EU-US Privacy Shield review finds room for improvement

(BRUSSELS) - The EU- U.S. Privacy Shield is doing a good job in protecting the personal EU personal data but there is some room for improving its implementation, the Commission says in its first annual review.

The Privacy Shield, an arrangement for protecting the personal data of anyone in the EU when it is transferred to the U.S. for commercial purposes, includes obligations for U.S. companies receiving personal data from the EU, as well as obligations for the U.S. government if they subsequently request access to this personal data for national security or law enforcement reasons.

"Transatlantic data transfers are essential for our economy," said the EU's Justice Commissioner Vera Jourova, "but the fundamental right to data protection must be ensured also when personal data leaves the EU."

The Privacy Shield was working well, she said, but its implementation could be improved: "The Privacy Shield is not a document lying in a drawer. It's a living arrangement that both the EU and U.S. must actively monitor to ensure we keep guard over our high data protection standards."

The Privacy Shield was launched in August 2016, with a commitment to an annual review to assess if it was ensuring adequate protection for personal data. It covers instances such as when a European customer is shopping online or using social media, personal data is collected by a branch or business partner of a participating American company, who then transfers it to the U.S. For example, a travel agent in the EU may send names, contact details and credit card numbers to a hotel in the U.S. which has registered to the Privacy Shield.

Overall the report shows that the Privacy Shield continues to ensure an adequate level of protection for the personal data transferred from the EU to participating companies in the U.S. It finds that the U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield, such as new redress possibilities for EU individuals. Complaint-handling and enforcement procedures have been set up, and cooperation with the European Data protection authorities has been stepped up. The certification process is functioning well - over 2,400 companies have now been certified by the U.S. Department of Commerce. As regards access to personal data by U.S. public authorities for national security purposes, relevant safeguards on the U.S. side remain in place.

Recommendations to further improve the functioning of the Privacy Shield

The report suggests a number of recommendations to ensure the continued successful functioning of the Privacy Shield. These include:

• More proactive and regular monitoring of companies' compliance with their Privacy Shield obligations by the U.S. Department of Commerce. The U.S. Department of Commerce should also conduct regular searches for companies making false claims about their participation in the Privacy Shield.
• More awareness-raising for EU individuals about how to exercise their rights under the Privacy Shield, notably on how to lodge complaints.
• Closer cooperation between privacy enforcers i.e. the U.S. Department of Commerce, the Federal Trade Commission, and the EU Data Protection Authorities (DPAs), notably to develop guidance for companies and enforcers.
• Enshrining the protection for non-Americans offered by Presidential Policy Directive 28 (PPD-28), as part of the ongoing debate in the U.S. on the reauthorisation and reform of Section 702 of the Foreign Intelligence Surveillance Act (FISA).
• To appoint as soon as possible a permanent Privacy Shield Ombudsperson, as well as ensuring the empty posts are filled on the Privacy and Civil Liberties Oversight Board (PCLOB).

The report will now be sent to the European Parliament, the Council, the Article 29 Working Party of Data Protection Authorities and to the U.S. authorities. The Commission says it will work with the U.S. authorities on the follow-up of its recommendations in the coming months.

Annual Review of the EU-U.S. Privacy 
Shield - background guide

Report and Staff Working Document on the annual review of the functioning of the EU–U.S. Privacy Shield