On October 19, 2018, senior officials from the United States government, the European Commission (the “Commission”), and European data protection authorities met in Brussels for the second annual review of the EU-U.S. Privacy Shield framework (the “Shield”). Over two days, the officials discussed such important matters as the oversight and enforcement of the Shield and the collection of personal data by U.S. authorities for purposes of law enforcement or national security.
The Shield is designed to safeguard the rights of EU citizens whose personal data is transferred to the United States for commercial purposes by introducing additional protections such as requiring U.S. authorities to cooperate with European data protection authorities and providing mechanisms for redress to EU citizens whose data has been misused. The Commission, by way of an adequacy decision, has deemed that EU-to-U.S. data transfers handled in line with the Shield’s requirements comply with EU data protection laws. Joining the Shield is voluntary, but once a company has self-certified to the International Trade Administration within the U.S. Department of Commerce and publicly declared that it complies with the Shield’s requirements, the commitment is enforceable under U.S. law. Since the Shield came into effect on 1 August 2016, nearly 4,000 U.S. companies have self-certified.
The Shield is subject to an annual joint review by EU and U.S. officials to monitor its application and ensure that it remains effective. The first review identified a number of issues and, in December 2017, the Article 29 Working Party (which has since been replaced by the European Data Protection Board) gave the U.S. government until 25 May 2018 to address its “prioritized concerns.” In particular, the Working Party stated that the U.S. should appoint members to the U.S. Privacy and Civil Liberties Oversight Board (“PCLOB”) and an independent ombudsperson to review complaints from EU citizens.
Even though the U.S. has now taken corrective action in respect of the key concerns – the U.S. Senate confirmed three members, Adam Klein, Edward Felten, and Jane Nitze to the PCLOB on 11 October 2018, and on 28 September 2018, the U.S. State Department named Manisha Singh as the Privacy Shield Ombudsperson – the future of the Shield is far from certain. On 12 June 2018, the Civil Liberties, Justice and Home Affairs Committee of the European Parliament passed a Resolution recommending that the Commission suspend the Shield on the basis that it failed to provide enough protection. The Commission stated that the lack of sufficient oversight and supervision after self-certification risked leading to enforcement gaps, and called on the Commission to ensure that the Shield is compliant with the EU General Data Protection Regulation (“GDPR”) and that U.S. companies are not able to gain an unfair competitive advantage in this regard from the application of the Shield.
Further, following the introduction of the GDPR earlier this year, the EU seeks additional concessions from the U.S. concerning the collection, storage, and use of EU citizens’ personal data by U.S. government agencies and companies, and there are outstanding issues with respect to standard contractual clauses (“SCCs”). In April, the Irish High Court referred questions to the European Court of Justice for determination regarding the relevance of the Shield in assessing the adequacy of U.S. privacy safeguards related to SCCs, and whether the provision of the Shield ombudsperson and existing U.S. law ensure a remedy for EU citizens that is compatible with Article 47 of the Charter of Fundamental Rights of the European Union. A report of the second annual review is to be published before the end of the year.
