Flawed EU-US #PrivacyShield fully operational from today

The decision on the EU- US Privacy Shield was adopted by the European Commission on 12 July. As of today, companies are able to sign up to the Privacy Shield with the US Department of Commerce who will then verify that their privacy policies comply with the high data protection standards required by the Privacy Shield.

Today (1 August), the European Commission publishes a guide for citizens explaining how citizen's data protection rights are guaranteed under the Privacy Shield and what remedies are available for individuals, if they consider that their data has been misused or that their data protection rights have not been respected.

The Privacy Shield is the successor to Safe Harbor, which was struck down by the European Court of Justice in October 2015 for failing to prevent the US government from gaining routine access to European citizens’ data.

Jan Philipp Albrecht MEP a leading privacy campaigner has called the new deal a blank cheque for the transfer of personal data of EU citizens to the US. He argues that the ‘shield’ does not offer equivalent data protection rights required in the European Court of Justice’s judgement. In particular, the individual rights of consumers are still too weak and blanket surveillance measures are still in place. Albrecht says that the Commission should not simply accept reassurances from the US authorities. but should be insisting on improvements in the data protection guaranteed to European consumers.

Věra Jourová, the EU's Commissioner for Justice, Consumers and Gender Equality asserts that: "The EU-US Privacy Shield protects the fundamental rights of Europeans and ensures legal certainty for businesses, including European companies, transferring personal data to the US. The Privacy Shield ensures easier redress for individuals in case of any complaints. I am therefore confident that the Privacy Shield will restore the trust of Europeans in the way their personal data is transferred across the Atlantic and processed by companies there. I encourage companies to sign up and I invite citizens to find out about their rights under the Privacy Shield."

The Article 29 Data Protection Working Party (WP29) established under the Directive on data protection have voiced concerns, some of these concerns have been addressed but doubts remain over commercial aspects and the access by US public authorities to data transferred from the EU. In particular WP29 regrets the lack of concrete assurances that such practice, namely mass surveillance prohibited by the European court’s judgement, does not take place.

The EU-US Privacy Shield’s guarantee that everyone in the EU has a number of rights when their data is processed, such as the right to ask a company for further information about the data they hold about them, or to amend their records if the information is outdated or inaccurate. Also they will benefit from several accessible and affordable dispute resolution mechanisms. Ideally, the complaint will be resolved by the company itself; or free of charge Alternative Dispute resolution (ADR) solutions will be offered. Individuals can also go to their national Data Protection Authorities, who will work with the U.S. Department of Commerce and Federal Trade Commission to ensure that complaints by EU citizens are investigated and resolved. If a case is not resolved by any of the other means, as a last resort there will be an arbitration mechanism. Redress regarding possible access to personal data for national security purposes will be handled by a new Ombudsperson independent of US intelligence services. The European Ombudsman, Emily O'Reilly, has also raised concerns about the independence of this proposed ombudsperson saying that an ombudsman : "must be visibly and demonstrably independent from those whom the Ombudsman has the power to investigate."

To find out more, visit the privacy shield website

Share this article: