Privacy & Information Security Law Blog

On May 30, 2016, the European Data Protection Supervisor (“EDPS”) released its Opinion (the “Opinion”) on the EU-U.S. Privacy Shield (the “Privacy Shield”) draft adequacy decision. The Privacy Shield was created to replace the previous Safe Harbor framework invalidated by the Court of Justice of the European Union (“CJEU”) in the Schrems decision.

Similar to the conclusion drawn from the Article 29 Working Party’s Opinion and the Resolution of the European Parliament, the Opinion recognizes the value of the Privacy Shield but calls for robust improvements in order to achieve a solid and stable legal framework for commercial transfers of data between the EU and the U.S. According to the EDPS, the draft adequacy decision, as currently formulated, does not adequately include all appropriate safeguards to protect the European rights of individuals to privacy and data protection.

In this respect, the Opinion provides three main recommendations:

• Integrating all main data protection principles. According to the EDPS, the current adequacy decision omits substantive details of some of the main data protection principles. Therefore, efforts should be made to clarify these principles, in particular, the data retention, automated processing and purpose limitation principles. Further, provisions related to onward transfers, the right of access and the right to object should be clarified.
• Limiting derogations. According to the draft adequacy decision and its annexes, the Privacy Shield principles can be limited, where necessary, to meet national security, law enforcement or public interest requirements, or in case of conflict with a statute, regulation or case law. In its Opinion, the EDPS recommends more detail regarding the exceptions to the Privacy Shield.
• Improving redress and oversight mechanisms. The EDPS recommends to further develop the role of the Ombudsperson to ensure that he or she is able to act independently from the intelligence community and any other authority. In addition, the EDPS calls for more specific commitments that the request for information and cooperation, decisions and recommendations of the Ombudsperson will be effectively respected and implemented by all competent agencies and bodies. In addition, efforts should be made to increase cooperation between the different oversight layers.

The Opinion also provides additional recommendations on different aspects of the EU-U.S. Privacy Shield, including:

• Provisions on transfers of data for commercial purposes. The EDPS recommends (1) integrating the data minimization and data retention principles in the draft adequacy decision, (2) adding safeguards for the legitimate interests of individuals where they are subject to a decision based solely on automated processing, (3) clarifying the purpose limitation principle, in particular, with respect to the use of personal data for marketing purposes, (4) limiting exceptions to the Privacy Shield principles, and (5) improving redress and oversight mechanisms.
• Recommendations regarding access by U.S. authorities. According to the EDPS, additional safeguards should be implemented for independent supervision and redress, in particular where personal data is collected or accessed for law enforcement and other public interest purposes.
• Assessing the impact of other relevant statutes and rules. According to the EDPS, the rules set forth by the draft adequacy decision should be assessed in light of the exceptions from the application of the Privacy Shield principles and other rules that may interfere with these principles.
• A meaningful review. The EDPS recommends that the review of the application of the Privacy Shield includes on-the-spot verifications and covers access by U.S. authorities to the data transferred under the Privacy Shield.
• Interaction with the GDPR. The EDPS notes that the draft adequacy decision is based on the current EU data protection legal framework, rather than the General Data Protection Regulation (“GDPR”), which will be implemented as of May 2018. Therefore, the EDPS urges the legislators to find an adequate, and long-term solution, taking into account new elements of the GDPR, such as the principles of privacy by design and data portability.

Read the EDPS’s press release.