You may have heard or read that the European Court of Justice recently issued a ruling invalidating the EU-U.S. Privacy Shield. Not surprisingly, this has caused concern on both sides of the Atlantic. Despite the decision, however, Twilio customers can continue to use all of our services in full compliance with European law.

The Court’s decision means that one safeguard under which companies were allowed to transfer personal data from the EU to the United States — the EU-U.S. Privacy Shield — no longer exists. However, the Court left the other two available for companies to use.

Twilio has prepared for this scenario well in advance of today’s ruling. Twilio’s Data Protection Addendum anticipated the possibility that Privacy Shield could be struck down and relies on overlapping data transfer safeguards. The Court’s ruling does not nullify Twilio’s primary data transfer mechanisms, Binding Corporate Rules and Standard Contractual Clauses. As a result, Twilio’s ability to do business with European customers or for Twilio customers to process EU personal data remains intact.

Our Binding Corporate Rules are our primary safeguard for data transfers. Twilio’s Binding Corporate Rules have been approved and reaffirmed by European data protection authorities and were not affected by the court ruling. In cases where these rules do not apply, our Data Protection Addendum automatically falls back to Standard Contractual Clauses. Today’s ruling confirms that Standard Contractual Clauses remain a viable transfer safeguard.

Twilio is closely watching for further guidance from EU data protection authorities in light of this decision regarding how to best provide service to customers impacted by it. Further, we are watching closely for any possible changes to any other transnational arrangement in light of the European Court of Justice decision. Nonetheless, as with the EU-U.S. Privacy Shield, Twilio will rely on its already available alternative transfer safeguards, such as its Binding Corporate Rules.

#news #big data