Brussels, 03/02/2016 (Agence Europe) - On Tuesday and Wednesday 2-3 February, European data protection agencies met up in Brussels as part of the Article 29 Group. They gave themselves two months to assess the new agreement announced the previous day (see EUROPE 11481) by the European Commissioners Vera Jourova (Justice) and Andrus Ansip (Single Digital Market) on the so-called Privacy Shield mechanism. This is supposed to replace the Safe Harbor mechanism invalidated by the European Court of Justice on 6 October last. The president of this group, Isabelle Falque-Pierrotin, made this announcement on Wednesday 3 February during a press conference. She explained that during the assessment, companies would be allowed to continue with the alternative transfer instruments, such as the corporate binding rules.
According to the president of the Article 29 Group, conclusion of the negotiations with the US should be welcomed. Falque-Pierrotin, from France, explained during the press conference that it was “a very positive signal, and a very good step” but that significant grey areas still exist. The President indicated “to be honest, we do not know very much” about this new agreement except the “verbal commitments from the Commission”. She had questions regarding the legal form this agreement would take and indicated that they had heard “the exchange of letters” mentioned.
She added: “We think it is important to have these commitments in writing”. The Article 29 Group is expected to make known its final position on this new mechanism at the end of March during a plenary session, indicated the President of the group. By then, the legal security and security of European citizens will still not be, guaranteed, however, with these alternative instruments and a more thoroughgoing analysis of these instruments over recent months has revealed a number of concerns, explained Falque-Pierrotin. She added that the analysis of the new Privacy Shield should shed new light on these other instruments.
This analysis of the new mechanism presented on 2 February will be carried out according to 4 criteria that need to be respected by the US intelligence services, explained the G29 President: data processing must follow clear, precise and accessible rules; data processing must be necessary and proportionate; there must be an independent supervisory mechanism and Europeans must have the means to appeal. She explained that these criteria constituted a “kind of European standard”.
Opinions differ at EP
This agreement also provoked a number of misgivings among MEPs, as well as among Internet rights organisations, such as the EDRI and bodies involved in defending the rights of companies affected by the mechanism.
On Tuesday evening, the President of the EP Civil Liberties Committee (LIBE), Claude Moraes (S&D, United Kingdom) indicated that he would insist on there being guarantees that the written assurances provided by the US are indeed binding, as stipulated by the European Commission, which informed MEPs that this agreement was based on letters signed by the different parties at the highest political level.
Claude Moraes is concerned that this agreement is not based on any concrete text and said that the new framework announced by Commissioner Jourova does not have a written text. His first concern was that there were too many things in common with the previous Safe Harbor decision. The press release did not outline the measures that are legally binding for the two parties but is based on a “statement” by the US authorities on their interpretation of the legal situation regarding surveillance by the US intelligence services, explained Moraes in the press release.
The president of the LIBE Committee also said that one of his other major concerns was the setting up of the post of ombudsman. He said that this could be a step forward in a way of assessing complaints from citizens but does not appear in its present form to be backed up by sufficient legal powers. He said that they were waiting for new developments on this proposal. He also voiced concerns about the agreement not leading to any changes in US law, which would, nonetheless, make this new mechanism more “substantial”.
The MEP Viviane Reding from the EPP said that this Privacy Shield also appeared insufficient. As European Commissioner she began talks with the US in 2013 about the Safe Harbor initiative, following the Snowden revelations. She believes that progress has been made in the US and that the enhanced cooperation between the national data protection agencies and the Department of Commerce, as well as the Federal Trade Commission, is a positive development, as is the annual joint assessment. The appointment of an Ombudsman is also new and interesting at an institutional level but its real powers remain vague. The Luxembourg MEP asked whether a question still remained regarding whether it will be “sufficient” for protecting personal data and ensuring legal security “on the central point, the new text is disappointed”. The commitment by the US authorities to limit mass surveillance of European citizens is only guaranteed by a written letter. “Is it sufficient for limiting, controlling and preventing generalised access to the data of European citizens? I have serious doubts about how this commitment would fare under another examination of the European Court of Justice”.
The Former Commissioner therefore distinguishes herself from the policy of the EP, which gave a warm welcome to these announcements. It did not give its full go-ahead but believes that the Commission announcements went in the right direction, as explained by Axel Voss.
The EDRI (European Digital rights) said the Commission appeared to have accepted an agreement on the cheap in relation to the Schrems ruling on 6 October, one of the main concerns also involves the form of the “letters” underpinning this agreement.
The US Secretary of Commerce, Penny Pritzker, described this agreement as “historic” on Tuesday 2 February. She said that it provided the necessary security to companies and millions of citizens that would be able to continue to surf on the Internet. The US representative said that this agreement significantly increased mechanisms for protecting private life. She highlighted the new means of resolving litigation began by Europeans that are now free and pointed to the joint regular assessment of the mechanism and the new possibility open to Europeans to question certain surveillance methods they are subject to. The US government would in this case have to respond to legal enquiries deemed “appropriate”. (Original version in French by Solenn Paulic)