The Article 29 Working Party group (WP29) of European data protection authorities recently announced that they will legally challenge the adequacy of the Privacy Shield Framework unless the U.S. government addresses certain “prioritized concerns” by May 25, 2018. Privacy Shield provides a framework which helps over 2500+ participating U.S. companies legally transfer EU personal data to the United States.

The WP29 announcement follows a report and press release from the European Commission in October which stated that “the Privacy shield continues to ensure an adequate level of protection.” Although the Commission report identified numerous “recommendations to further improve the functioning of the Privacy Shield,” it did not threaten withdrawal from the Framework over these recommendations. The WP29 announcement thus raises the stakes for the future of Privacy Shield by threatening to undermine the legal adequacy of the Framework itself with a legal challenge.

The WP29 “prioritized concerns” behind its challenge to the Framework include:

(1) Appointment of an independent Ombudsperson. As part of the original Privacy Shield Framework, the U.S. Department of State committed to establish an “Ombudsperson” to respond to inquiries from EU data protection authorities on behalf of EU individuals regarding US signals intelligence. This position has not been filled.

(2) Appointment of PCLOB Members. U.S. federal law establishes a Privacy and Civil Liberties Oversight Board (PCLOB) with responsibility for reviewing national anti-terrorism policy and procedures to ensure the protection of civil liberties. As part of the Privacy Shield Framework negotiations, the U.S. highlighted the existence of the board as part of its assurances to EU regulators regarding U.S. concern for privacy and civil liberties. Currently, however, the PCLOB has only one board member, leaving most board positions unfilled.

The WP29 states that, unless these points are resolved by May 25, 2018, “the members of WP29 will take appropriate action,” including challenging Privacy Shield before national courts and the Court of Justice of the European Union.