As was generally expected from informal comments by EU representatives, Privacy Shield has survived its first annual review.  Commissioner Jourova stated: “Our first review shows that the Privacy Shield works well, but there is some room for improving its implementation.”  Specifically, the Commission highlighted the following in the press release today in which it announced its conclusions:

• More proactive and regular monitoring of companies’ compliance with their Privacy Shield obligations by the U.S. Department of Commerce. The U.S. Department of Commerce should also conduct regular searches for companies making false claims about their participation in the Privacy Shield.

• More awareness-raising for EU individuals about how to exercise their rights under the Privacy Shield, notably on how to lodge complaints.

• Closer cooperation between privacy enforcers i.e. the U.S. Department of Commerce, the Federal Trade Commission, and the EU Data Protection Authorities (DPAs), notably to develop guidance for companies and enforcers.

• Enshrining the protection for non-Americans offered by Presidential Policy Directive 28 (PPD-28), as part of the ongoing debate in the U.S. on the reauthorisation and reform of Section 702 of the Foreign Intelligence Surveillance Act (FISA).

• To appoint as soon as possible a permanent Privacy Shield Ombudsperson, as well as ensuring the empty posts are filled on the Privacy and Civil Liberties Oversight Board (PCLOB).

It’s worth noting the recommendation regarding enshrining the protections for non-Americans under Presidential Policy Directive 28 in the reauthorization of Section 702 — while President Trump has not withdrawn PPD-28, it’s not a given that protection for foreigners will be built into FISA.

The full report is available here.