Monday

18th Dec 2017

Watchdogs concerned by EU-US data pact

  • Over 2,400 US companies that process data have signed up to the Privacy Shield system (Photo: Rami Al-zayat)

The United States needs to appoint an independent ombudsperson who can deal with data complaints by EU citizens before 25 May 2018, the EU's data protection authorities said in a report published on Tuesday (5 December).

If it does not, the authorities said they would "take appropriate action", including going to court.

The data watchdogs are known collectively as the Article 29 Data Protection Working Party (WP29), named after the relevant article in the EU's data protection directive.

In their report, they took aim at the EU-US 'Privacy Shield', a scheme put in place last year after a previous data-exchange pact, 'Safe Harbour', was annulled by the Court of Justice of the EU (CJEU).

The self-certification system governs the use of data of European citizens by US companies like Google and Facebook.

"The WP29 acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbour Decision," the report said, which was the advisory body's first annual review of the scheme.

"However, the WP29 has identified a number of significant concerns that need to be addressed by both the commission and the US authorities," it added.

The WP29 called on the European Commission and the US authorities "to restart discussions" and to "immediately" set up an "action plan" that will address the WP29's concerns.

Although Privacy Shield was agreed already in mid-2016, the US has still not appointed an independent ombudsperson to deal with complaints from EU citizens – it still has a temporary one.

It also had questions about the legal powers of the ombudsperson, who would not be able to bring a case to court.

Moreover, the US would only "partially" reveal information about the relation between the ombudsperson and the intelligence community.

The original data-exchange pact, Safe Harbour, was annulled by the EU's highest court after revelations of mass snooping by US intelligence agencies of EU citizens.

The report said that "as long as the applicable procedures will remain classified and will not be shared, the WP29 will not be in a position to assess whether the ombudsperson is vested with sufficient powers to access information and to remedy non-compliance".

Oversight

The WP29 also said that the system, which is based on self-certification, "still lacks sufficient oversight and supervision of compliance in practice" by the US.

It expressed concern that a US oversight body, the Privacy and Civil Liberties Oversight Board, still had vacancies.

The report also criticised that the website about Privacy Shield was mainly targeted towards companies that need to comply with the rules, rather than to EU citizens that want to know about their rights.

It said that "the US authorities should strive to offer more information in an accessible and easily understandable form to the individuals regarding their rights and available recourses and remedies".

The WP29 is also worried about a difference of interpretation between the EU and US on what constituted "HR data", which under the scheme should benefit from extra safeguards.

It said that the US side saw HR data only as data of employees within the same company, while the WP29 saw HR data as "as any personal data concerning an employee in the context of an employer-employee relationship".

The report came after eight representatives from EU data protection authorities went on a fact-finding mission to the US in September.

Commission: system functioning correctly

The eight accompanied the commission, which in October already produced its own review of Privacy Shield.

Although the commission also noted that "the practical implementation of the Privacy Shield framework can be further improved", the general tone of its seven-page report was positive.

"The annual review has demonstrated that the U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield," the commission report said.

According to the EU executive, "the United States continues to ensure an adequate level of protection for personal data transferred under the Privacy Shield from the Union to organisations in the United States".

The commission also called on the US to replace the acting ombudsperson with a permanent one "as soon as possible", without giving a deadline.

Act, or face legal action

By contrast, the WP29 said that the appointment of the ombudsperson and the oversight board members needed to be resolved by 25 May 2018.

Other pending concerns should be "addressed" at the latest during the second annual review, which can be expected in the autumn of 2018.

If the US doesn't comply, the data protection authorities threaten to go to court, which could ultimately lead Privacy Shield to the same fate as its predecessor: annulment.

"In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling," it said.

US tests EU patience over Privacy Shield

The data sharing pact with the US is yet to be fully implemented, as the Americans have failed to appoint people in key positions to ensure EU citizens' personal data is protected.

Germany says China using LinkedIn to recruit informants

Germany's spy agency says the Chinese state is trying to recruit high-ranking German officials via social media outlets like LinkedIn. It accused Chinese intelligence of setting up fake profiles to lure them into becoming informants.

News in Brief

  1. EU adopts 'track-and-trace' tobacco system
  2. Luxembourg appeals Amazon tax decision
  3. EU leaders agree to open phase 2 of Brexit talks
  4. Juncker: May made 'big efforts' on Brexit
  5. Merkel took 'tough' line on Russia at EU summit
  6. EU leaders added line supporting 'two-state' solution
  7. EU leaders agree to 20 European Universities by 2024
  8. Belgian courts end legal proceedings against Puigdemont

Stakeholders' Highlights

  1. Dialogue PlatformThe Gülen Community: Who to Believe - Politicians or Actions?" by Thomas Michel
  2. Plastics Recyclers Europe65% plastics recycling rate attainable by 2025 new study shows
  3. European Heart NetworkCommissioner Andriukaitis' Address to EHN on the Occasion of Its 25th Anniversary
  4. ACCACFOs Risk Losing Relevance If They Do Not Embrace Technology
  5. UNICEFMake the Digital World Safer for Children & Increase Access for the Most Disadvantaged
  6. European Jewish CongressWelcomes Recognition of Jerusalem as the Capital of Israel and Calls on EU States to Follow Suit
  7. Mission of China to the EUChina and EU Boost Innovation Cooperation Under Horizon 2020
  8. European Gaming & Betting AssociationJuncker’s "Political" Commission Leaves Gambling Reforms to the Court
  9. AJC Transatlantic InstituteAJC Applauds U.S. Recognition of Jerusalem as Israel’s Capital City
  10. EU2017EEEU Telecom Ministers Reached an Agreement on the 5G Roadmap
  11. European Friends of ArmeniaEU-Armenia Relations in the CEPA Era: What's Next?
  12. Mission of China to the EU16+1 Cooperation Injects New Vigour Into China-EU Ties

Latest News

  1. Catalonia, Brexit, and Uber on EU agenda This WEEK
  2. Macron and Merkel take tough line on Poland
  3. Eurozone future needs structural reforms, EU leaders told
  4. Showdown EU vote on asylum looking likely for next June
  5. EU stresses unity as it launches next phase of Brexit talks
  6. Polish PM ready for EU sanctions scrap
  7. Dutchman to lead powerful euro working group
  8. EU mulls post-Brexit balance of euro and non-eurozone states

Stakeholders' Highlights

  1. EPSUEU Blacklist of Tax Havens Is a Sham
  2. EU2017EERole of Culture in Building Cohesive Societies in Europe
  3. ILGA EuropeCongratulations to Austria - Court Overturns Barriers to Equal Marriage
  4. Centre Maurits CoppietersCelebrating Diversity, Citizenship and the European Project With Fundació Josep Irla
  5. European Healthy Lifestyle AllianceUnderstanding the Social Consequences of Obesity
  6. Union for the MediterraneanMediterranean Countries Commit to Strengthening Women's Role in Region
  7. Bio-Based IndustriesRegistration for BBI JU Stakeholder Forum about to close. Last chance to register!
  8. European Heart NetworkThe Time Is Ripe for Simplified Front-Of-Pack Nutrition Labelling
  9. Counter BalanceNew EU External Investment Plan Risks Sidelining Development Objectives
  10. EU2017EEEAS Calls for Eastern Partnership Countries to Enter EU Market Through Estonia
  11. Dialogue PlatformThe Turkey I No Longer Know
  12. World Vision7 Million Children at Risk in the DRC: Donor Meeting to Focus on Saving More Lives