Brussels, 29/02/2016 (Agence Europe) - On Monday 29 February, the European Commission presented its draft adequacy decision to update the old personal data transfer system used between the EU and US and known as the Safe Harbor mechanism. The European Court of Justice invalidated this mechanism on 6 October 2015 (see EUROPE 11404).
After presenting the main guidelines on 2 February, the Commission therefore officially announced the draft “US/EU Privacy Shield” text (see EUROPE 11481), which it also sent to the European data protection authorities meeting up in the Article 29 group in the morning. This group is expected to submit its final opinion at the end of March and the draft adequacy decision will replace the old decision that dates back to 2000, which will be sent off for committee procedures.
Although the Commission was unable to give a precise timetable for the entry into force of the “shield”, it did highlight the new safeguards, such as those added to the mass surveillance programmes and the creation of an independent Ombudsman. One of the functions of the latter will be to ensure that every European who makes a complaint or request in this area will receive a satisfactory response or resolution.
The Commission is convinced that it has negotiated a more solid text that is not likely to be undermined by the European Court of Justice, which happened in the case put forward by Austrian student Max Schrems, the reason for the annulment of the Safe Harbor mechanism. The Commission highlighted both the major changes and more efficient supervisory mechanisms. The US Department of Trade is committed to ensuring that this supervision applies to Europeans and US companies that will not just have to comply with these protection principles but also apply them to transfers that it could make to other third countries. Companies will have 45 days to respond to requests or complaints from European citizens. (More binding arbitration mechanism may be used when alternative resolution modes fail).
The Commission is delighted to have received written guarantees on the objectives, the period for treating personal data, as well as the access provided to national security agencies to this personal data, which in theory is only processed by companies such as Google or Facebook. Access to the data of national intelligence authorities will be subject to guidance based on the principles of necessity and proportionality. In this connection, the US is committed to providing possibilities to appeal to Europeans and the Ombudswoman
(Catherine Novelli) will be able to access confidential elements.
Bulk data collections - those that have not yet been determined and affect all individuals - will still be allowed but will be the exception and not the rule, explained the Commission. It will be permitted if other more targeted approaches are not possible and will have to respond to 6 conditions such as the fight against terrorism or opposing the activities of foreign intelligence services that could damage US interests. This guarantee was given in writing by the US and will be verified every year as part of the annual joint Privacy Shield revision mechanism, which should provide an opportunity for both parties to examine appropriate respect by companies of the principles in the new mechanism, explained the Commission again. In this context, the EU is hoping to exert pressure on its partner to ensure that possible failings are addressed, such as the too frequent use of bulk data collection techniques.
The system will, however, continue to be based on corporate self-regulation but the Commission has promised that it would almost immediately suspend the mechanism if certain failings observed continued. It is also counting on continuity in the application of the mechanisms, if the Republicans take office.
On Monday, Max Schrems said that he had doubts about these developments and asked whether this new shield would really be able to prevent matters going to the court in Luxembourg again. (Original version in French by Solenn Paulic)