Privacy Shield Panned as Insufficient by EU Authorities

    Jun 06, 2016

    Following in the footsteps of the Article 29 Working Party of EU data protection officials, the European Parliament on May 26 adopted a resolution calling on the European Commission to renegotiate with the United States to make improvements in the U.S.-EU Privacy Shield. On May 30, European Data Protection Supervisor (EDPS) Giovanni Buttarelli issued a similar opinion calling for additional changes in the agreement.

    On April 13, the Article 29 Working Party had issued an opinion stating that the draft U.S.-EU Privacy Shield, which was negotiated by the European Commission and U.S. regulators and released on February 29, does not offer the full range of data protection to EU data subjects and wouldn't provide sufficient safeguards against potential government bulk collection of personal data.

    The Parliament’s non-binding resolution outlines a number of deficiencies in the proposed agreement, including access by U.S. authorities to data transferred under the Privacy Shield, the continued potential for bulk data collection in violation of EU Charter of Fundamental Rights, a complicated redress mechanism, and an inadequate and insufficiently independent U.S. ombudsperson that can effectively exercise and enforce the agreement.

    The EDPS opinion, while recognizing that the Privacy Shield as a whole ensures a level of protection that is essentially equivalent to the principles of the European Data Protection Directive, said the draft Privacy Shield omits substantive details of some of those principles.

    “I appreciate the efforts made to develop a solution to replace Safe Harbour but the Privacy Shield as it stands is not robust enough to withstand future legal scrutiny before the Court,” Buttarelli said in a press release. “Significant improvements are needed should the European Commission wish to adopt an adequacy decision, to respect the essence of key data protection principles with particular regard to necessity, proportionality and redress mechanisms. Moreover, it’s time to develop a longer term solution in the transatlantic dialogue.”

    The European Commission said it would amend the decision approving the Privacy Shield in line with the Article 29 Working Party opinion, the Parliament resolution, and the EDPS opinion; it is in discussions with the United States to do so. 

    “We take these expert recommendations very seriously and we are now working – including with the U.S. side – to incorporate some clarifications in the final text,” stated Commissioner VÄ›ra Jourová in a May 10 speech.

    Once an amended version of the Privacy Shield decision is completed, it will be considered by a regulatory committee of EU member country representatives. If a favorable opinion is forthcoming, the European Commission is expected to adopt the Privacy Shield decision by late summer.

    The Washington Policy Brief is an online advisory that contains brief summaries of recent legislative and regulatory issues that may affect the records and information management profession. Further information about the issue is accessed by clicking on the link provided at the end of each summary.


    Want to sign up to receive an e-mail version of the Washington Policy Brief? It's free! Just tell us a little about yourself and you'll receive a monthly dose of the latest in legislation, regulation, and more.



    © 2017, ARMA International