Trends

Article 29 WP sceptical on the EU/US Privacy Shield

Article 29 WP sceptical on the EU/US Privacy Shield

Article 29 WP sceptical on the EU/US Privacy Shield

14.04.2016

On 6 October 2015, the CJEU invalidated the U.S. Safe Harbor.

The EU Commission then published a draft adequacy decision on 29 February, putting in place a new legal framework for transatlantic transfers of personal data (the “Privacy Shield”).

Yesterday, the WP29, a body composed of all the EU DPAs, issued its opinion on the Privacy Shield. It welcomes the “significant improvements brought by the Privacy Shield compared to the Safe Harbour decision”. However, it expresses several concerns and urges the Commission to resolve them. The main points of criticism are:

  1. the Privacy Shield package lacks clarity, both in terms of structure and language;
  2. some key EU data protection principles are not reflected, barring a finding of “essential equivalence”; and
  3. within the context of surveillance, there is no clear limitation on massive and indiscriminate collection of personal data originating from the EU.

Although this opinion is not legally binding, it is an important step as regards the ultimate final approval of the Privacy Shield by EU countries. You can find the opinion here.
 

Team

Related news

20.09.2022 EU law
Launch of Metaverse blog series

Articles - Stibbe launches a new blog series focusing on the legal challenges of the Metaverse. In our upcoming blog posts, we will discuss the legal challenges of NFTs, crypto-assets, Metaverse platforms, crypto exchanges, DAO, and many more.

Read more

28.07.2022 NL law
Zuiver commercieel belang ook gerechtvaardigd belang: Raad van State laat zich er niet over uit

Short Reads - Op 27 juli 2022 heeft de Raad van State bevestigd dat de Autoriteit Persoonsgegevens onterecht een boete van € 575.000 aan VoetbalTV heeft opgelegd. De hoop bestond dat de Afdeling antwoord zou geven op de vraag of de AP terecht of onterecht meent dat een zuiver commercieel belang géén gerechtvaardigd belang kan zijn in de zin van de Algemene Verordening Gegevensbescherming. Het antwoord op deze vraag blijft echter uit.  

Read more

28.07.2022 NL law
Purely commercial interest also a legitimate interest? Council of State leaves the question unanswered.

Short Reads - On 27 July 2022, the Council of State confirmed that the Dutch Data Protection Authority wrongly imposed a €575,000 fine on VoetbalTV. But the Council did not answer the question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest within the meaning of the General Data Protection Regulation.

Read more