On July 16, 2020, the Court of Justice of the European Union (CJEU) ruled that the EU-U.S. Privacy Shield Framework, designed by the U.S. Department of Commerce and the European Commission, is no longer valid for transferring the personal data of European citizens and residents out of the EU to the U.S. The General Data Protection Regulation (GDPR), which went into enforcement in May of 2018, sets forth the principles and requirements for how personal data of Europeans can be used or processed by organizations, requires that data transferred outside of the EU must have a valid mechanism to support its transfer. While some countries have been deemed to have adequacy by the European Commission based upon their own national data protection laws, the U.S. has not. For this reason, many organizations in the U.S. have relied on Privacy Shield, an agreement between the EU and U.S., which grants adequacy to U.S. organizations that adopted the Privacy Shield Framework and Principles and self-certified to their compliance for processing European data. The ruling The July 16 ruling came out of the Schrems II Case and simply stated that Privacy Shield does not provide adequate protections to EU citizen or resident personal data due to U.S. authorities use and access to that data through surveillance and other U.S. governmental practices. This decision has left over 5,000 active Privacy Shield participants having to rely upon another mechanism for cross-border transfers, such as Standard Contractual Clauses (SCCs), to be GDPR compliant. Fortunately, for these organizations, the Court upheld SCCs; however, organizations must now also take into consideration relevant aspects of the legal system where the data will be transferred.  The ruling also seems to have left the door open for the SCCs to be revised in the near future. The ruling has been an earthquake in the data privacy world leaving organizations scrambling to determine the impact and next steps, and furthering the calls for U.S. surveillance reform or a U.S. national data privacy law similar to the GDPR.   What should U.S. organizations do right now? If your organization processes the personal data of Europeans as either a data controller or a data processor, and you are Privacy Shield self-certified, the advice out of the UK’s Information Commissioner’s Office (ICO) is to maintain your Privacy Shield certification and obligations. It must be noted, if you choose to leave Privacy Shield, there is a required process and you may find it more of a challenge than its worth. If your organization is not currently Privacy Shield self-certified and you process the personal data of Europeans, now is not the time to begin the process according to the ICO.  Regardless of whether you are Privacy Shield self-certified, or if you are a data processor or data controller, now is the time to refer to your records for processing documentation (you did create records of the processing documentation as required by Article 30 of the GDPR, right?), and evaluate the mechanisms you rely upon for processing European data. You should ensure your contracts have the GDPR SCCs in place and if not, work with your data controllers or data processors to sign data processing agreements.   You may find that savvy or apprehensive EU-based organizations, and even individuals, are going to ask questions about your organization’s transfer mechanisms, Privacy Shield status and data processing activities. Once your organization has established its mechanisms, develop a statement that explains what mechanisms you rely upon. Do so in a clear and concise manner so that the organizations and individuals with whom you interact feel confident you are protecting their personal data appropriately and lawfully. Remember, nothing breeds concern like ambiguity, confusion and inconsistency.  Data privacy is a complex and continually evolving issue. We are here to help. For more information or help with data privacy at your organization, contact our team.

The Privacy Shield Framework is no longer valid for transferring the personal data of European citizens to the U.S. A valid mechanism is required by the General Data Protection Regulation (GDPR).

Risk Advisory

Privacy

General Data Protection Regulation (GDPR)

Privacy Shield no longer a valid mechanism for cross-border transfer of personal data

Authored by: Jeff Clayton, Leo Alvarez In a recent article published in the Professional Service Council’s Service Contractor Magazine, Baker Tilly’s Jeff Clayton and Leo Alvarez discuss the importance of supply chain risk management for companies doing business with the federal government in order for them to better understand their supply chains and effectively mitigate and manage risks.
For more information on this topic, or to learn how Baker Tilly specialists can help, contact our team.

For companies who do business with the federal government, managing supply chain risk is no longer something that is nice to have or that just makes good business sense; it is becoming a necessity.

Government Contractors

Supply Chain Network Optimization

Government Contracting & Compliance

Cybersecurity Maturity Model Certification (CMMC)

Cybersecurity

Pressure testing supply chain management: What do today’s challenges mean for government contractors?

It has been quite a year and we’re not even half way through. A declared pandemic, multiple rounds of government-injected stimulus packages and nationwide closures have completely changed the way we currently do business. Only three years ago, we were just beginning a conversation about major tax reform. Now, many of those historical tax changes have been rolled back or deferred in an effort to help taxpayers survive the COVID-19 pandemic and resulting economic collapse.  The general theme of the tax provisions enacted in the past few months has been to increase deductions, reduce restrictions on the ability to utilize losses, and provide opportunities to carry back net operating losses and claim refunds. Changes include correcting the so-called “retail glitch” in the Tax Cuts and Jobs Act that had failed to classify qualified improvement property as bonus eligible with a 15-year life, ease restrictions on the deductibility of business interest expense, and allow taxpayers to retroactively make certain changes back to 2018.  Taking each provision alone, they sound relatively simple. However, their interplay coupled with the processing of amending prior returns, considering different tax rate structures, and revising past elections add considerable complexities in analyzing how to best apply these new rules for yourself and your business. To supplement our alerts and webinars, we are summarizing here how to take advantage of the many facets of the stimulus packages. 
Visit the sections below for more on what taxpayers need to know to help them through the pandemic and beyond: Planning to manage the QIP and business interest expense changes Should you consider a casualty loss provision for your business?  Federal coronavirus rescue programs
– Protection Program
– Economic Injury Disaster Loans (EIDL) Program
– Employee retention credit Upcoming compliance deadlines for reacting to CARES Act changes  Lease modifications: Watch out for IRC section 467  Working with the IRS during a pandemic  International taxation relief provisions  States’ reactions in a pandemic environment 
For more information, please visit our Coronavirus Resource Center.
The information provided here is of a general nature and is not intended to address the specific circumstances of any individual or entity. In specific circumstances, the services of a professional should be sought. Tax information, if any, contained in this communication was not intended or written to be used by any person for the purpose of avoiding penalties, nor should such information be construed as an opinion upon which any person may rely. The intended recipients of this communication and any attachments are not subject to any limitation on the disclosure of the tax treatment or tax structure of any transaction or matter that is the subject of this communication and any attachments.

Baker Tilly’s federal, state and local, and international tax professionals review how taxpayers of all types and sizes can benefit from the coronavirus stimulus packages.

Federal Tax

International Tax

State & Local Tax

Coronavirus Resource Center

Federal tax coronavirus resources

State and local tax coronavirus resources

Tax planning during and after COVID-19

Authored by Timothy Kosiek and Christopher DeMarco The small business owner's guide to the CARES Act For borrowers with a straightforward PPP loan compliance environment, we have developed a self-service, Excel-based loan forgiveness calculator. But if your situation is more complex, or you have limited staffing available to support the loan requirements, we can provide an automated approach to forecasting eligible spend, monitoring specific payroll exceptions, and managing compliance with final documentation requirements.
Business owners have been strongly affected by COVID-19 and are left with many questions. The programs and initiatives in the Coronavirus Aid, Relief, and Economic Security (CARES) Act passed by Congress are intended to assist them in overcoming the current challenges. Baker Tilly developed the below FAQs to guide business owners as well as certain not-for-profits and other employers during this uncertain time.  NOTICE: Baker Tilly is providing updated information as it becomes available. Due to the nature of the emerging and rapidly evolving information from government and non-government relief programs, some requirements and offerings may change before they are listed here. Please consult with your loan officer for the most current details. Paycheck Protection Program (PPP) loans The program provides cash-flow assistance through 100% federally guaranteed loans to employers who maintain their payroll during this emergency. If employers maintain their payroll, the loans are forgiven up to the full principal amount of qualifying loans guaranteed under the PPP, which would help your workers remain employed, as well as help your small businesses and our economy to snap back quicker after the crisis.  PPP has a host of attractive features, such as forgiveness of up to eight weeks of payroll based on employee retention and salary levels, no SBA fees and at least six months of deferral with maximum deferrals of up to a year. Small businesses and other eligible entities will be able to apply if they were harmed by COVID-19 between Feb. 15, 2020, and June 30, 2020. This program would be retroactive to Feb. 15, 2020, to help bring workers who may have already been laid off back onto payrolls.  View the PPP application Expand the section(s) below to view the FAQ.
Baker Tilly COVID-19 support During this uncertain time, Baker Tilly is ready to help you with practical advice on informing and supporting your employees as well as keeping your business running. 
The information provided here is of a general nature and is not intended to address the specific circumstances of any individual or entity. In specific circumstances, the services of a professional should be sought. Tax information, if any, contained in this communication was not intended or written to be used by any person for the purpose of avoiding penalties, nor should such information be construed as an opinion upon which any person may rely. The intended recipients of this communication and any attachments are not subject to any limitation on the disclosure of the tax treatment or tax structure of any transaction or matter that is the subject of this communication and any attachments.

Coronavirus Aid, Relief, and Economic Security Act – Baker Tilly specialists answer all your questions.

Privacy Shield no longer a valid mechanism for cross-border transfer of personal data

Pressure testing supply chain management: What do today’s challenges mean for government contractors?

Tax planning during and after COVID-19

Paycheck Protection Program (PPP) FAQ

Privacy Shield no longer a valid mechanism for cross-border transfer of personal data

Trending Tags