EU-US Privacy Shield second review: “it’s mostly fine” says the Commission, “not really” replies the EU Data Protection Board

No. 2, 28 Jan 2019 Issue

On December 19, the EU Commission released its report on the second review of the EU-US Privacy Shield arrangement, the mechanism that allows for the transfer of data between the EU and the US. Overall, the Commission fins that the US authorities has taken steps to improve the functioning of the framework. Several groups who contributed to the review, including Access Now, have however called for the suspension of arrangement, pointing to significant structural issues with the deal. In its submission to the EU Commission, Access Now highlighted that “in 2018, the situation for the Privacy Shield has only deteriorated. In the past year we have seen serious expansions in US surveillance law. Additionally, prominent controversies like the use of Facebook-held data by Cambridge Analytica underscore the limitations of the US Federal Trade Commission (FTC) as a data protection authority”.

On January 24, the EU Data Protection Board gathering all EU data protection authorities announced that due to substantial shortcomings, the EU-US Privacy Shield risk could be struck down by the European Court of Justice later this year. The EDPB has released a full report on the review of the Privacy Shield and said in a statement that the mechanism still fell behind on “a list of remaining issues raised after the first joint review” conducted last year.

Despite it support for the deal, the EU Commission did acknowledge some issue and announced that they expect the US authorities to nominate a permanent Ombudsperson by 28 February 2019 to replace the one that is currently acting. Since the creation of this new figure theoretically in charge of helping with the enforcement and compliance with the deal in the US, the position has remained vacant. In a letter, the Commission indicated that it “will then consider taking appropriate measures, in accordance with the General Data Protection Regulation” which includes the possibility to suspend the transfer of data from the EU to the US. Meanwhile in the US, the Trump Administration has announced mid-January plans to nominate tech businessman Keith Krach a permanent Ombudsperson. In the middle of the current government shutdown, the US Senate is expected to confirm this nomination in the next few days.

Read the EU Commission report here.

Read the EU Data Protection Board statement here.

Here is Keith Krach Wikipedia page.


Provided by Access Now