Sunday

21st Apr 2019

Watchdogs concerned by EU-US data pact

  • Over 2,400 US companies that process data have signed up to the Privacy Shield system (Photo: Rami Al-zayat)

The United States needs to appoint an independent ombudsperson who can deal with data complaints by EU citizens before 25 May 2018, the EU's data protection authorities said in a report published on Tuesday (5 December).

If it does not, the authorities said they would "take appropriate action", including going to court.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 18 year's of archives. 30 days free trial.

... or join as a group

The data watchdogs are known collectively as the Article 29 Data Protection Working Party (WP29), named after the relevant article in the EU's data protection directive.

In their report, they took aim at the EU-US 'Privacy Shield', a scheme put in place last year after a previous data-exchange pact, 'Safe Harbour', was annulled by the Court of Justice of the EU (CJEU).

The self-certification system governs the use of data of European citizens by US companies like Google and Facebook.

"The WP29 acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbour Decision," the report said, which was the advisory body's first annual review of the scheme.

"However, the WP29 has identified a number of significant concerns that need to be addressed by both the commission and the US authorities," it added.

The WP29 called on the European Commission and the US authorities "to restart discussions" and to "immediately" set up an "action plan" that will address the WP29's concerns.

Although Privacy Shield was agreed already in mid-2016, the US has still not appointed an independent ombudsperson to deal with complaints from EU citizens – it still has a temporary one.

It also had questions about the legal powers of the ombudsperson, who would not be able to bring a case to court.

Moreover, the US would only "partially" reveal information about the relation between the ombudsperson and the intelligence community.

The original data-exchange pact, Safe Harbour, was annulled by the EU's highest court after revelations of mass snooping by US intelligence agencies of EU citizens.

The report said that "as long as the applicable procedures will remain classified and will not be shared, the WP29 will not be in a position to assess whether the ombudsperson is vested with sufficient powers to access information and to remedy non-compliance".

Oversight

The WP29 also said that the system, which is based on self-certification, "still lacks sufficient oversight and supervision of compliance in practice" by the US.

It expressed concern that a US oversight body, the Privacy and Civil Liberties Oversight Board, still had vacancies.

The report also criticised that the website about Privacy Shield was mainly targeted towards companies that need to comply with the rules, rather than to EU citizens that want to know about their rights.

It said that "the US authorities should strive to offer more information in an accessible and easily understandable form to the individuals regarding their rights and available recourses and remedies".

The WP29 is also worried about a difference of interpretation between the EU and US on what constituted "HR data", which under the scheme should benefit from extra safeguards.

It said that the US side saw HR data only as data of employees within the same company, while the WP29 saw HR data as "as any personal data concerning an employee in the context of an employer-employee relationship".

The report came after eight representatives from EU data protection authorities went on a fact-finding mission to the US in September.

Commission: system functioning correctly

The eight accompanied the commission, which in October already produced its own review of Privacy Shield.

Although the commission also noted that "the practical implementation of the Privacy Shield framework can be further improved", the general tone of its seven-page report was positive.

"The annual review has demonstrated that the U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield," the commission report said.

According to the EU executive, "the United States continues to ensure an adequate level of protection for personal data transferred under the Privacy Shield from the Union to organisations in the United States".

The commission also called on the US to replace the acting ombudsperson with a permanent one "as soon as possible", without giving a deadline.

Act, or face legal action

By contrast, the WP29 said that the appointment of the ombudsperson and the oversight board members needed to be resolved by 25 May 2018.

Other pending concerns should be "addressed" at the latest during the second annual review, which can be expected in the autumn of 2018.

If the US doesn't comply, the data protection authorities threaten to go to court, which could ultimately lead Privacy Shield to the same fate as its predecessor: annulment.

"In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling," it said.

US tests EU patience over Privacy Shield

The data sharing pact with the US is yet to be fully implemented, as the Americans have failed to appoint people in key positions to ensure EU citizens' personal data is protected.

Focus

EU takes step towards free flow of data

Non-personal data should be allowed to cross EU borders without restrictions, with an exemption for security reasons, diplomats meeting in the Council of the EU have agreed.

Stakeholders' Highlights

  1. Counter BalanceSign the petition to help reform the EU’s Bank
  2. UNICEFChild rights organisations encourage candidates for EU elections to become Child Rights Champions
  3. UNESDAUNESDA Outlines 2019-2024 Aspirations: Sustainability, Responsibility, Competitiveness
  4. Counter BalanceRecord citizens’ input to EU bank’s consultation calls on EIB to abandon fossil fuels
  5. International Partnership for Human RightsAnnual EU-Turkmenistan Human Rights Dialogue takes place in Ashgabat
  6. Nordic Council of MinistersNew campaign: spot, capture and share Traces of North
  7. Nordic Council of MinistersLeading Nordic candidates go head-to-head in EU election debate
  8. Nordic Council of MinistersNew Secretary General: Nordic co-operation must benefit everybody
  9. Platform for Peace and JusticeMEP Kati Piri: “Our red line on Turkey has been crossed”
  10. UNICEF2018 deadliest year yet for children in Syria as war enters 9th year
  11. Nordic Council of MinistersNordic commitment to driving global gender equality
  12. International Partnership for Human RightsMeet your defender: Rasul Jafarov leading human rights defender from Azerbaijan

Latest News

  1. Romania drafts EU code on NGO migrant rescues
  2. Bulgaria, Hungary, and Malta shamed on press unfreedom
  3. EU drafts $20bn US sanctions list in aviation dispute
  4. Brunei defends stoning to death of gay men in EU letter
  5. US Democrats side with Ireland on Brexit
  6. Wifi or 5G to connect EU cars? MEPs weigh in
  7. How Brexit may harm the new EU parliament
  8. EU parliament backs whistleblower law

Stakeholders' Highlights

  1. UNICEFUNICEF Hosts MEPs in Jordan Ahead of Brussels Conference on the Future of Syria
  2. Nordic Council of MinistersNordic talks on parental leave at the UN
  3. International Partnership for Human RightsTrial of Chechen prisoner of conscience and human rights activist Oyub Titiev continues.
  4. Nordic Council of MinistersNordic food policy inspires India to be a sustainable superpower
  5. Nordic Council of MinistersMilestone for Nordic-Baltic e-ID
  6. Counter BalanceEU bank urged to free itself from fossil fuels and take climate leadership
  7. Intercultural Dialogue PlatformRoundtable: Muslim Heresy and the Politics of Human Rights, Dr. Matthew J. Nelson
  8. Platform for Peace and JusticeTurkey suffering from the lack of the rule of law
  9. UNESDASoft Drinks Europe welcomes Tim Brett as its new president
  10. Nordic Council of MinistersNordic ministers take the lead in combatting climate change
  11. Counter BalanceEuropean Parliament takes incoherent steps on climate in future EU investments
  12. International Partnership For Human RightsKyrgyz authorities have to immediately release human rights defender Azimjon Askarov

Join EUobserver

Support quality EU news

Join us