Friday

29th Sep 2023

Privacy Shield less relevant given GDPR, says data chief

  • Is Privacy Shield still relevant? (Photo: European Commission)

Two years ago the EU's data protection chief said the EU-US data transfer pact known as 'Privacy Shield' would increasingly play a minor role.

On the eve of the launch of the general data protection regulation (GDPR), Giovanni Buttarelli, the European data protection supervisor, maintains his position.

Read and decide

Join EUobserver today

Become an expert on Europe

Get instant access to all articles — and 20 years of archives. 14-day free trial.

... or subscribe as a group

On Wednesday (23 May) in an interview with EUobserver, he said the soon to be enforced data rules will provide a much higher standard of safeguards that go far beyond Privacy Shield.

"You may say Privacy Shield is still there but is less relevant for me because the entire set of standards, including the transfer, should be subject to higher standards," he said.

Privacy Shield is a self-certifying legal framework enforced by the Americans that allows US tech firms to transfer data of Europeans back to the United States on the basis they respect European privacy laws.

GDPR is a European regulation that goes way beyond the scope of Privacy Shield, is enforced by European data regulators as of Friday, and wrestles away the corporate grip on people's data worldwide.

GDPR means, among other things, that people in Europe must give affirmative consent for their data to be used, that any business anywhere in the world be clear about how they use that data, and that one can demand that same data be deleted or transferred elsewhere.

It also means companies must design services that have privacy standards built in by default. The whole is supposed to protect data from things like abuse and identity theft.

"On Friday, what you do in Europe remotely is subject to GDPR in its entirety," said Buttarelli, noting that Privacy Shield will no longer be considered as a 'free pass' for US firms to use the data as they please.

The thousands of US companies like Facebook listed under shield are supposed to respect European privacy laws, but in practice, this has raised serious doubts of compliance.

The pact had to be renegotiated after the European Court of Justice scuppered its predecessor Safe Harbour in late 2015 given US mass surveillance, in the wake of secret documents leaked to the press by former US agent Edward Snowden.

The US then earlier this year renewed privacy-invasive programs like section 702 of the US Foreign Intelligence Surveillance Act (FISA), which allows the National Security Agency to gather intelligence on Europeans by collecting data from fibre optic cables.

The Americans have also yet to appoint the necessary staff on their side to make sure the conditions of the Privacy Shield pact are fully respected. This includes setting up a permanent ombudsman within the US state department to field complaints by EU citizens.

US promises to meet those conditions fell apart under the Donald Trump administration despite repeated European Commission demands. Last September, Vera Jourova, the EU justice commissioner went to the United States to sort outstanding issues. She came away empty handed.

"I made clear that my patience is running to an end," Jourova told reporters last week when asked if anything has since changed.

Despite the loopholes and lack of US compliance, some MEPs maintain that Privacy Shield remains vital. MEPs in the civil liberties committee on Thursday are set to vote on a report on Privacy Shield.

One of its biggest defenders is Axel Voss, a German centre-right MEP.

"It decreases the administrative burden for businesses and keeps a safe environment for citizens' data," he said, in a statement on Wednesday.

Voss had also tabled more amendments to weaken the general data protection regulation than any other MEP, according to LobbyPlag.

Are EU data watchdogs staffed for GDPR?

The success of the new general data protection regulation (GDPR) will depend on whether data protection authorities enforce the new rules - which, in turn, will be at least partly determined by how many people they employ.

Eight countries to miss EU data protection deadline

The EU starts enforcing its general data protection regulation on 25 May - but Belgium, Bulgaria, Cyprus, Czech Republic, Greece, Hungary, Lithuania and Slovenia won't be ready. The delay will cause legal uncertainty.

MEPs: 'Mass surveillance' still possible under US privacy deal

A delegation of MEPs from the civil liberties committee have warned of the remaining "deficiencies" of the EU-US 'privacy shield' framework, amid concerns over the efficiency of this mechanism to protect EU citizens' fundamental rights.

Will US privacy-lite hollow out GDPR?

Some say GDPR is the most developed data protection law in the world, but the US has opted for a very different approach - a "voluntary tool" based on privacy risk management.

Opinion

Orbán's 'revenge law' is an Orwellian crackdown on education

On Tuesday, the Hungarian parliament passed a troubling piece of legislation known by its critics as the 'revenge law', which aims to punish and intimidate teachers who dare to defy Viktor Orbán's regime. This law is a brutally oppressive tool.

Latest News

  1. Poland's culture of fear after three years of abortion 'ban'
  2. Time for a reset: EU regional funding needs overhauling
  3. Germany tightens police checks on Czech and Polish border
  4. EU Ombudsman warns of 'new normal' of crisis decision-making
  5. How do you make embarrassing EU documents 'disappear'?
  6. Resurgent Fico hopes for Slovak comeback at Saturday's election
  7. EU and US urge Azerbijan to allow aid access to Armenians
  8. EU warns of Russian 'mass manipulation' as elections loom

Stakeholders' Highlights

  1. International Medical Devices Regulators Forum (IMDRF)Join regulators, industry & healthcare experts at the 24th IMDRF session, September 25-26, Berlin. Register by 20 Sept to join in person or online.
  2. UNOPSUNOPS begins works under EU-funded project to repair schools in Ukraine
  3. Georgia Ministry of Foreign AffairsGeorgia effectively prevents sanctions evasion against Russia – confirm EU, UK, USA
  4. International Medical Devices Regulators Forum (IMDRF)Join regulators & industry experts at the 24th IMDRF session- Berlin September 25-26. Register early for discounted hotel rates
  5. Nordic Council of MinistersGlobal interest in the new Nordic Nutrition Recommendations – here are the speakers for the launch
  6. Nordic Council of Ministers20 June: Launch of the new Nordic Nutrition Recommendations

Stakeholders' Highlights

  1. International Sustainable Finance CentreJoin CEE Sustainable Finance Summit, 15 – 19 May 2023, high-level event for finance & business
  2. ICLEISeven actionable measures to make food procurement in Europe more sustainable
  3. World BankWorld Bank Report Highlights Role of Human Development for a Successful Green Transition in Europe
  4. Nordic Council of MinistersNordic summit to step up the fight against food loss and waste
  5. Nordic Council of MinistersThink-tank: Strengthen co-operation around tech giants’ influence in the Nordics
  6. EFBWWEFBWW calls for the EC to stop exploitation in subcontracting chains

Join EUobserver

Support quality EU news

Join us