Brussels, 12/07/2016 (Agence Europe) - On Tuesday 12 July, the European Commission announced that it had formally adopted the new arrangement for personal data transfer to the US - the Privacy Shield. With the 'adequacy decision' now adopted, the US will launch the process of certification for companies participating in the new framework from 1 August, US secretary of commerce Penny Pritzker stated in Brussels. Privacy Shield replaces the former Safe Harbor (or Security Sphere) adequacy decision, which was invalidated by the European Court of Justice on 6 October 2015 on the grounds that it was not sufficiently protective of Europeans' privacy. The member states approved the content of Privacy Shield on 8 July (EUROPE 11590).
It is Austrian student Max Schrems who was at the origin of the affair. In Brussels on 12 July, Schrems said he was no more convinced by the Privacy Shield decision than by the previous one, and he pointed out persisting shortcomings. Schrems still sees difficulty with regard to blanket surveillance and especially with regard to intelligence agencies' access to certain data, even if this is limited - for example, on the grounds of terrorism threats. In his view, the definition is still too vague and he is also concerned at the difficulty for Europeans in being able to appeal because the appeal mechanisms are particularly complex and could make a complaint wait “for years”.
The ruling of the Court of Justice was not upheld on this point, nor on blanket surveillance, Schrems says, especially when the Court required effective means of repair.
Schrems again criticised the fact that the elements given by the Americans only depended on letters sent to the US authorities. “It is not an assurance that will be implemented”, he said.
And although a few improvements have been made, such as data minimisation, Privacy Shield is organised so that companies will almost all be able to fall outside this principle of minimisation, Schrems continued. The creation of an ombudsman's post is further progress but does not fully respond to what the Court of Justice demanded either, he said, believing nevertheless that the authorities had tried to improve the framework.
Although the means for action are now limited after the Commission adopted the adequacy decision, the European Parliament's civil liberties committee will give its opinion in a resolution in September, German MEP Jan-Philipp Albrecht (Greens/EFA) stated - with the decision to draft this resolution being adopted during the evening of 11 July.
In Albrecht's view, the European Commission has simply not done its work on implementing the Court of Justice legislation. “The Commission has today signed a blank cheque for the transfer of personal data of EU citizens to the US, without delivering equivalent data protection rights”, he said in a press release. “The Privacy Shield framework does not seem to address the concerns outlined by the European Court of Justice in ruling the Safe Harbor decision illegal. In particular the individual rights of consumers are still too weak and blanket surveillance measures are still in place. In this context, the Commission should not be simply accepting reassurances from the US authorities but should be insisting on improvements in the data protection guaranteed to European consumers”, he said.
Albrecht particularly criticises the fact that the mass collection of personal data by the US surveillance authorities remains possible despite the limitations set (six possibilities for access). He also thought that the adequacy decision adopted on Tuesday should be renegotiated when the new general regulation on personal data comes into force in early 2018. European Commissioner for Justice and Consumers Vera Jourova ruled this possibility out at a press conference, however, saying that the elements of the new reform had been taken into account in the Privacy Shield decision and that renegotiation should not be necessary. (Original version in French by Solenn Paulic)