billion per day.

  • The existing BITs between China and EU Member States are to be upgraded.

China signed its first BIT with Sweden in 1982, and currently has similar arrangements with each and every EU Member State (except Ireland).  However, these BITs were negotiated and executed in the past 30 years, during which China went through substantial changes in all aspects of society, including a significant increase in outbound investment.  Some of the BITs were updated to reflect such changes, e.g., the China-Netherlands BIT was amended to include national treatment in 2001.

Overall, the EU-China BIT will not be a simple compilation of the existing BITs between China and EU Member States, but an upgrade of the investment relationship between them.

  • The negotiation of a EU-China BIT is likely to be a long process.

The negotiation of a BIT between two giant economic entities is likely to be a long process.  For example, the China-US BIT negotiation is still in its preliminary stage more than 30 years after both parties opened the dialogue in 1980.  The China-Canada agreement took 18 years and went through 22 rounds of formal negotiations.

The difficulties of these negotiations must not be underestimated.  The EU-China BIT will go further than the existing bilateral agreements with individual Member States.  The EU negotiators are keen to include provisions on market access, including access to services, and on intellectual property.  The negotiation process is likely to be complicated by calls from the European Parliament to include provisions on fundamental rights and values (social, environmental, consumer, etc.).

From a procedural point of view, this will be the first trade agreement negotiated by the EU since the assignment of trade and investment agreements to the exclusive competence of the EU under the Lisbon Treaty.  This gives the European Parliament a key role to play in approving any final agreement.

In sum, if both parties formally launch the negotiations in November, it will be a small step in the negotiation process, but a giant leap for upgrading the investment relationship between EU and China.

If EU industry has concerns about obstacles to FDI in China, including discrimination and absence of mutual treatment, it is not too late to raise them with the Directorate General for Trade of the European Commission.

Article by:

Philip Bentley, QC

Frank Schoneveld

Bryan Fu

Of:

McDermott Will & Emery