The Commission will draw on all other sources of information available and will issue a public report to the European Parliament and the Council.
Advertisement
The European Union’s data protection laws are meant to ensure that we can entrust personal data to our devices and online services without fear of privacy violations.
Both Pritzker and Vera Jourova, the European Commissioner for Justice, said they are confident that the new deal will stand up to any court challenge.
It’s required because U.S. law doesn’t meet the data protection standard required for the commission to grant a blanket adequacy decision for all personal data transferred there.
Earlier this year Brussels’ officials, negotiating on behalf of the European Union, put forward Privacy Shield as Safe Harbour’s replacement.
“In short: new “Shield”, old problems”, Tomaso Falchetta, legal officer at Privacy International, said in an email on Tuesday. But many believe it comes loaded with the same fundamental weaknesses as Safe Harbour.
Schrems isn’t planning an immediate legal challenge to Privacy Shield, but suspects that there will be no lack of possible plaintiffs.
Věra Jourová, Commissioner for Justice, Consumers and Gender Equality said: “The EU-U.S. Privacy Shield is a robust new system to protect the personal data of Europeans and ensure legal certainty for businesses”. “I am not happy, I am not absolutely satisfied. It is in line with the Schrems judgment [the CJEU ruling]”.
U.S. Commerce Secretary Penny Pritzker, also present, made no reference to surveillance or bulk collection, preferring to focus on the positives. This is not about commercial interests.
Jourova also said that a new United States ombudsperson would be “functionally independent” and would “carry out her functions free from any undue influence that could affect the independence of her analysis”. Jourova replied that the ombudsperson will be required to reply to gripes: “No complaint will go unanswered”, she said. We need to restore trust with citizens. This expectation is enshrined in European Union law as “purpose limitation”.
He said Privacy Shield was based exclusively on “promises being exchanged”, and if the commissioner really wants to “test” the deal, she should include a sunset clause.
But there is already opposition to the new agreement. “Given the flawed premises – trying to fix data protection deficit in the United States by means of government’s assurances as opposed to meaningful legislative reform – it is not surprising that the new Privacy Shield remains full of holes and hence offers limited protection to personal data”, Falchetta added.
But some civil liberties groups are wary of Privacy Shield, questioning whether it will have any meaningful impact on consumer privacy.
Andrus Ansip, European Commission VP for the digital single market, said: “We have approved the new EU-US Privacy Shield today. It is a major privacy win for consumers and it provides legal clarity for thousands of European and US firms”, said Christian Borggreen, European director of Computer and Communications Industry Association, whose members include the likes of Amazon.com, Google and Microsoft. In its Safe Harbour ruling, the European Court of Justice strongly criticised mass-surveillance laws in the U.S., which have not changed in the meantime.
The EU-US Privacy Shield is seen as critical to facilitating the cross-border data flows that major tech companies and other industries rely upon to carry out trans-Atlantic business.
Under the new arrangement, the US Department of Commerce will conduct regular updates and reviews of participating companies, to ensure they follow the rules.
When the first draft of Privacy Shield was published in February, its vague provisions on mass surveillance were criticized from many quarters, including the Commission’s own advisors, leading to fears that it would only be a matter of time before the CJEU overturned it too.
Advertisement
Head of global privacy and cybersecurity practice at law firm Hunton & Williams Lisa Sotto called Privacy Shield “a win for global commerce”, while in the USA, the Information Technology Industry Council (ITI), a trade group representing more than 60 tech companies, also welcomed the deal.
