Articles

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

13.10.2016

The Article 29 Data Protection Working Party (“WP29”) remain concerned about the recently adopted Privacy Shield as follows from their recent statement dated 1 July 2016.

The WP29’s concerns are not new. The WP29 already expressed concerns with respect to the Privacy Shield before it was adopted. It did so on 13 April 2016 (in its Opinion 01/2016, the “Opinion”) addressing three major points:

  1. Once a data transfer to the US has been effectuated, the US entities do not have legal obligations similar to those that apply to EU entities to delete data if it is no longer necessary to keep these data for the purpose of which the data is collected.
  2. In the US, the continuous collection of massive and indiscriminate data is not fully excluded. Consequently, such data collection is an unjustified interference with the fundamental rights of individuals under EU privacy law.
  3. The WP29 raises concerns regarding the introduction of the US privacy ombudsperson mechanism and whether the US privacy ombudsperson has sufficient powers to provide for effective functioning.

Furthermore, as a more general concern, the WP29 considered that various points of the draft adequacy decision require further clarification, and the key data protection notions used in the Privacy Shield were not defined and applied in a consistent way.

Meanwhile, the Privacy Shield, including the changes that have been made to reflect – some of – the WP29 concerns, has entered into force on 12 July 2016. Privacy principles are further defined and clarified, and more clarity is provided about the transfer of personal data. Furthermore, the European privacy authorities are authorized from now on to deal with complaints about US national security authorities. If required, complaints can also be transferred to the US privacy ombudsperson via a new European complaint institution.

However, not all concerns of the WP29 that were recently addressed in the Opinion have been implemented in the Privacy Shield. This is the main reason why the WP29 reiterated certain concerns:

  • The Privacy Shield still does not contain specific rules on “automated decisions” (which are fullyautomated processing of personal data intended to evaluate certain personal aspects relating to individuals, such as performance at work, creditworthiness, reliability, conduct, etc.), and it also does not contain a general right to object to such automated decisions
  • No commitment is imposed on the US to not conduct mass and indiscriminate collection of personal data (as stated under 1 above).
  • The provisions of the Privacy Shield are unclear as to how they will apply to data processors in the US.
  • The exact powers and independence of the US privacy ombudsperson and whether such powers are sufficient for him or her to perform his or her tasks effectively remain unclear. And although during the negotiations regarding the Privacy Shield the US has indicated that the US privacy ombudsperson will objectively perform his or her tasks and will not be influenced in an inadmissible way, the current Privacy Shield does not impose any obligation or confirm formally the existence of an obligation in this respect.

In conclusion, the WP29 still finds there are several provisions in the Privacy Shield that require improvement. The first joint annual review of the Privacy Shield, which is expected to take place in May 2017, will therefore be a key moment for further assessment of the functioning and efficiency of the Privacy Shield.

The WP29 Opinion can be found on http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinionrecommendation/ files/2016/wp238_en.pdf 

Team

Related news

18.06.2021 NL law
FAQ: Wat houdt het Wetsvoorstel elektronische gegevensuitwisseling in de zorg (Wegiz) in en wat is de verhouding tot de AVG?

Short Reads - (Digitale) gegevensuitwisseling in de zorg is een actueel thema. Illustratief is een item bij EenVandaag van april 2021 waarin de analoge werkwijze bij gegevensuitwisseling in de zorg wordt aangekaart, maar ook dit artikel in het NRC van afgelopen maand waarin verslag werd gedaan van een datalek waardoor duizenden gevoelige patiëntgegevens op straat kwamen te liggen. 

Read more

04.05.2021 NL law
Participatie en privacyregels: hoe te combineren onder de Omgevingswet?

Short Reads - In het stelsel van de Omgevingswet (Ow) is een belangrijke rol bedacht voor participatie bij de totstandkoming van besluiten. Het beoogde resultaat: tijdig belangen, meningen en creativiteit op tafel krijgen en daarmee een groter draagvlak en kwalitatief betere besluitvorming bereiken. Door een grotere betrokkenheid van meer personen gaan overheden en initiatiefnemers ook meer persoonsgegevens verwerken. Dit brengt privacyrisico’s met zich mee. Wat regelt de Ow op het gebied van privacy, de verwerking van persoonsgegevens en datagebruik?

Read more

04.03.2021 BE law
Webinar: Responding to Personal Data Breaches in the Post-GDPR era

Seminar - On 24-26 March 2021 ERA (Adademy of European Law) organises an online Conference "Responding to Personal Data Breaches in the Post-GDPR era". Erik Valgaeren, our Brussels TMT partner, addresses the topic "Managing personal data breach in a complex international scenario", including cross border cases in the EU and breaches at non-EU establishments.

Read more

18.05.2021 NL law
Kroniek: De bestuursrechtelijke aspecten van de AVG

Articles - Tom Barkhuysen, Steven Bastiaans, Fenneke Buskermolen en Fatma Çapkurt (Universiteit Leiden) schreven samen de eerste editie van de nieuwe jaarlijkse NTB kroniek: de bestuursrechtelijke aspecten van de AVG. Hierin bespreken zij onder meer de meest relevante (bestuursrechtelijke) jurisprudentie van het afgelopen jaar op het gebied van de AVG.

Read more