As has been widely reported (see Baker & McKenzie client alert), the European Court of Justice (ECJ) invalidated the EU/US Safe Harbor Program which allowed transfers of personal data of EU/EEA residents to U.S. companies that registered under the program. Generally, such transfers are allowed only if a permissible ground exists, and the Safe Harbor Program was a convenient ground for many U.S. companies doing business in the EU/EEA. By invalidating the program, these companies are now forced to rely on other grounds, such as the data subject’s express consent or Model Agreements between the transferring and receiving entity.
What Does This Mean for Equity Award Administration?
In the context of equity awards, U.S. companies granting awards to employees in the EU/EEA have to collect, process and transfer the employees’ personal data (i.e., information by which an employee can be identified) to administer their participation in the plan. Usually, the equity award database is maintained in the U.S., so the data has to be transferred to the U.S. In addition, the data is often shared with third-party providers (e.g., stock plan brokers) which also maintain databases in the U.S.