Articles

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

Privacy authorities remain concerned about the Privacy Shield

13.10.2016

The Article 29 Data Protection Working Party (“WP29”) remain concerned about the recently adopted Privacy Shield as follows from their recent statement dated 1 July 2016.

The WP29’s concerns are not new. The WP29 already expressed concerns with respect to the Privacy Shield before it was adopted. It did so on 13 April 2016 (in its Opinion 01/2016, the “Opinion”) addressing three major points:

  1. Once a data transfer to the US has been effectuated, the US entities do not have legal obligations similar to those that apply to EU entities to delete data if it is no longer necessary to keep these data for the purpose of which the data is collected.
  2. In the US, the continuous collection of massive and indiscriminate data is not fully excluded. Consequently, such data collection is an unjustified interference with the fundamental rights of individuals under EU privacy law.
  3. The WP29 raises concerns regarding the introduction of the US privacy ombudsperson mechanism and whether the US privacy ombudsperson has sufficient powers to provide for effective functioning.

Furthermore, as a more general concern, the WP29 considered that various points of the draft adequacy decision require further clarification, and the key data protection notions used in the Privacy Shield were not defined and applied in a consistent way.

Meanwhile, the Privacy Shield, including the changes that have been made to reflect – some of – the WP29 concerns, has entered into force on 12 July 2016. Privacy principles are further defined and clarified, and more clarity is provided about the transfer of personal data. Furthermore, the European privacy authorities are authorized from now on to deal with complaints about US national security authorities. If required, complaints can also be transferred to the US privacy ombudsperson via a new European complaint institution.

However, not all concerns of the WP29 that were recently addressed in the Opinion have been implemented in the Privacy Shield. This is the main reason why the WP29 reiterated certain concerns:

  • The Privacy Shield still does not contain specific rules on “automated decisions” (which are fullyautomated processing of personal data intended to evaluate certain personal aspects relating to individuals, such as performance at work, creditworthiness, reliability, conduct, etc.), and it also does not contain a general right to object to such automated decisions
  • No commitment is imposed on the US to not conduct mass and indiscriminate collection of personal data (as stated under 1 above).
  • The provisions of the Privacy Shield are unclear as to how they will apply to data processors in the US.
  • The exact powers and independence of the US privacy ombudsperson and whether such powers are sufficient for him or her to perform his or her tasks effectively remain unclear. And although during the negotiations regarding the Privacy Shield the US has indicated that the US privacy ombudsperson will objectively perform his or her tasks and will not be influenced in an inadmissible way, the current Privacy Shield does not impose any obligation or confirm formally the existence of an obligation in this respect.

In conclusion, the WP29 still finds there are several provisions in the Privacy Shield that require improvement. The first joint annual review of the Privacy Shield, which is expected to take place in May 2017, will therefore be a key moment for further assessment of the functioning and efficiency of the Privacy Shield.

The WP29 Opinion can be found on http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinionrecommendation/ files/2016/wp238_en.pdf 

Team

Related news

07.12.2018 BE law
GDPR-roundtable on practical questions encountered during implementation

Roundtable - After the success of the roundtable sessions we held before the GDPR took effect (in May this year), our TMT team is enthusiastic about the session of 7 December, focusing on the lessons we have learned from working on multiple GDPR-matters in the past year. We will tackle some practical questions that we have encountered and that are not or cannot be readily answered by the new regulation.

Read more

20.11.2018 NL law
Seminar 'Personal data from a broader perspective: overlap inside and outside the privacy domain'

Seminar - On 20 November 2018, Stibbe will host a seminar on privacy. Several Stibbe lawyers will discuss personal data from a broader perspective and the overlap that can occur inside and outside the legal privacy domain.

Read more

07.12.2018 BE law
Virtual Currency Regulation Law Review

Articles - The first edition of the Virtual Currency Regulation Law Review is intended to provide a practical, business-focused analysis of recent legal and regulatory changes and developments, and of their effects, and to look forward at expected trends in the area of virtual currencies on a country-by-country basis.

Read more

Our website uses cookies: third party analytics cookies to best adapt our website to your needs & cookies to enable social media functionalities. For more information on the use of cookies, please check our Privacy and Cookie Policy. Please note that you can change your cookie opt-ins at any time via your browser settings.

Privacy – en cookieverklaring