Thursday

20th Feb 2020

Privacy Shield less relevant given GDPR, says data chief

  • Is Privacy Shield still relevant? (Photo: European Commission)

Two years ago the EU's data protection chief said the EU-US data transfer pact known as 'Privacy Shield' would increasingly play a minor role.

On the eve of the launch of the general data protection regulation (GDPR), Giovanni Buttarelli, the European data protection supervisor, maintains his position.

Read and decide

Join EUobserver today

Support quality EU news

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or join as a group

On Wednesday (23 May) in an interview with EUobserver, he said the soon to be enforced data rules will provide a much higher standard of safeguards that go far beyond Privacy Shield.

"You may say Privacy Shield is still there but is less relevant for me because the entire set of standards, including the transfer, should be subject to higher standards," he said.

Privacy Shield is a self-certifying legal framework enforced by the Americans that allows US tech firms to transfer data of Europeans back to the United States on the basis they respect European privacy laws.

GDPR is a European regulation that goes way beyond the scope of Privacy Shield, is enforced by European data regulators as of Friday, and wrestles away the corporate grip on people's data worldwide.

GDPR means, among other things, that people in Europe must give affirmative consent for their data to be used, that any business anywhere in the world be clear about how they use that data, and that one can demand that same data be deleted or transferred elsewhere.

It also means companies must design services that have privacy standards built in by default. The whole is supposed to protect data from things like abuse and identity theft.

"On Friday, what you do in Europe remotely is subject to GDPR in its entirety," said Buttarelli, noting that Privacy Shield will no longer be considered as a 'free pass' for US firms to use the data as they please.

The thousands of US companies like Facebook listed under shield are supposed to respect European privacy laws, but in practice, this has raised serious doubts of compliance.

The pact had to be renegotiated after the European Court of Justice scuppered its predecessor Safe Harbour in late 2015 given US mass surveillance, in the wake of secret documents leaked to the press by former US agent Edward Snowden.

The US then earlier this year renewed privacy-invasive programs like section 702 of the US Foreign Intelligence Surveillance Act (FISA), which allows the National Security Agency to gather intelligence on Europeans by collecting data from fibre optic cables.

The Americans have also yet to appoint the necessary staff on their side to make sure the conditions of the Privacy Shield pact are fully respected. This includes setting up a permanent ombudsman within the US state department to field complaints by EU citizens.

US promises to meet those conditions fell apart under the Donald Trump administration despite repeated European Commission demands. Last September, Vera Jourova, the EU justice commissioner went to the United States to sort outstanding issues. She came away empty handed.

"I made clear that my patience is running to an end," Jourova told reporters last week when asked if anything has since changed.

Despite the loopholes and lack of US compliance, some MEPs maintain that Privacy Shield remains vital. MEPs in the civil liberties committee on Thursday are set to vote on a report on Privacy Shield.

One of its biggest defenders is Axel Voss, a German centre-right MEP.

"It decreases the administrative burden for businesses and keeps a safe environment for citizens' data," he said, in a statement on Wednesday.

Voss had also tabled more amendments to weaken the general data protection regulation than any other MEP, according to LobbyPlag.

Focus

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

Will US privacy-lite hollow out GDPR?

Some say GDPR is the most developed data protection law in the world, but the US has opted for a very different approach - a "voluntary tool" based on privacy risk management.

New GDPR enforcer says complaints imminent

The European Data Protection Board is a new EU body tasked with enforcing the EU's privacy laws with powers to impose massive fines. Its head Andrea Jelinek told reporters complaints against companies are expected to be immediate.

Polish 'LGBTI-free zones' not ok, says EU commission

The European Commissioner for equality Helena Dalli has said the distribution of 'LGBTI-free zones' stickers or the adoption of anti-LGBTI resolutions cannot be allowed. Some 86 towns in Poland have so far declared themselves 'LGBTI-free zones'.

Stakeholders' Highlights

  1. Nordic Council of MinistersScottish parliament seeks closer collaboration with the Nordic Council
  2. UNESDAFrom Linear to Circular – check out UNESDA's new blog
  3. Nordic Council of Ministers40 years of experience have proven its point: Sustainable financing actually works
  4. Nordic Council of MinistersNordic and Baltic ministers paving the way for 5G in the region
  5. Nordic Council of MinistersEarmarked paternity leave – an effective way to change norms
  6. Nordic Council of MinistersNordic Climate Action Weeks in December

Join EUobserver

Support quality EU news

Join us