Can the EU and US Build a Bridge Across Data Privacy Divide?

December 09, 2019

EU regulations often cast a shadow far beyond the borders of Europe. More than a year since its implementation, this extra territorial impact has been highlighted once more as the EU’s General Data Protection Regulation (GDPR) hinders certain EU firms wishing to conduct business in the US.

As a reminder, GDPR is the EU data protection regime that looks to safeguard the use of personal data of EU citizens regardless of where that data is transferred to or from. Hence, yet another European regulation with global impact. Under GDPR, the transfer of personal data outside the European Economic Area is subject to certain rules and depends on whether the European Commission has approved the third country through what’s known as “an adequacy decision.” In lieu of such agreement, data transfers between EU and the third country are more difficult. Currently, the US does not have such an agreement in place.

A Disconnect Across the Pond

Recently, it’s come to light that the US Securities and Exchange Commission (SEC) has been refusing investment advisor applications from some EU firms because they believe GDPR will prevent them from complying with SEC regulations. For example, the SEC requires access to certain information such as emails and other electronic communications in order to conduct their supervisory and investor protection work.

If the SEC continues to refuse these types of applications, it would effectively mean EU firms servicing US clients would be unable to continue to do so unless all operations related to that client, including the portfolio managers, were moved to a jurisdiction not affected by the GDPR – a large burden for EU-based cross border asset managers.

However, others argue the SEC’s concerns are unfounded, given the fact that GDPR contains provisions requiring firms to share data with a third country regulator upon a legitimate request. GDPR’s Article 49 derogation means that personal data can be transferred if it is necessary for the completion of activities by the data exporter, which would include a regulator request in a market in which the GDPR firm operates. While the issue is significant, it may also be short lived. The SEC and the European Commission plan on meeting in February 2020 in an attempt to find a common ground with regard to data privacy concerns on both sides of the pond.

There has also been much debate and speculation on whether the US will frame their own federal regulation on data privacy. So far, some states have taken the issue into their own hands, like California’s Consumer Protection Act (CCPA). But it’s also unlikely we see a US regulation as far reaching as GDPR in the near future.

What’s Brexit Got to Do with It?

GDPR’s reach is not just an issue between the EU and US. Our old friend Brexit means that the UK and EU also need to consider what their exchange of data looks like in a post-Brexit world.

For now, the UK remains an EU member state, as such it has already adopted GDPR. However, should the UK ultimately leave the EU, particularly without a deal, then UK-regulated firms will have to consider how to ensure ongoing compliance with GDPR. There are 3 primary routes to compliance, post-Brexit:

  1. Adequacy Decision: EU regulators deem the UK as equivalent, but this process can take time and as we’ve highlighted before is both a political and regulatory decision.
  2. Binding Corporate Rules (BCR): BCRs are internal data transfer rules for multinationals. They allow firms to transfer data to countries without a deemed “adequate” level of protection so long as the firm itself operates to GDPR standards regardless. They are a hugely challenging undertaking for a firm and can be lengthy.
  3. Model Contract Clause: these are EU approved contractual clauses that may be used by an EU data controller to non-EU or EEA controller or processor.

What’s Next?

All eyes now turn to the highly anticipated February meeting between the US and EU. In an era of unprecedented global interconnectedness and interdependence, but heightened bilateral trade and political tension, there are asset managers on both sides of the Atlantic who will hope the meeting results in agreement. A positive outcome would facilitate the continued exchange of information and the ability to conduct business seamlessly in each other’s territory.   

Brown Brothers Harriman & Co. (“BBH”) may be used as a generic term to reference the company as a whole and/or its various subsidiaries generally. This material and any products or services may be issued or provided in multiple jurisdictions by duly authorized and regulated subsidiaries.This material is for general information and reference purposes only and does not constitute legal, tax or investment advice and is not intended as an offer to sell, or a solicitation to buy securities, services or investment products. Any reference to tax matters is not intended to be used, and may not be used, for purposes of avoiding penalties under the U.S. Internal Revenue Code, or other applicable tax regimes, or for promotion, marketing or recommendation to third parties. All information has been obtained from sources believed to be reliable, but accuracy is not guaranteed, and reliance should not be placed on the information presented. This material may not be reproduced, copied or transmitted, or any of the content disclosed to third parties, without the permission of BBH. All trademarks and service marks included are the property of BBH or their respective owners.© Brown Brothers Harriman & Co. 2021. All rights reserved.

This browser is not fully supported by our public website and may not display or function as expected for this reason. Please note, the Infuse Portal and BBH client applications fully support the IE 11 browser.

Important Information for Non-U.S. Residents

You are required to read the following important information, which, in conjunction with the Terms and Conditions, governs your use of this website. Your use of this website and its contents constitute your acceptance of this information and those Terms and Conditions. If you do not agree with this information and the Terms and Conditions, you should immediately cease use of this website. The contents of this website have not been prepared for the benefit of investors outside of the United States. This website is not intended as a solicitation of the purchase or sale of any security or other financial instrument or any investment management services for any investor who resides in a jurisdiction other than the United States1. As a general matter, Brown Brothers Harriman & Co. and its subsidiaries (“BBH”) is not licensed or registered to solicit prospective investors and offer investment advisory services in jurisdictions outside of the United States. The information on this website is not intended to be distributed to, directed at or used by any person or entity in any jurisdiction or country where such distribution or use would be contrary to law or regulation. Persons in respect of whom such prohibitions apply must not access the website.  Under certain circumstances, BBH may provide services to investors located outside of the United States in accordance with applicable law. The conditions under which such services may be provided will be analyzed on a case-by-case basis by BBH. BBH will only accept investors from such jurisdictions or countries where it has made a determination that such an arrangement or relationship is permissible under the laws of that jurisdiction or country. The existence of this website is not intended to be a substitute for the type of analysis described above and is not intended as a solicitation of or recommendation to any prospective investor, including those located outside of the United States. Certain BBH products or services may not be available in certain jurisdictions. By choosing to access this website from any location other than the United States, you accept full responsibility for compliance with all local laws. The website contains content that has been obtained from sources that BBH believes to be reliable as of the date presented; however, BBH cannot guarantee the accuracy of such content, assure its completeness, or warrant that such information will not be changed. The content contained herein is current as of the date of issuance and is subject to change without notice. The website’s content does not constitute investment advice and should not be used as the basis for any investment decision. There is no guarantee that any investment objectives, expectations, targets described in this website or the  performance or profitability of any investment will be achieved. You understand that investing in securities and other financial instruments involves risks that may affect the value of the securities and may result in losses, including the potential loss of the principal invested, and you assume and are able to bear all such risks.  In no event shall BBH or any other affiliated party be liable for any direct, incidental, special, consequential, indirect, lost profits, loss of business or data, or punitive damages arising out of your use of this website. By clicking accept, you confirm that you accept  to the above Important Information along with Terms and Conditions.

1BBH sponsors UCITS Funds registered in Luxembourg, in certain jurisdictions. For information on those funds, please see

captcha image

Type in the word seen on the picture

I am a current investor in another jurisdiction