Saturday

17th Apr 2021

Privacy Shield less relevant given GDPR, says data chief

  • Is Privacy Shield still relevant? (Photo: European Commission)

Two years ago the EU's data protection chief said the EU-US data transfer pact known as 'Privacy Shield' would increasingly play a minor role.

On the eve of the launch of the general data protection regulation (GDPR), Giovanni Buttarelli, the European data protection supervisor, maintains his position.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

On Wednesday (23 May) in an interview with EUobserver, he said the soon to be enforced data rules will provide a much higher standard of safeguards that go far beyond Privacy Shield.

"You may say Privacy Shield is still there but is less relevant for me because the entire set of standards, including the transfer, should be subject to higher standards," he said.

Privacy Shield is a self-certifying legal framework enforced by the Americans that allows US tech firms to transfer data of Europeans back to the United States on the basis they respect European privacy laws.

GDPR is a European regulation that goes way beyond the scope of Privacy Shield, is enforced by European data regulators as of Friday, and wrestles away the corporate grip on people's data worldwide.

GDPR means, among other things, that people in Europe must give affirmative consent for their data to be used, that any business anywhere in the world be clear about how they use that data, and that one can demand that same data be deleted or transferred elsewhere.

It also means companies must design services that have privacy standards built in by default. The whole is supposed to protect data from things like abuse and identity theft.

"On Friday, what you do in Europe remotely is subject to GDPR in its entirety," said Buttarelli, noting that Privacy Shield will no longer be considered as a 'free pass' for US firms to use the data as they please.

The thousands of US companies like Facebook listed under shield are supposed to respect European privacy laws, but in practice, this has raised serious doubts of compliance.

The pact had to be renegotiated after the European Court of Justice scuppered its predecessor Safe Harbour in late 2015 given US mass surveillance, in the wake of secret documents leaked to the press by former US agent Edward Snowden.

The US then earlier this year renewed privacy-invasive programs like section 702 of the US Foreign Intelligence Surveillance Act (FISA), which allows the National Security Agency to gather intelligence on Europeans by collecting data from fibre optic cables.

The Americans have also yet to appoint the necessary staff on their side to make sure the conditions of the Privacy Shield pact are fully respected. This includes setting up a permanent ombudsman within the US state department to field complaints by EU citizens.

US promises to meet those conditions fell apart under the Donald Trump administration despite repeated European Commission demands. Last September, Vera Jourova, the EU justice commissioner went to the United States to sort outstanding issues. She came away empty handed.

"I made clear that my patience is running to an end," Jourova told reporters last week when asked if anything has since changed.

Despite the loopholes and lack of US compliance, some MEPs maintain that Privacy Shield remains vital. MEPs in the civil liberties committee on Thursday are set to vote on a report on Privacy Shield.

One of its biggest defenders is Axel Voss, a German centre-right MEP.

"It decreases the administrative burden for businesses and keeps a safe environment for citizens' data," he said, in a statement on Wednesday.

Voss had also tabled more amendments to weaken the general data protection regulation than any other MEP, according to LobbyPlag.

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Will US privacy-lite hollow out GDPR?

Some say GDPR is the most developed data protection law in the world, but the US has opted for a very different approach - a "voluntary tool" based on privacy risk management.

MEPs: 'Mass surveillance' still possible under US privacy deal

A delegation of MEPs from the civil liberties committee have warned of the remaining "deficiencies" of the EU-US 'privacy shield' framework, amid concerns over the efficiency of this mechanism to protect EU citizens' fundamental rights.

News in Brief

  1. EU postpones decision on labelling gas 'sustainable'
  2. MEPs call for mass surveillance ban in EU public spaces
  3. Greek and Turkish ministers trade jibes in Ankara
  4. Biden repeats opposition to Russia-Germany pipeline
  5. Navalny in danger, letter warns EU foreign ministers
  6. Lithuania keen to use Denmark's AstraZeneca vaccines
  7. Gas plants largest source of power-sector emissions
  8. Study: Higher risk of blood clots from Covid than vaccines

Feature

Covid-hit homeless find Xmas relief at Brussels food centre

The Kamiano food distribution centre in Brussels is expecting 20 people every half hour on Christmas Day. For many, Kamiano is also more than that - a support system for those made homeless or impoverished.

Top court finds Hungary and Poland broke EU rules

EU tribunal said Hungary's legislation made it "virtually impossible" to make an asylum application. Restricting access to international protection procedure is a violation of EU rules.

Stakeholders' Highlights

  1. Nordic Council of MinistersDigitalisation can help us pick up the green pace
  2. Nordic Council of MinistersCOVID19 is a wake-up call in the fight against antibiotic resistance
  3. Nordic Council of MinistersThe Nordic Region can and should play a leading role in Europe’s digital development
  4. Nordic Council of MinistersNordic Council to host EU webinars on energy, digitalisation and antibiotic resistance
  5. UNESDAEU Code of Conduct can showcase PPPs delivering healthier more sustainable society
  6. Nordic Council of MinistersWomen benefit in the digitalised labour market

Latest News

  1. US rejects Slovenia-linked plan to break up Bosnia
  2. Ukraine urges Borrell to visit Russia front line
  3. Could US sanctions hit Russia vaccine sales to EU?
  4. Polish court pushes out critical ombudsman
  5. Political crises in Romania and Bulgaria amid third wave
  6. Von der Leyen's summer plans undisclosed, after Ukraine snub
  7. Over a million EU citizens back farm-animal cage ban
  8. Three options for West on Putin's Ukraine build-up

Join EUobserver

Support quality EU news

Join us