The European Commission has today published its Report on the first annual review of the EU-U.S. Privacy Shield (the Report is accompanied with a Staff Working Document, Infographic, and Q&A).  The Commission concludes that Privacy Shield continues to ensure an adequate level of protection for personal data transferred from the EU to Privacy Shield-certified companies in the United States.  With its conclusion, the Commission also makes a number of recommendations to further improve the Privacy Shield framework.  The Report follows a joint press statement by the U.S. Secretary of Commerce and EU Commissioner Jourová on September 21, 2017, closing the review and reaffirming that the “United States and the European Union share an interest in the [Privacy Shield] Framework’s success and remain committed to continued collaboration to ensure it functions as intended.”

Background

The EU-U.S. Privacy Shield is a framework that effects the lawful transfer of personal data from the EEA to Privacy Shield-certified companies in the U.S.  The Privacy Shield framework was unveiled by the EU and United States on July 12, 2016 and the Privacy Shield framework became operational on August 1, 2016.  To date, there are over 2,400 in companies (including more than 100 EU-based companies) that have certified, with 400 applications under review.

The Privacy Shield provides an annual review and evaluation procedure intended to regularly verify that the findings of the Commission’s adequacy decision are still factually and legally justified.  Under the Privacy Shield, an “Annual Joint Review” is conducted by the U.S. Department of Commerce and the European Commission, with participation by the FTC, EU data protection authorities and representatives of the Article 29 Working Party, and “other departments and agencies involved in the implementation of the Privacy Shield,” including the U.S. Intelligence Community and the Privacy Shield Ombudsperson for matters pertaining to national security.  In preparation for the Review, the Commission also sought feedback from a number of trade associations, NGOs, and certified companies.  (See our earlier posts on the purpose of the first annual review here and here.)

Commission findings

Having reviewed all aspects of the Privacy Shield — with a specific focus on U.S. legal developments — the Commission concludes that the Privacy Shield continues to ensure an adequate level of protection for the personal data transferred from the EU to participating companies.  The Report finds that:

“U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield, such as new redress possibilities for EU individuals. Complaint-handling and enforcement procedures have been set up, and cooperation with the European Data protection authorities has been stepped up.  The certification process is functioning well – over 2,400 companies have now been certified by the U.S. Department of Commerce. As regards access to personal data by U.S. public authorities for national security purposes, relevant safeguards on the U.S. side remain in place.”

Notwithstanding the continued adequacy of the Privacy Shield, the Commission makes a number of recommendations that could further improve the functioning of the Privacy Shield.  These recommendations — which do not call into question the Commission’s assessment of the Privacy Shield as it currently stands — include:

• More proactive and regular monitoring of companies’ compliance with their Privacy Shield obligations by the U.S. Department of Commerce, including regular searches for companies falsely claiming they are certified to the Privacy Shield.

• Increasing awareness among EU individuals about how to exercise their rights and lodge complaints under the Privacy Shield.

• Greater cooperation between the relevant EU and U.S. regulators.  Increased cooperation between the U.S. Department of Commerce, the Federal Trade Commission, and EU data protection authorities could lead to more convergence in interpretation, clear and more joined-up guidance, and greater legal certainty.  The Commission highlights a number of issues that could benefit from more clarity, including accountability for onward transfers, the definition of human resources data, and the relevance of automated decision-making.

• Enshrining existing U.S. protections for EU citizens into law.  The Commission views the debate in the United States on the reform of Section 702 of the Foreign Intelligence Surveillance Act as an opportunity to further strengthen the privacy protections afforded to EU citizens by enshrining the protections offered by Presidential Policy Directive 28 into law.

• Appointment of a permanent Privacy Shield Ombudsperson (there is currently an acting Ombudsperson) to enhance the redress and complaints procedure, and the appointment of more members to the United States Privacy and Civil Liberties Oversight Board, which is an independent agency within the executive tasked with analyzing the protection of privacy in the context of U.S. counterterrorism policies and activities.

Next steps

The Report will now be reviewed by the European Parliament, the Council, the Article 29 Working Party (composed of European Member State data protection authorities and the European Data Protection Supervisor) and to the U.S. authorities.  The Commission will work with its U.S. counterparts on the follow-up of its recommendations.