EU-US Privacy Shield

The EU-US Privacy Shield is a framework for transatlantic exchanges of personal data for commercial purposes between the European Union and the United States.^[1] One of its purposes is to enable US companies to more easily receive personal data from EU entities under EU privacy laws meant to protect European Union citizens.^[2] The EU-US Privacy Shield is a replacement for the International Safe Harbor Privacy Principles, which were declared invalid by the European Court of Justice in October 2015.^[3]

Background history

In October 2015 the European Court of Justice declared the previous framework called the International Safe Harbor Privacy Principles invalid.^[3] Soon after this decision the European Commission and the U.S. Government started talks about a new framework and on 2 February 2016 they reached a political agreement.^[1] The European Commission published a draft “adequacy decision”, declaring principles to be equivalent to the protections offered by EU law.^[4]

The Article 29 Data Protection Working Party delivered an opinion on April 13, 2016, stating that the Privacy Shield offers major improvements compared to the Safe Harbour decisions, but that three major points of concern still remain. They relate to deletion of data, collection of massive amounts of data, and clarification of the new Ombudsperson mechanism.^[5] The European Data Protection Supervisor issued an opinion on 30 May 2016 in which he stated that "the Privacy Shield, as it stands, is not robust enough to withstand future legal scrutiny before the [European] Court".^[6]

On 8 July 2016 EU Member States representatives (article 31 committee) approved the final version of the EU-U.S. Privacy Shield, paving the way for the adoption of the decision by the Commission.^[7] The European Commission adopted the framework on 12 July 2016 and it went into effect the same day.^[8][9]

U.S. President Donald Trump signed an Executive Order entitled "Enhancing Public Safety" which states that U.S. privacy protections will not be extended beyond US citizens or residents:

Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.^[10]

The European Commission has stated that:

The US Privacy Act has never offered data protection rights to Europeans. The Commission negotiated two additional instruments to ensure that EU citizens’ data is duly protected when transferred to the US:

• The EU-US Privacy Shield, which does not rely on the protections under the US Privacy Act.
• The EU-US Umbrella Agreement, which enters into force on 1 February (2017). To finalise this agreement, the US Congress adopted a new law last year, the US Judicial Redress Act,^[11] which extends the benefits of the US Privacy Act to Europeans and gives them access to US courts.”^[12]

The Commission said it will “continue to monitor the implementation of both instruments”.^[13]

Response

German MEP Jan Philipp Albrecht and campaigner Max Schrems have criticized the new ruling, with the latter predicting that the Commission might be taking a "round-trip to Luxembourg" (where the European Court of Justice is located).^[14] EU Commissioner for Consumers, Vera Jourova, expressed confidence that a deal would be reached by the end of February.^[15] Many Europeans are demanding a mechanism for individual European citizens to lodge complaints over the use of their data, as well as a transparency scheme to assure that European citizens data does not fall into the hands of U.S intelligence agencies.^[16] The Article 29 Working Party has taken up this demand, and stated it will hold back another month until March 2016 to decide on consequences of Commissioner Jourova's new proposal. ^[17] The European Commission’s Director for Fundamental Rights Paul Nemitz stated at a conference in Brussels in January how the Commission would decide on the "adequacy" of data protection. ^[18] The Economist newspaper predicts that "once the Commission has issued a beefed-up 'adequacy decision', it will be harder for the ECJ to strike it down".^[19] Privacy activist Joe McNamee summed up the situation by noting the Commission has announced agreements prematurely, thus forfeiting its negotiating right.^[20] At the same time, the first court challenges in Germany have commenced: the Hamburg data protection authority was during February 2016 preparing to fine three companies for relying on Safe Harbour as the legal basis for their transatlantic data transfers and two other companies were under investigation.^[21] From the other side a reaction looks imminent.^[22]

Controversy

As of February 2017 the future of the Privacy Shield is contested. One consultant, Matt Allison, predicts that "The EU's citizen-driven, regulated model will swiftly come into conflict with the market forces of the US and the UK." ^[23] Allison summarizes a new paper in which the European Commission lays out its plans for adequacy decisions and global strategy. ^[24]

See also

• Binding corporate rules
• Electronic Communications Privacy Act
• FTC Fair Information Practice (FIPP's), US
• International Safe Harbor Privacy Principles
• IT risk
• Privacy
• Safe harbor (law)
• Stored Communications Act

References

External links

• EU-U.S. Privacy Shield fact sheet at the European Union
• EU-U.S. Privacy Shield press release from the European Commission, with a draft adequacy decision attached, 29 February 2016
• EU-U.S. Privacy Shield fact sheet at the US Department of Commerce