Wednesday

20th Jun 2018

Watchdogs concerned by EU-US data pact

  • Over 2,400 US companies that process data have signed up to the Privacy Shield system (Photo: Rami Al-zayat)

The United States needs to appoint an independent ombudsperson who can deal with data complaints by EU citizens before 25 May 2018, the EU's data protection authorities said in a report published on Tuesday (5 December).

If it does not, the authorities said they would "take appropriate action", including going to court.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 18 year's of archives. 30 days free trial.

... our join as a group

The data watchdogs are known collectively as the Article 29 Data Protection Working Party (WP29), named after the relevant article in the EU's data protection directive.

In their report, they took aim at the EU-US 'Privacy Shield', a scheme put in place last year after a previous data-exchange pact, 'Safe Harbour', was annulled by the Court of Justice of the EU (CJEU).

The self-certification system governs the use of data of European citizens by US companies like Google and Facebook.

"The WP29 acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbour Decision," the report said, which was the advisory body's first annual review of the scheme.

"However, the WP29 has identified a number of significant concerns that need to be addressed by both the commission and the US authorities," it added.

The WP29 called on the European Commission and the US authorities "to restart discussions" and to "immediately" set up an "action plan" that will address the WP29's concerns.

Although Privacy Shield was agreed already in mid-2016, the US has still not appointed an independent ombudsperson to deal with complaints from EU citizens – it still has a temporary one.

It also had questions about the legal powers of the ombudsperson, who would not be able to bring a case to court.

Moreover, the US would only "partially" reveal information about the relation between the ombudsperson and the intelligence community.

The original data-exchange pact, Safe Harbour, was annulled by the EU's highest court after revelations of mass snooping by US intelligence agencies of EU citizens.

The report said that "as long as the applicable procedures will remain classified and will not be shared, the WP29 will not be in a position to assess whether the ombudsperson is vested with sufficient powers to access information and to remedy non-compliance".

Oversight

The WP29 also said that the system, which is based on self-certification, "still lacks sufficient oversight and supervision of compliance in practice" by the US.

It expressed concern that a US oversight body, the Privacy and Civil Liberties Oversight Board, still had vacancies.

The report also criticised that the website about Privacy Shield was mainly targeted towards companies that need to comply with the rules, rather than to EU citizens that want to know about their rights.

It said that "the US authorities should strive to offer more information in an accessible and easily understandable form to the individuals regarding their rights and available recourses and remedies".

The WP29 is also worried about a difference of interpretation between the EU and US on what constituted "HR data", which under the scheme should benefit from extra safeguards.

It said that the US side saw HR data only as data of employees within the same company, while the WP29 saw HR data as "as any personal data concerning an employee in the context of an employer-employee relationship".

The report came after eight representatives from EU data protection authorities went on a fact-finding mission to the US in September.

Commission: system functioning correctly

The eight accompanied the commission, which in October already produced its own review of Privacy Shield.

Although the commission also noted that "the practical implementation of the Privacy Shield framework can be further improved", the general tone of its seven-page report was positive.

"The annual review has demonstrated that the U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield," the commission report said.

According to the EU executive, "the United States continues to ensure an adequate level of protection for personal data transferred under the Privacy Shield from the Union to organisations in the United States".

The commission also called on the US to replace the acting ombudsperson with a permanent one "as soon as possible", without giving a deadline.

Act, or face legal action

By contrast, the WP29 said that the appointment of the ombudsperson and the oversight board members needed to be resolved by 25 May 2018.

Other pending concerns should be "addressed" at the latest during the second annual review, which can be expected in the autumn of 2018.

If the US doesn't comply, the data protection authorities threaten to go to court, which could ultimately lead Privacy Shield to the same fate as its predecessor: annulment.

"In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling," it said.

US tests EU patience over Privacy Shield

The data sharing pact with the US is yet to be fully implemented, as the Americans have failed to appoint people in key positions to ensure EU citizens' personal data is protected.

Focus

EU takes step towards free flow of data

Non-personal data should be allowed to cross EU borders without restrictions, with an exemption for security reasons, diplomats meeting in the Council of the EU have agreed.

Feature

EU and Turkey fight for 'lost generation'

Some 300,000 school-age Syrian children in Turkey are not enrolled in classes. Fears they may end up in sweatshops or forced to beg have triggered efforts by the EU, Unicef, and the Turkish government to keep them in school.

Stakeholders' Highlights

  1. Mission of China to the EUJointly Building Belt and Road Initiative Leads to a Better Future for All
  2. Macedonian Human Rights MovementMHRMI Launches Lawsuits Against Individuals and Countries Involved in Changing Macedonia's Name
  3. IPHRCivil society asks PACE to appoint Rapporteur to probe issue of political prisoners in Azerbaijan
  4. ACCASocial Mobility – How Can We Increase Opportunities Through Training and Education?
  5. Nordic Council of MinistersEnergy Solutions for a Greener Tomorrow
  6. UNICEFWhat Kind of Europe Do Children Want? Unicef & Eurochild Launch Survey on the Europe Kids Want
  7. Nordic Council of MinistersNordic Countries Take a Stand for Climate-Smart Energy Solutions
  8. Mission of China to the EUChina: Work Together for a Better Globalisation
  9. Nordic Council of MinistersNordics Could Be First Carbon-Negative Region in World
  10. European Federation of Allergy and AirwaysLife Is Possible for Patients with Severe Asthma
  11. PKEE - Polish Energy AssociationCommon-Sense Approach Needed for EU Energy Reform
  12. Nordic Council of MinistersNordic Region to Lead in Developing and Rolling Out 5G Network

Stakeholders' Highlights

  1. Mission of China to the EUChina-EU Economic and Trade Relations Enjoy a Bright Future
  2. ACCAEmpowering Businesses to Engage with Sustainable Finance and the SDGs
  3. Nordic Council of MinistersCooperation in Nordic Electricity Market Considered World Class Model
  4. FIFAGreen Stadiums at the 2018 Fifa World Cup
  5. Mission of China to the EUChina and EU Work Together to Promote Sustainable Development
  6. Counter BalanceEuropean Ombudsman Requests More Lending Transparency from European Investment Bank
  7. FIFARecycling at the FIFA World Cup in Russia
  8. Nordic Council of MinistersOECD Report: Gender Equality Boosts GDP Growth in Nordic Region
  9. Centre Maurits Coppieters“Peace and Reconciliation Is a Process That Takes Decades” Dr. Anthony Soares on #Brexit and Northern Ireland
  10. Mission of China to the EUMEPs Positive on China’s New Measures of Opening Up
  11. Macedonian Human Rights MovementOld White Men are Destroying Macedonia by Romanticizing Greece
  12. Counter BalanceControversial EIB-Backed Project Under Fire at European Parliament

Join EUobserver

Support quality EU news

Join us