On July 6, 2016, the European Parliament adopted the first-ever pan-European law on cyber security. The law, entitled the “Directive on the Security of Network and Information Systems” (NIS Directive), imposes security requirements and security incident notification obligations on digital service providers and operators of essential services. The NIS Directive was enacted as part of the European Commission’s broader initiative to strengthen cyber security capabilities in the EU and will take effect in August 2016…

Two recent developments have significantly increased the already uncertain legal landscape surrounding transatlantic data flows. Earlier today, the EU Parliament voted out a resolution calling on the European Commission (EU Commission) to further negotiate the terms of the EU-U.S. Privacy Shield (Privacy Shield). And yesterday, the Irish Data Protection Commissioner (DPC) announced the launch of new proceedings before the Court of Justice of the European Union (CJEU) to assess the validity of the EU Standard…

On April 14, 2016, the European Parliament formally adopted the General Data Protection Regulation (GDPR). With this vote, the new EU data protection legal framework will become legally effective in two years and 20 days from its publication in the EU Official Journal (expected in May 2016). By May 2018, companies will have to comply with its new stringent requirements. The GDPR will significantly impact all companies doing business in the EU, including U.S.-based enterprises…

On April 13, 2016, the body of European Data Protection Authorities (DPAs)—the “Article 29 Working Party” (WP29)—issued its opinion on the new EU-U.S. Privacy Shield. The WP29 acknowledged that progress has been made with the Privacy Shield, but called for several significant changes to the shield before it can be found to provide protection that is “essentially equivalent” to EU data protection law. Importantly, the WP29 also concluded that it will not examine the validity…

The Internet has transformed the ways that we access, consume, and use information. For years, debates have raged in both the United States and Europe over so-called “network neutrality”—the extent to which the government should require entities that provide Internet access services to treat the content that they transmit equally. In the past several months, there have been significant events with regard to network neutrality laws in the U.S. and the EU. Regulators in both…

On February 3, 2016, the body of European data protection regulators—the Article 29 Working Party (WP29)—issued a statement following the announcement of a political agreement regarding a new transatlantic data transfer scheme, the EU-U.S. Privacy Shield. This is the second guidance document issued by the WP29 following the invalidation of the EU-U.S. Safe Harbor Framework Agreement (Safe Harbor) by the Court of Justice of the European Union (CJEU) on October 6, 2015, in Maximillian Schrems…

On February 2, 2016, the European Commission announced that a political agreement on a new legal framework for data transfers has been reached between the European Union (EU) and the U.S. Today’s agreement introduces the new “EU-U.S. Privacy Shield.” Although the details of the new agreement have not yet been released, this is a crucial step for thousands of businesses on both sides of the Atlantic engaged in transfers of data from the EU to…