On April 13, 2016, the Article 29 Working Party issued a statement detailing its opinion on the upcoming Privacy Shield agreement, the deal that will ensure that the transfer of personal data from EU countries to the US will be able to continue. The statement criticizes the agreement on several points, despite the acknowledgment that the Privacy Shield agreement is a significant improvement compared to the demised Safe Harbor. The European Commission (EC) is not obliged to take on board the comments of the Article 29 Working Group; however, it is now unlikely that the deal will go through without further amendments.
Back to the drawing board for the Privacy Shield agreement
The Article 29 Working Party (the body that groups together the Data Protection Authorities of EU countries) has sent the EC back to the drawing board on the Privacy Shield agreement. Tech companies have eagerly awaited this agreement since the demise of Safe Harbor.
Since the EC announced the key points of its deal with the US authorities, concerns have emerged about certain aspects, such as the many exceptions under which the bulk use of personal data could still be possible for US authorities. There are also concerns that the powers and independence of the ombudsperson, which should ensure that EU citizens have the ability to seek redress in cases of privacy breaches, are not clearly defined and guaranteed.
The opinion of the Article 29 Working Party is not binding for the EC; however, it is unlikely that the EC will be able to ignore it. It represents the position of Data Protection Authorities of influential member states. Also, the EC should be worried about building a framework that is not too easily subjected to legal challenge. If the European Court of Justice finds that the flaws of Safe Harbor have not been addressed in the Privacy Shield agreement, it will not hesitate to strike the latter down too. Companies affected by this agreement should prepare to face more uncertainty, because the deal is likely to undergo further amendments before it is finalized.
Data Protection Tracker: 4Q15, TE0007-000955 (December 2015)
"The EU–US Privacy Shield agreement will not address surveillance concerns," TE0007-000999 (March 2016)
Luca Schiavoni, Senior Analyst, Regulation