The Article 29 Data Protection Working Party (“WP29”) remain concerned about the recently adopted Privacy Shield as follows from their recent statement dated 1 July 2016.
The WP29’s concerns are not new. The WP29 already expressed concerns with respect to the Privacy Shield before it was adopted. It did so on 13 April 2016 (in its Opinion 01/2016, the “Opinion”) addressing three major points:
- Once a data transfer to the US has been effectuated, the US entities do not have legal obligations similar to those that apply to EU entities to delete data if it is no longer necessary to keep these data for the purpose of which the data is collected.
- In the US, the continuous collection of massive and indiscriminate data is not fully excluded. Consequently, such data collection is an unjustified interference with the fundamental rights of individuals under EU privacy law.
- The WP29 raises concerns regarding the introduction of the US privacy ombudsperson mechanism and whether the US privacy ombudsperson has sufficient powers to provide for effective functioning.
Furthermore, as a more general concern, the WP29 considered that various points of the draft adequacy decision require further clarification, and the key data protection notions used in the Privacy Shield were not defined and applied in a consistent way.
Meanwhile, the Privacy Shield, including the changes that have been made to reflect – some of – the WP29 concerns, has entered into force on 12 July 2016. Privacy principles are further defined and clarified, and more clarity is provided about the transfer of personal data. Furthermore, the European privacy authorities are authorized from now on to deal with complaints about US national security authorities. If required, complaints can also be transferred to the US privacy ombudsperson via a new European complaint institution.
However, not all concerns of the WP29 that were recently addressed in the Opinion have been implemented in the Privacy Shield. This is the main reason why the WP29 reiterated certain concerns:
- The Privacy Shield still does not contain specific rules on “automated decisions” (which are fullyautomated processing of personal data intended to evaluate certain personal aspects relating to individuals, such as performance at work, creditworthiness, reliability, conduct, etc.), and it also does not contain a general right to object to such automated decisions
- No commitment is imposed on the US to not conduct mass and indiscriminate collection of personal data (as stated under 1 above).
- The provisions of the Privacy Shield are unclear as to how they will apply to data processors in the US.
- The exact powers and independence of the US privacy ombudsperson and whether such powers are sufficient for him or her to perform his or her tasks effectively remain unclear. And although during the negotiations regarding the Privacy Shield the US has indicated that the US privacy ombudsperson will objectively perform his or her tasks and will not be influenced in an inadmissible way, the current Privacy Shield does not impose any obligation or confirm formally the existence of an obligation in this respect.
In conclusion, the WP29 still finds there are several provisions in the Privacy Shield that require improvement. The first joint annual review of the Privacy Shield, which is expected to take place in May 2017, will therefore be a key moment for further assessment of the functioning and efficiency of the Privacy Shield.
The WP29 Opinion can be found on http://ec.europa.eu/ justice/data-protection/article-29/documentation/opinionrecommendation/ files/2016/wp238_en.pdf
