European Data Protection Officers On Privacy Shield Announcement: Please Send Text!

A day after the European Commission announced an agreement with US authorities for a “Privacy Shield” as a follow-up mechanism for the invalidated Safe Harbour Agreement, the Article 29 Working Party of European Union data protection officers said they need to see the written text before making their final assessment.

The announcement of the agreement is here. The statement of the Article 29 Working Party is here [pdf].

Speaking at a press conference in Brussels after the first part of the Article 29 Working Party (WP) meeting this week, the current chairperson, Isabelle Falque-Pierrotin, who is the chair of the French Data Protection Agency CNIL, said EU Commissioner Vera Jourova had committed to send the text of the Privacy Shield mechanism by the end of February.

Only then will the Article 29 WP be able to analyse the new agreement to see if it meets the conditions set out by the European Court of Justice in their ruling against the Safe Harbour Agreement, she said.

The agreement allowed the easy transfer of EU citizens’ personal data between the EU and the US for 15 years, as long as companies joined the Safe Harbour list managed by the US Federal Trade Commission.

With the annulment of the agreement by the ECJ, companies have to rely on alternative measures like data protection provisions in their binding corporate rules (BCR) or in standard contractual clauses (SCC).

The Article 29 WP would have announced today that they still have concerns with regard to transfers based on the BCRs and SCCs, after an in-depth analysis of the legal status quo with regard to access to the transferred data by US intelligence services.

Especially with regard to the scope of access and the lack of remedies, concerns remain despite recent reforms in the US, said Falque-Pierrotin. The Judicial Redress Bill, still to be adopted in the US, would not address the concerns as it does not cover access by the intelligence services.

With Jourovas’s announcement of the Privacy Shield yesterday, European data protection officials now want to wait and see if the negotiated provisions will address their concerns.

For the time being companies still can rely on the alternative mechanisms to transfers of data, Falque-Pierrotin said. Relying on Safe Harbour would be illegal, though.

A final decision could come at an extraordinary plenary meeting of the Article 29 WP in March.