Greetings from Brussels!
This week the European Commission published its first annual report on the functioning of the EU-U.S. Privacy Shield. As a reminder, the aim of the Shield is to protect and safeguard the personal data of anyone in the EU transferred to the U.S. for commercial purposes. As you may know, the European Commission last month conducted its first annual review and audit of the young framework to assess whether the U.S. has maintained its commitments and guarantees — failing which, the European Commission could suspend the Privacy Shield. After the Safe Harbour debacle, there was much at stake for the global economy.
The report summarizes both the strengths and perceived weaknesses of the framework as it stands. And, following one year in operation, the overall opinion showed that the Privacy Shield continues to ensure an adequate level of protection for the personal data transferred from the EU to participating companies in the U.S.
The EU reports that the U.S. authorities have implemented the necessary structures and procedures to ensure the correct functioning of the Privacy Shield, such as new redress possibilities for EU individuals. Complaint-handling and enforcement procedures have been set up, and cooperation with the European data protection authorities has been stepped up. The certification process is functioning well — more than 2,400 companies have now been certified by the U.S. Department of Commerce. As regards access to personal data by U.S. public authorities for national security purposes, relevant safeguards on the U.S. side remain in place.
If you’ll recall, many of the protections put in place were by means of Presidential Policy Directive 28, signed by former U.S. President Barack Obama. EU Justice Commissioner Vera Jourová said, “The change of administration in the U.S. made this first annual review especially relevant.” Section 702 of the U.S. Foreign Intelligence Surveillance Act, which expires at the end of this year — unless it is reauthorized by the U.S. Congress — still allows U.S. authorities to snoop on EU citizens' email and other digital communications under certain conditions. “For us, the best-case scenario would be if the Congress considered enshrining the protections of data for non-U.S. citizens into this law,” Jourová said.
There were, however, several recommendations to address perceived weaknesses, including the Commission urging the United States to appoint a permanent Privacy Shield ombudsperson as soon as possible — a new office that was created to deal with complaints from EU citizens about U.S. spying, but which is currently only filled on an “acting” basis. In addition, the Commission requested that the U.S. ensure the empty posts are filled on the Privacy and Civil Liberties Oversight Board. The report also requests a more proactive and regular monitoring of companies' compliance with their Privacy Shield obligations by the U.S. Department of Commerce. Further, the U.S. Department of Commerce should also conduct regular searches for companies making false claims about their participation in the Privacy Shield.
In terms of next steps, the report will be sent to the European Parliament, the Council and the Article 29 Working Party, as well as to the U.S. authorities. The Commission will work with the U.S. authorities on the follow-up of its recommendations in the coming months. It goes without saying, the Commission will continue to closely monitor the ongoing functioning of Privacy Shield framework and maintain an open dialogue with the U.S. authorities with respect to their compliance with the commitments.
We should also expect an independent opinion from the WP29 now that the EU executive branch has released their findings. All in all, this is positive news for the more than 2,400 companies signed up to the framework, especially since the Privacy Shield and other alternative transfer mechanisms are already being challenged in European courts by privacy activists. This report may well have a bearing on those proceedings, the final outcome of which we will wait for with much interest.