Tuesday

25th Sep 2018

Watchdogs concerned by EU-US data pact

  • Over 2,400 US companies that process data have signed up to the Privacy Shield system (Photo: Rami Al-zayat)

The United States needs to appoint an independent ombudsperson who can deal with data complaints by EU citizens before 25 May 2018, the EU's data protection authorities said in a report published on Tuesday (5 December).

If it does not, the authorities said they would "take appropriate action", including going to court.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 18 year's of archives. 30 days free trial.

... or join as a group

The data watchdogs are known collectively as the Article 29 Data Protection Working Party (WP29), named after the relevant article in the EU's data protection directive.

In their report, they took aim at the EU-US 'Privacy Shield', a scheme put in place last year after a previous data-exchange pact, 'Safe Harbour', was annulled by the Court of Justice of the EU (CJEU).

The self-certification system governs the use of data of European citizens by US companies like Google and Facebook.

"The WP29 acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbour Decision," the report said, which was the advisory body's first annual review of the scheme.

"However, the WP29 has identified a number of significant concerns that need to be addressed by both the commission and the US authorities," it added.

The WP29 called on the European Commission and the US authorities "to restart discussions" and to "immediately" set up an "action plan" that will address the WP29's concerns.

Although Privacy Shield was agreed already in mid-2016, the US has still not appointed an independent ombudsperson to deal with complaints from EU citizens – it still has a temporary one.

It also had questions about the legal powers of the ombudsperson, who would not be able to bring a case to court.

Moreover, the US would only "partially" reveal information about the relation between the ombudsperson and the intelligence community.

The original data-exchange pact, Safe Harbour, was annulled by the EU's highest court after revelations of mass snooping by US intelligence agencies of EU citizens.

The report said that "as long as the applicable procedures will remain classified and will not be shared, the WP29 will not be in a position to assess whether the ombudsperson is vested with sufficient powers to access information and to remedy non-compliance".

Oversight

The WP29 also said that the system, which is based on self-certification, "still lacks sufficient oversight and supervision of compliance in practice" by the US.

It expressed concern that a US oversight body, the Privacy and Civil Liberties Oversight Board, still had vacancies.

The report also criticised that the website about Privacy Shield was mainly targeted towards companies that need to comply with the rules, rather than to EU citizens that want to know about their rights.

It said that "the US authorities should strive to offer more information in an accessible and easily understandable form to the individuals regarding their rights and available recourses and remedies".

The WP29 is also worried about a difference of interpretation between the EU and US on what constituted "HR data", which under the scheme should benefit from extra safeguards.

It said that the US side saw HR data only as data of employees within the same company, while the WP29 saw HR data as "as any personal data concerning an employee in the context of an employer-employee relationship".

The report came after eight representatives from EU data protection authorities went on a fact-finding mission to the US in September.

Commission: system functioning correctly

The eight accompanied the commission, which in October already produced its own review of Privacy Shield.

Although the commission also noted that "the practical implementation of the Privacy Shield framework can be further improved", the general tone of its seven-page report was positive.

"The annual review has demonstrated that the U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield," the commission report said.

According to the EU executive, "the United States continues to ensure an adequate level of protection for personal data transferred under the Privacy Shield from the Union to organisations in the United States".

The commission also called on the US to replace the acting ombudsperson with a permanent one "as soon as possible", without giving a deadline.

Act, or face legal action

By contrast, the WP29 said that the appointment of the ombudsperson and the oversight board members needed to be resolved by 25 May 2018.

Other pending concerns should be "addressed" at the latest during the second annual review, which can be expected in the autumn of 2018.

If the US doesn't comply, the data protection authorities threaten to go to court, which could ultimately lead Privacy Shield to the same fate as its predecessor: annulment.

"In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling," it said.

US tests EU patience over Privacy Shield

The data sharing pact with the US is yet to be fully implemented, as the Americans have failed to appoint people in key positions to ensure EU citizens' personal data is protected.

Focus

EU takes step towards free flow of data

Non-personal data should be allowed to cross EU borders without restrictions, with an exemption for security reasons, diplomats meeting in the Council of the EU have agreed.

News in Brief

  1. ECB's Draghi set to clarify role in secretive G30 group
  2. Half of EU states at risk of missing recycling target
  3. Commission refers Poland to EU top court over rule of law
  4. Open Society Foundation takes Hungary to court
  5. EU court asked to rule on halting Brexit
  6. EU threatens Switzerland on stock trading
  7. Italy's new basic wage restricted to Italians
  8. UK tycoon offers to create pro-Brexit party

Opinion

Building a Europe more resilient to terrorism

One year to the day since the terror attacks in Barcelona and Cambrils, the commissioner for home affairs spells out what action the EU is taking now to protect against further attacks.

Stakeholders' Highlights

  1. NORDIC COUNCIL OF MINISTERSThe vital bioeconomy. New issue of “Sustainable Growth the Nordic Way” out now
  2. NORDIC COUNCIL OF MINISTERSThe Nordic gender effect goes international
  3. NORDIC COUNCIL OF MINISTERSPaula Lehtomaki from Finland elected as the Council's first female Secretary General
  4. NORDIC COUNCIL OF MINISTERSNordic design sets the stage at COP24, running a competition for sustainable chairs.
  5. Counter BalanceIn Kenya, a motorway funded by the European Investment Bank runs over roadside dwellers
  6. ACCACompany Law Package: Making the Best of Digital and Cross Border Mobility,
  7. IPHRCivil Society Worried About Shortcomings in EU-Kyrgyzstan Human Rights Dialogue
  8. UNESDAThe European Soft Drinks Industry Supports over 1.7 Million Jobs
  9. Mission of China to the EUJointly Building Belt and Road Initiative Leads to a Better Future for All
  10. IPHRCivil society asks PACE to appoint Rapporteur to probe issue of political prisoners in Azerbaijan
  11. ACCASocial Mobility – How Can We Increase Opportunities Through Training and Education?
  12. Nordic Council of MinistersEnergy Solutions for a Greener Tomorrow

Latest News

  1. Missing signature gaffe for Azerbaijan gas pipeline
  2. Every major city in Europe is getting warmer
  3. No chance of meeting EU renewable goals if infrastructure neglected
  4. Brexit and MEPs expenses in the spotlight This WEEK
  5. Wake-up call on European Day Against Islamophobia
  6. Sound of discord at 'Sound of Music' Salzburg summit
  7. Salzburg summit presses for bigger Frontex mandate
  8. UK's post-Brexit plan 'will not work', EU says

Stakeholders' Highlights

  1. UNICEFWhat Kind of Europe Do Children Want? Unicef & Eurochild Launch Survey on the Europe Kids Want
  2. Nordic Council of MinistersNordic Countries Take a Stand for Climate-Smart Energy Solutions
  3. Mission of China to the EUChina: Work Together for a Better Globalisation
  4. Nordic Council of MinistersNordics Could Be First Carbon-Negative Region in World
  5. European Federation of Allergy and AirwaysLife Is Possible for Patients with Severe Asthma
  6. PKEE - Polish Energy AssociationCommon-Sense Approach Needed for EU Energy Reform
  7. Nordic Council of MinistersNordic Region to Lead in Developing and Rolling Out 5G Network
  8. Mission of China to the EUChina-EU Economic and Trade Relations Enjoy a Bright Future
  9. ACCAEmpowering Businesses to Engage with Sustainable Finance and the SDGs
  10. Nordic Council of MinistersCooperation in Nordic Electricity Market Considered World Class Model
  11. FIFAGreen Stadiums at the 2018 Fifa World Cup
  12. Mission of China to the EUChina and EU Work Together to Promote Sustainable Development

Join EUobserver

Support quality EU news

Join us