Articles

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

13.10.2016 EU law

The Article 29 Data Protection Working Party (“WP29”) remain concerned about the recently adopted Privacy Shield as follows from their recent statement dated 1 July 2016.

The WP29’s concerns are not new. The WP29 already expressed concerns with respect to the Privacy Shield before it was adopted. It did so on 13 April 2016 (in its Opinion 01/2016, the “Opinion”) addressing three major points:

  1. Once a data transfer to the US has been effectuated, the US entities do not have legal obligations similar to those that apply to EU entities to delete data if it is no longer necessary to keep these data for the purpose of which the data is collected.
  2. In the US, the continuous collection of massive and indiscriminate data is not fully excluded. Consequently, such data collection is an unjustified interference with the fundamental rights of individuals under EU privacy law.
  3. The WP29 raises concerns regarding the introduction of the US privacy ombudsperson mechanism and whether the US privacy ombudsperson has sufficient powers to provide for effective functioning.

Furthermore, as a more general concern, the WP29 considered that various points of the draft adequacy decision require further clarification, and the key data protection notions used in the Privacy Shield were not defined and applied in a consistent way.

Meanwhile, the Privacy Shield, including the changes that have been made to reflect – some of – the WP29 concerns, has entered into force on 12 July 2016. Privacy principles are further defined and clarified, and more clarity is provided about the transfer of personal data. Furthermore, the European privacy authorities are authorized from now on to deal with complaints about US national security authorities. If required, complaints can also be transferred to the US privacy ombudsperson via a new European complaint institution.

However, not all concerns of the WP29 that were recently addressed in the Opinion have been implemented in the Privacy Shield. This is the main reason why the WP29 reiterated certain concerns:

  • The Privacy Shield still does not contain specific rules on “automated decisions” (which are fullyautomated processing of personal data intended to evaluate certain personal aspects relating to individuals, such as performance at work, creditworthiness, reliability, conduct, etc.), and it also does not contain a general right to object to such automated decisions
  • No commitment is imposed on the US to not conduct mass and indiscriminate collection of personal data (as stated under 1 above).
  • The provisions of the Privacy Shield are unclear as to how they will apply to data processors in the US.
  • The exact powers and independence of the US privacy ombudsperson and whether such powers are sufficient for him or her to perform his or her tasks effectively remain unclear. And although during the negotiations regarding the Privacy Shield the US has indicated that the US privacy ombudsperson will objectively perform his or her tasks and will not be influenced in an inadmissible way, the current Privacy Shield does not impose any obligation or confirm formally the existence of an obligation in this respect.

In conclusion, the WP29 still finds there are several provisions in the Privacy Shield that require improvement. The first joint annual review of the Privacy Shield, which is expected to take place in May 2017, will therefore be a key moment for further assessment of the functioning and efficiency of the Privacy Shield.

The WP29 Opinion can be found on http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinionrecommendation/ files/2016/wp238_en.pdf 

Team

Related news

26.10.2017 NL law
Autoriteit Persoonsgegevens adviseert negatief over Implementatiewet PSD2

Short Reads - Het wetsvoorstel Implementatiewet herziene richtlijn betaaldiensten ("Wet PSD2") voorziet in de wijziging van verschillende wetten (waaronder de Wet financieel toezicht (Wft) en het Burgerlijk Wetboek (BW)) en de nationale omzetting van Richtlijn (EU) 2015/2366 van het Europees Parlement en de Raad van 25 november 2015 betreffende betalingsdiensten in de interne markt, houdende wijziging van de Richtlijnen 2002/65/EG, 2009/110/EG en 2013/36/EU en Verordening (EU) nr. 1093/2010 en houdende intrekking van Richtlijn 2007/64/EG.

Read more

25.10.2017 NL law
Ontwerpwet Generieke Digitale Infrastructuur voor advies naar de Autoriteit Persoonsgegevens

Short Reads - Met de ontwerpwet Generieke Digitale Infrastructuur ("Wet GDI") wordt beoogd dat burgers de beschikking krijgen over elektronische identificatiemiddelen ("eID") met een hoger betrouwbaarheidsniveau dan het huidige DigiD. Tegelijkertijd krijgen publieke dienstverleners meer zekerheid over de identiteit de burger aan wie zij die diensten verlenen.

Read more

Our website uses cookies: third party analytics cookies to best adapt our website to your needs & cookies to enable social media functionalities. For more information on the use of cookies, please check our Privacy and Cookie Policy. Please note that you can change your cookie opt-ins at any time via your browser settings.

Privacy and Cookie Policy