Greetings from Brussels!

It has been a busy week for the Article 29 Working Party, meeting here in Brussels this week. The EU data protection authorities have temporarily given a "green light" to the Privacy Shield as indicated in a recent statement that they will hold off for at least one year on any new challenges to the EU-U.S. Privacy Shield.

If you recall, in its original opinion on the draft Privacy Shield issued in April, the WP29 expressed concern and asked for various clarifications. In its latest statement, the WP29 said that a “number of these concerns remain regarding both the commercial aspects and the access by U.S. public authorities to data transferred from the EU.” Concerning access by U.S. public authorities to data transferred, the WP29 would have expected “stricter guarantees concerning the independence and the powers of the ombudsperson mechanism.” In what concerns bulk collection of data, while respecting the commitment of the Office of the Director of National Intelligence to not carry out mass and indiscriminate collection, it seems that concrete assurances that this will not be the case have not been entirely forthcoming to the satisfaction of the WP29.

As such, the first joint annual review seems to be the key pivotal mechanism for assessing the effectiveness of the safeguards in place and by extension the validity of the Privacy Shield going forward. Nonetheless, this does not necessarily mean that its provisions will not face any legal challenges over the coming year. The appropriate interpretation of the WP29 position is best summed up as the European data protection authorities agreeing not to reject the Privacy Shield before it has had the chance to prove its worthiness and robustness; a cautious approach stopping short of actual endorsement. Moreover, the findings of the annual review could well influence the future validity of the alternative transfer mechanisms: the standard contract clauses and BCRs.

In other news this week, the EU's privacy watchdog, the EDPS, has called for an expansion in the e-Privacy Directive to cover more types of communication services and providers (think of the broad range of services offered over the internet). In its preliminary opinion submitted for the European Commission's review of the directive, the EDPS said the EU should "preserve and not reduce" the protection offered by the current e-Privacy Directive, while harmonizing some provisions to "complement" the GDPR. The e-Privacy Directive provides a specific set of privacy rules that are applicable to data processing in the telecoms sector. Until it is amended, the directive will coexist with the GDPR, which is applicable to all sectors, telecoms included. Giovanni  Buttarelli and his team have said that a new legal framework for e-Privacy is required, one that is "smarter, clearer and stronger."

Buttarelli is also reaffirming his pro-privacy "anti-backdoor" position. To clarify, Buttarelli is of the opinion that “privacy versus security” is in practice a contradiction in terms. In short, his view is that cybersecurity measures and provisions should never be availed of to weaken, or abuse, the data protection rights of the individual. The EDPS position is loud and clear: New rules are needed that allow users to use end-to-end encryption, without compromise, to protect their electronic communications. Decryption, reverse engineering or monitoring of communications protected by encryption should be prohibited. Buttarelli is calling for the new legal framework to extend beyond its current scope to reflect the societal and technological evolutions taking place today to ensure that individuals be afforded the same level of protection for all functionally equivalent services, irrespective of whether they are provided — for example — by traditional telephone companies, VoIP services, or via mobile phone messaging apps. 

“No communications should be subject to unlawful tracking and monitoring without freely given consent, whether by cookies, device-fingerprinting or other technological means," Buttarelli said.

The EDPS position is courageous, and goes somewhat against the grain of the more mediatized political commentary we have heard coming from countries such as the U.S., U.K., France and Brazil; particularly with regard to national security issues. His comments will most likely be received with mixed reaction, although you can imagine that security providers and technology providers such as Apple will be encouraged by the EDPS’ opinion, at least in part.