Enter to open, tab to navigate, enter to select
Article 29 Working Party publishes statement on EU-US Privacy Shield
Practical Law UK Legal Update 3-631-5605 (Approx. 4 pages)
Article 29 Working Party publishes statement on EU-US Privacy Shield
by Practical Law Data Protection
| Published on 27 Jul 2016 • European Union, USA (National/Federal) |
The Article 29 Working Party has published a statement welcoming the adoption of the EU-US Privacy Shield, but notes that some of its concerns raised in its Opinion (WP238) still remain.
The Article 29 Working Party (WP29) has issued a statement welcoming the improvements brought by the EU-US Privacy Shield for transfers of personal data for commercial purposes to the US, compared to the Safe Harbour. The WP29 commends the EU Commission's College of Commissioners and the US authorities for taking account of its concerns, but notes that some concerns raised in its Opinion (WP238) still remain, regarding commercial aspects and US public authorities' access to personal data transferred from the EU (see Legal update, Article 29 Working Party publishes opinion on EU-US Privacy Shield).
The WP29 regrets, for example, the lack of specific rules on automated decisions and of a general right to object and it is still unclear how the Privacy Shield will apply to data processors. The WP29 expected stricter guarantees on the independence and the powers of the Ombudsperson in relation to access by public authorities to personal data transferred to the US under the Privacy Shield. The WP29 also notes the Office of the Director of National Intelligence's commitment not to conduct mass and indiscriminate collection of EU citizens' data but regrets a lack of concrete assurances. The WP29 therefore anticipates that the first joint annual review will be key to assessing the robustness and efficiency of the Privacy Shield, the outcome of which may also impact on Binding Corporate Rules and Standard Contractual Clauses. The WP29 will soon provide information to data controllers about their obligations under the Shield, comments on the citizens' guide, suggestions for the composition of an EU centralised body and the organisation of the joint review.
On 12 July 2016, the EU Commission's College of Commissioners adopted the EU-US Privacy Shield adequacy decision (see Legal update, European Commission adopts EU-US Privacy Shield adequacy decision). For more information see Practice note, Cross-border transfers of personal data.