Articles

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

13.10.2016

The Article 29 Data Protection Working Party (“WP29”) remain concerned about the recently adopted Privacy Shield as follows from their recent statement dated 1 July 2016.

The WP29’s concerns are not new. The WP29 already expressed concerns with respect to the Privacy Shield before it was adopted. It did so on 13 April 2016 (in its Opinion 01/2016, the “Opinion”) addressing three major points:

  1. Once a data transfer to the US has been effectuated, the US entities do not have legal obligations similar to those that apply to EU entities to delete data if it is no longer necessary to keep these data for the purpose of which the data is collected.
  2. In the US, the continuous collection of massive and indiscriminate data is not fully excluded. Consequently, such data collection is an unjustified interference with the fundamental rights of individuals under EU privacy law.
  3. The WP29 raises concerns regarding the introduction of the US privacy ombudsperson mechanism and whether the US privacy ombudsperson has sufficient powers to provide for effective functioning.

Furthermore, as a more general concern, the WP29 considered that various points of the draft adequacy decision require further clarification, and the key data protection notions used in the Privacy Shield were not defined and applied in a consistent way.

Meanwhile, the Privacy Shield, including the changes that have been made to reflect – some of – the WP29 concerns, has entered into force on 12 July 2016. Privacy principles are further defined and clarified, and more clarity is provided about the transfer of personal data. Furthermore, the European privacy authorities are authorized from now on to deal with complaints about US national security authorities. If required, complaints can also be transferred to the US privacy ombudsperson via a new European complaint institution.

However, not all concerns of the WP29 that were recently addressed in the Opinion have been implemented in the Privacy Shield. This is the main reason why the WP29 reiterated certain concerns:

  • The Privacy Shield still does not contain specific rules on “automated decisions” (which are fullyautomated processing of personal data intended to evaluate certain personal aspects relating to individuals, such as performance at work, creditworthiness, reliability, conduct, etc.), and it also does not contain a general right to object to such automated decisions
  • No commitment is imposed on the US to not conduct mass and indiscriminate collection of personal data (as stated under 1 above).
  • The provisions of the Privacy Shield are unclear as to how they will apply to data processors in the US.
  • The exact powers and independence of the US privacy ombudsperson and whether such powers are sufficient for him or her to perform his or her tasks effectively remain unclear. And although during the negotiations regarding the Privacy Shield the US has indicated that the US privacy ombudsperson will objectively perform his or her tasks and will not be influenced in an inadmissible way, the current Privacy Shield does not impose any obligation or confirm formally the existence of an obligation in this respect.

In conclusion, the WP29 still finds there are several provisions in the Privacy Shield that require improvement. The first joint annual review of the Privacy Shield, which is expected to take place in May 2017, will therefore be a key moment for further assessment of the functioning and efficiency of the Privacy Shield.

The WP29 Opinion can be found on http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinionrecommendation/ files/2016/wp238_en.pdf 

Team

Related news

27.03.2019 NL law
Ook WhatsApp- en sms-berichten op privételefoons vallen onder Wet openbaarheid van bestuur

Short Reads - De Afdeling bestuursrechtspraak van de Raad van State heeft in een uitspraak van 20 maart 2019 (ECLI:NL:RVS:2019:899) bevestigd dat ook WhatsApp- en sms-berichten onder de reikwijdte van de Wet openbaarheid van bestuur (Wob) vallen. Dat geldt niet alleen voor WhatsApp- en sms-berichten die staan op werktelefoons, maar ook voor berichten die staan op privételefoons van bestuurders of ambtenaren. Daarmee gaat de Afdeling terecht verder dan de rechtbank (ECLI:NL:RBMNE:2017:5979) in eerste aanleg, die van oordeel was dat de Wob niet van toepassing is op berichten op privételefoons.

Read more

21.03.2019 NL law
15 aspects of Brexit you did not know

Short Reads - A Brexit without a deal, or with a deal that does not cover all relevant aspects, is still a potential scenario. We have highlighted a number of unexpected legal consequences of Brexit in such a no deal or incomplete deal scenario.

Read more

Our website uses functional cookies for the functioning of the website and analytic cookies that enable us to generate aggregated visitor data. We also use other cookies, such as third party tracking cookies - please indicate whether you agree to the use of these other cookies:

Privacy – en cookieverklaring