Brussels, 08/07/2016 (Agence Europe) - The Commission has indicated that on Friday 8 July, member state representatives meeting up in the so-called Article 31 group endorsed the provisions in the new transatlantic framework for the transfer of personal data, the well-known “Privacy Shield” mechanism. Austria, Romania, Bulgaria and Slovenia, however, abstained.
This mechanism will replace the former Safe Harbour system that the European Court of Justice invalidated last October because it did not protect the private life of Europeans enough, following the revelations of Edward Snowden on the NSA, the US intelligence agency, which had access to personal data shared in this mechanism.
Finalised at the beginning of February and fine-tuned afterwards by the Commission, the new Privacy Shield mechanism seeks to rectify these shortcomings. The Commission will finally adopt this adequacy decision on Tuesday 12 July, explained the services of the spokesperson for the European Commissioner in charge of this dossier, Vera Jourova. The Commission believes that the new mechanism contains more guarantees for protecting private life, as well as more obligations incumbent on enterprises that use it. An annual joint assessment with the US is planned, rights of appeal are open to European citizens (since the adoption of the Judicial Redress Act) and a Ombudsman will be set up at the State Department, who will have the task of managing any possible litigation arising from surveillance carried out by the US authorities.
Commissioner Vera Jourova (Justice and Consumer Protection), who is piloting the dossier, and Andrus Ansip (Digital Single Market) stated: “The EU-U.S. Privacy Shield will ensure a high level of protection for individuals and legal certainty for business. It is fundamentally different from the old 'Safe Harbour': It imposes clear and strong obligations on companies handling the data and makes sure that these rules are followed and enforced in practice”.
The original agreement stipulates that companies are subject to strict obligations, including clear guidelines on ensuring that the rules are followed, with the possibility of penalising them or excluding them if the rules are not respected. The US authorities' access should be subject to clear rules and be transparent, explains the Commission, whilst any access granted to the public authorities for national security data should be subject to limits, conditions and well-defined supervisory mechanisms.
The Ombudsman will ensure follow-up to complaints and requests for information from individuals and will also indicate to them whether the appropriate regimentation has been respected.
The companies subject to a European complaint will have to provide a response to it within a timeframe of 45 days. A free of charge Alternative Dispute Resolution solution will be available. When a dispute has not been settled using this method, an arbitration mechanism will be available as a last resort.
An annual joint review mechanism will monitor the functioning of the Privacy Shield, including the commitments and assurance as regards access to data for law enforcement and national security purposes. The re-examination will be carried out by the European Commission and US Secretary for Trade, explained the Commission.
The EP and the Article 29 Group, which bring together the national data protection authorities, gave the new mechanism a relatively positive welcome but the two bodies highlighted some of the shortcomings, particularly with regard to the ambiguity involving the powers of the Ombudsman.
In its subsequent contacts with the US, the European Commission said that it would like clarification on a number of aspects, such as the obligation to provide the same level of protection when companies transfer the data of other partners. The Commission explains that these third parties should inform the companies about the Privacy Shield when they are unable to ensure the same level of protection. The company should also remove the personal data that they are no longer using. The Commission also provided assurances, without giving details, that it had received guarantees that the Ombudsman would have the necessary resources for carrying out its work and doing so in complete independence, according to the promises received from the US. (Original version in French by Solenn Paulic)