The fate of Privacy Shield will hang in the balance until at least June 20 as national representatives remain in talks. The Privacy Advisor has learned the Article 31 committee has scheduled at least two further meetings to discuss Privacy Shield after it failed to reach an agreement last week, sources confirmed. 

Under Directive 95/46/EC the European Commission, which negotiates on behalf of the EU, can only grant a third country adequacy – which is what the Privacy Shield deal amounts to – if the Article 31 committee approves. The much more prominent Article 29 Working Party (WP29), the European Data Protection Supervisor (EDPS) and the European Parliament, by contrast, are only invited to give opinions, and the Commission is not necessarily obliged to follow them.

The widely reported WP29 opinion was highly critical of the current Shield text and called for multiple clarifications. It described the text as vague, questioned the independence of the proposed U.S. ombudsman, and said the door was left open for “bulk collection” of data in “exceptional cases” contrary to the rules of the European Charter of Fundamental Rights.

The EDPS will publish his opinion on Monday, May 30, but told The Privacy Advisor that he shares many of the same concerns as the rest of the WP29. Meanwhile the Parliament today sent somewhat mixed messages to the Commission negotiators.

In a non-binding resolution, MEPs called on the Commission to continue to work with the U.S. to draw up a robust Privacy Shield deal. And in a debate before the vote, many MEPs questioned whether the Privacy Shield would stand up in court; however they stopped short of imposing a “sunset clause.”

Axel Voss from the conservative European People’s Party said, “a sunset clause is not necessary as we have a strong annual review procedure that makes the sunset clause redundant.”

From the left, Cornelia Ernst argued that having needed a European Court of Justice decision to get Safe Harbour removed, a sunset clause “should be the minimum required,” but instead “the big coalition here [in the Parliament] is applauding [Privacy Shield] loudly.”

Rapporteur for the General Data Protection Regulation Jan Philipp Albrecht said it was a “dishonest” approach to pretend to go along with Privacy Shield knowing that it may not stand. Albrecht said he was surprised that the other groups were not able to accept proposals for a sunset clause saying that his group had been pragmatic in its requests changing the timeframe to four years when there will be a new administration and sufficient time for the General Data Protection Regulation to have been implemented.

“Only with a time limit would there be pressure on the U.S. government to propose legislative changes, in particular for judicial redress against national security agencies and consumer privacy and data protection standards,” he said.

So it now falls to the Article 31 committee to have the final say. “It can only be hoped that the member states insist on a time limit for the Privacy Shield,” said Albrecht.

The Article 31 committee, which is made up of mid-level diplomats and is chaired by a European Commission official, must vote in favor of the proposal by a qualified majority – 16 member states representing at least 65 percent of the EU population. The Commission rep doesn’t have a vote.

But with the power of veto the group is determined to take its time. If they vote against it, or fail to reach a consensus opinion, the Commission has three options: It can drop the proposal, which definitely won’t happen, it can appeal, or it can submit a revised draft.

The Commission is already working to appease WP29 and is in constant communication with the Article 31 committee about developments. Even Justice Commissioner Věra Jourova admitted to the Parliament on Wednesday that, indeed, “Privacy Shield isn’t perfect, it can never be perfect. As Mr Albrecht rightly pointed out we don’t have the power to change the legislation in the United States. I will say very openly that we are not fully satisfied, but we are satisfied that we have achieved the maximum possible.”

The Article 31 committee is likely to share that pragmatism, but with competing concerns from different countries, no outcome is a foregone conclusion.

Image courtesy of European Commission.