Privacy regulators: Commission ‘could do better’ on Privacy Shield

Whether the Commission will try remains to be seen

The Privacy Shield trans-Atlantic data transfer arrangement is better than its predecessor, Safe Harbor, but still not good enough, European Union data protection authorities said Wednesday.

They want the European Commission improve the deal it has negotiated with U.S. authorities to ensure that EU citizens' personal information receives privacy protection equivalent to that of EU law when it is exported to the U.S.

The authorities have been examining Privacy Shield since it was unveiled in February, and announced the results of their study Wednesday.

The deal is too complex, they say, as it is composed of a collection of legal instruments, letters and annexes rather than a single, easily understandable document.

Furthermore, the measures it proposes are themselves too complex. For example, the avenues available for addressing complaints are too numerous, making it "difficult for the end user to find the right interlocutor," said Isabelle Falque-Pierrotin, chairwoman of the Article 29 Working Party, an umbrella organization for European DPAs.

As it stands, Privacy Shield fails to adequately reflect key data protection principles, Falque-Pierrotin said at a news conference in Brussels. Further, it contains no revision mechanism to cope with the wholesale change in European privacy law that is expected to happen in 2018 with the introduction of the General Data Protection Regulation. A draft of this text will go before the European Parliament for vote later this week.

The members of the Article 29 Working Party made clear that they will withhold their support for Privacy Shield until the Commission has addressed their concerns.

The Commission may not care: The Working Party's role is purely advisory, and it cannot enforce its will on the Commission.

However, its members could ask the Court of Justice of the EU to rule on Privacy Shield's legality.

The new data transfer arrangement became necessary last October, when the court ruled the legal protections of its predecessor, Safe Harbor, inadequate under EU law. That case, pitting Austrian citizen Max Schrems against the Irish Data Protection Commissioner, had been referred to it by the High Court of Ireland.

Schrems was quick to react to the DPAs' verdict on Privacy Shield.

“I personally doubt that the European Commission will change its plans much. There will be some political wording, but I think they will still push it through," he said via email.

But he was optimistic about the prospects of a legal challenge in the light of the DPAs' negative opinion, he said.

Lobby group the Computer & Communications Industry Association focused on the good news, hailing Falque-Pierrotin's remark that Privacy Shield was "a major improvement," and glossing over the DPAs' request for clarifications.

While the DPAs' doubts about Privacy Shield's legal robustness are bad news for businesses reliant on trans-Atlantic data transfers, there was some good news: Falque-Pierrotin said the working party will not publish its views on the legality of other mechanisms for data transfer until the fate of Privacy Shield is finalized.

It has been conducting a study of those mechanisms, binding corporate rules and model contract clauses, since the CJEU overturned the Safe Harbor Agreement in October, but has yet to publish its findings.

That's important, because if the working party were to torpedo all the data transfer mechanisms allowed under the EU's 1995 Data Protection Directive, there would be no legal way for businesses to transfer personal information from the EU to the U.S. That would pose serious problems for multinational businesses or service providers processing payroll for Europeans in the U.S., and could threaten operations for companies such as Google or Facebook, which would have to split their networks into European and non-European segments.

Many companies have switched to the alternative legal mechanisms, and their continued validity is essential if data is to continue to flow across the Atlantic, according to another industry lobby group, DigitalEurope. 

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags Safe HarborPrivacy Shield

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Peter Sayer

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?