Privacy & Information Security Law Blog

On April 13, 2016, the Article 29 Working Party (the “Working Party”) published its Opinion on the EU-U.S. Privacy Shield (the “Privacy Shield”) draft adequacy decision. The Privacy Shield was created to replace the previous Safe Harbor framework invalidated by the Court of Justice of the European Union (“CJEU”) in the Schrems decision. The Working Party also published a Working Document on the justification for interferences with the fundamental rights to privacy and data protection through surveillance measures when transferring personal data (European Essential Guarantees).

Background

On October 16, 2015, the Working Party announced it would assess the consequences of the Schrems judgment with respect to all mechanisms permitting data transfers to the U.S. To this end, the Working Party inventoried and analyzed the jurisprudence of the CJEU related to Articles 7, 8 and 47 of the EU Charter of Fundamental Rights and the jurisprudence of the European Court of Human Rights related to Article 8 of the European Convention on Human Rights (“ECHR”) dealing with surveillance issues in states party to the ECHR. Following this assessment, the Working Party concluded that the requirements can be summarized in four European Essential Guarantees. The Working Document of the Working Party explains the background of the four European Essential Guarantees, and its Opinion on the Privacy Shield includes an assessment of these Guarantees for data transfers to the U.S.

In this respect, the Working Party recognized that the Privacy Shield is a significant improvement to the Safe Harbor framework and that many of the shortcomings of the Safe Harbor framework it had previously identified have been addressed by the Privacy Shield. However, the Working Party also stressed the overall complexity and lack of clarity regarding the new framework and expressed concerns with respect to both the commercial and national security aspects of the Privacy Shield.

Commercial Aspect of the Privacy Shield

With respect to the commercial aspects for data transfers from the European Union to the U.S., the Working Party has serious concerns regarding whether the Privacy Shield can ensure a level of protection that is essentially equivalent to that in the EU. In particular, the Working Party stated that the commercial part of the Privacy Shield requires further clarification on many points, including:

Data Retention
According to the Working Party’s Opinion, there is no express data retention principle mentioned in the Privacy Shield and a data retention principle cannot be clearly construed from the current wording of the Data Integrity and Purpose Limitation principle. This may give organizations the option to keep personal data as long as they wish, even after leaving the Privacy Shield, which is not in line with the EU data retention limitation principle.

Purpose Limitation
The Working Party noted that the scope of the purpose limitation concept is different under the (1) Notice, (2) Choice, and (3) Data Integrity and Purpose Limitation principles of the Privacy Shield and that there is some inconsistency among the terminology used in the three principles. According to the Working Party, it should be made clear that an organization cannot be authorized to process personal data for a purpose materially different (from the original purpose of processing) if the additional purpose is incompatible according to the Data Integrity and Purpose Limitation Principle.

Onward Data Transfers
The Working Party emphasized “that onward transfers from a Privacy Shield entity to third country recipients should provide the same level of protection on all aspects of the Shield (including national security) and should not lead to lower or circumvent EU data protection principles. In case of an onward data transfer to a third country, every Privacy Shield organisation should have the obligation to assess any mandatory requirements of the third country’s national legislation applicable to the data importer, prior to the data transfer. If a risk of substantial adverse effect on the guarantees, obligations and level of protection provided by the Privacy Shield is identified, the U.S. Privacy Shield organisation acting as a Processor (Agent) shall promptly notify the EU data controller before carrying out any onward transfer.” In which case, the latter should be “entitled to suspend the transfer of data and/or terminate the contract.” If the Shield organization is acting as a data controller, it “should not be allowed to onward transfer the data, as this would compromise its duty to provide the same level of protection” as under the Privacy Shield.

In this respect, the Working Party “recalls its position that if the EU data controller is aware of an onward transfer to a third party outside the U.S. even before the transfer to the U.S. takes place, or if the EU data controller is jointly responsible for the decision to allow onward transfers, the transfer should be considered as a direct transfer from the EU to the third country outside the U.S.,” in which case the EU Data Protection Directive applies instead of the Privacy Shield onward transfer principle.

The Working Party “concludes that onward transfers of EU personal data are insufficiently framed, especially regarding their scope, the limitation of their purpose and the guarantees applying to transfers to data processors (Agents).”

EU Individuals’ Right of Redress
The Working Party has concerns that, in practice, the new redress mechanism may prove to be too complex and difficult to use for EU individuals. In order to ensure effectiveness, the Working Party recommended that the Privacy Shield allow for EU data protection authorities to represent EU individuals (the data subjects) and act on their behalf or to act as an intermediary. “Alternatively, [the Privacy Shield] should contain specific jurisdiction clauses entitling data subjects to exercise their rights in Europe.

Other concerns and requests for clarification relate to the processing of HR and pharmaceutical data and how the Privacy Shield Principles are to be applied to data processors (Agents).

National Security Guarantees of the Privacy Shield

The Working Party had the two following major concerns with respect to national security guarantees:

• Massive and indiscriminate collection of personal data originating from the EU is not fully excluded by the U.S. authorities.
• The establishment of the Ombudsman as a new redress mechanism is welcomed. However, the powers and position of the Ombudsperson have not been fully defined, and the Working Party “is concerned that this new institution is not sufficiently independent and is not vested with adequate powers to effectively exercise its duty and does not guarantee a satisfactory remedy in case of disagreement.”

Conclusion and Recommendations

In light of the concerns expressed by the Working Party and its requests for clarification, the Working Party urged the European Commission to resolve these concerns, identify appropriate solutions to improve its draft adequacy decision, and ensure the protection offered by the Privacy Shield is indeed essentially equivalent to that offered by European data protection laws. To that end, the Working Party recommends, in particular, (1) to introduce a glossary of terms in the Privacy Shield F.A.Q., with definitions agreed upon by the EU and the U.S., and (2) to review the Privacy Shield shortly after the EU General Data Protection Regulation (“GDPR”) becomes effective to ensure that the higher level of data protection brought by the GDPR is reflected in the Privacy Shield. Finally, with respect to the annual joint review of the Privacy Shield, the Working Party recommended that the modalities of those joint reviews be agreed in advance of the first review.

Next Steps

The Opinion of the Working Party is non-binding and the European Commission could still proceed to finalize the adequacy determination. In this respect, the European Commission still needs to consult a committee composed of representatives of the EU Member States before issuing its final decision. In the meantime, the Chairwoman of the Working Party confirmed that data transfers to the U.S. may still take place under the existing data transfer mechanisms, EU Model Clauses or Binding Corporate Rules.