‘Concerns’ remain about personal data transfers to US

EU data protection commissioners have asked the European Commission to produce all documents relating to the new EU-US data transfer arrangement – known as the EU-US Privacy Shield – by the end of February, indicating they still have "concerns" about the protection of citizens' privacy.

The independent Article 29 working party (WP29), comprised of a representative of every data protection authority in the EU, was responding to the European Commission’s announcement of a proposed new mechanism to legitimise personal data transfers to the US, replacing the dead Safe Harbour arrangement.

The commission said on Monday that it would look to the new EU-US Privacy Shield arrangement to make transfers of personal data to the US legal. However, it has yet to fully sign off on that proposal.

Safe Harbour was struck down last October by the Court of Justice of the European Union, essentially as it was not capable of ensuring adequate protection for EU citizen data due to the level of mass surveillance by US national security authorities.

Conclusion

Speaking in Brussels after a meeting of the WP29 group, chair Isabelle Falque-Pierrotin welcomed the conclusion of the negotiations.

However, she said the group still wanted to receive the relevant documents from the commission to assess whether it was legally binding and whether it could address the wider concerns raised by the Schrems judgment. It still had “concerns” about the current US legal framework.

Ms Falque-Pierrotin noted that since Schrems, transfers of data to the US may not take place on the basis of the invalidated Safe Harbour decision.

“EU data protection authorities will therefore deal with related cases and complaints on a case-by-case basis.”

Documents

The working party called on the commission to communicate “all documents pertaining to the new arrangement by the end of February”.

After that date, the WP29 will consider whether transfer mechanisms, such as standard contractual clauses and binding corporate rules, can still be used for personal data transfers to the US. In the meantime, the working party still considered such mechanisms to be valid.

Data protection consultant Daragh O'Brien of Irish firm Castlebridge Associates said the lack of any documentary evidence for the privacy shield deal, and its "questionable legal status", was clearly a problem for the A29 working party. Safe Harbour remained dead and there was "every chance" the working party would have no option but to suspend all data transfers to the US once that review was concluded, he said.

Austrian campaigner Max Schrems, whose case against the Irish Data Protection Commissioner over its refusal to investigate Facebook's US data transfers was referred to the Court of Justice, said he may challenge the arrangement depending on its final text.