EU-US privacy shield review finds room for improvement

(BRUSSELS) - The U.S. is ensuring adequate protection for personal data transferred under the 'Privacy Shield' from the EU to participating companies in the States, says the EU's third review, but there is room for improvement.

The European Commission's report on the third annual review of the functioning of the EU-U.S. Privacy Shield finds that since the second annual review, there have been a number of improvements in the functioning of the framework, as well as appointments to key oversight and redress bodies, such as the Privacy Shield Ombudsperson.

The EU-U.S. Privacy Shield decision was adopted in July 2016 with the Privacy Shield framework becoming operational on 1 August 2016. It protects the fundamental rights of anyone in the EU whose personal data is transferred to certified companies in the United States for commercial purposes and brings legal clarity for businesses relying on transatlantic data transfers.

In the third year of the Shield's operation, the review focuses on the lessons learnt from its practical implementation and day-to-day functionality. There are currently about 5,000 companies participating in this EU-U.S. data protection framework.

"The annual review is an important health check for its functioning," said the Justice Commissioner Vera Jourova: "We will continue the digital diplomacy dialogue with our U.S. counterparts to make the Shield stronger, including when it comes to oversight, enforcement and, in a longer-term, to increase convergence of our systems."

Among the improvements, the third review notes that the U.S. Department of Commerce is ensuring the necessary oversight in a more systematic manner by, for example, carrying out monthly checks of a sample of companies to verify compliance with Privacy Shield principles.

The review finds that enforcement action has improved with the Federal Trade Commission taking enforcement action related to the Privacy Shield in seven cases.

An increasing number of EU individuals are also making use of their rights under the Privacy Shield and the relevant redress mechanisms are functioning well.

In addition to the appointment of the permanent Ombudsperson, the final two vacancies on the Privacy and Civil Liberties Oversight Board have been filled, ensuring that it is fully-staffed for the first time since 2016.

The Commission does however recommend that certain concrete steps be taken to better ensure the effective functioning of the Privacy Shield in practice.

This includes further strengthening the (re)certification process for companies who want to participate by shortening the time of the (re)certification process; expanding compliance checks, including concerning false claims of participation in the framework; and developing additional guidance for companies related to human resources data.

The Commission also expects the Federal Trade Commission to further step up its investigations into compliance with substantive requirements of the Privacy Shield and provide the Commission and the EU data protection authorities with information on ongoing investigations.

Report on the third annual review of the EU-U.S. Privacy Shield

EU-U.S. Joint Statement from the third annual review

EU-US Privacy Shield including Guide for Citizens

EU-U.S. Privacy Shield: background guide