Brussels, 18/03/2016 (Agence Europe) - Several of the participants at a public hearing organised by the European Parliament's civil liberties committee on Thursday 17 March (see EUROPE 11501), including Austrian Max Schrems, were critical of the controversial EU-US Privacy Shield agreement on the transfer of European citizens' personal data to the United States.
Although the European Commission is happy with this new agreement which, it claims, provides the necessary safeguards guaranteeing European citizens the fundamental right to protection of personal data while still allowing these data to be sent across the Atlantic, Schrems, whose legal action led to the European Court of Justice invalidating the Safe Harbour agreement that preceded Privacy Shield (see EUROPE 11404) took the view that the new agreement “won't change anything”. “It's a replica of Safe Harbour”, he said.
The flaws in Privacy Shield are many and numerous, in Schrems' view. Establishing an ombudsman in the United States - whose job it will be to receive the complaints lodged by European citizens and to determine whether there has been a breach of the fundamental right to protection of personal data - will not achieve anything, he says. He argued: “You can turn to an ombudsman, who will tell you if things are fine but will not say anything (…) if you have been the subject of surveillance”.
Tiina Astola, Director General for Justice and Consumers at the Commission, said that introduction of this new ombudsman mechanism was, on the contrary, “a great success” in that “there was nothing like it in Safe Harbour”. Isabelle Falque-Pierrotin (France), speaking on behalf of the Article 29 Working Party (made up of representatives of national data protection authorities, the authorities for the EU institutions and bodies, and the European Commission) said that “this new post is undeniably a step forward. However, to ensure its effectiveness, it will have to have real powers and the holder of the post must really be independent”.
A further point in this highly controversial agreement relates to access to personal data for the purposes of national security. The Commission said it had “obtained written agreement that access by US public authorities to the personal data transferred from Europe will be limited to what is strictly necessary and will be proportionate”. But what do “strictly necessary” and “proportionate” mean? That is a question to which Falque-Pierrotin wants answers. She wants to be certain that “there will be no mass, indiscriminate access and that the fundamental rights of the persons concerned are respected”.
Schrems is not hopeful of improvement of personal data protection mechanisms in Europe in the future. “Asking a lawyer how to comply with the law will cost companies more than breaking it”, he opined. (Original version in French by Maëlle Didion)