Reactions were relieved following the publication, on Wednesday 19 December, of the European Commission's second evaluation of the transatlantic data protection system, the Privacy Shield (see EUROPE 12163).
While in July the European Parliament called for the suspension of the scheme if the US authorities did not comply fully with it by 1 September 2018 (see EUROPE 12056), the Commission decided to maintain it and considered that it continued to provide adequate data protection for European citizens.
On the American side, satisfaction is the order of the day. Deputy Under-Secretary of Commerce James M Sullivan announced his impressions to the press on Thursday 20 December. The report clearly indicates that the Privacy Shield has been a “success” and highlights the “significant work” done by the US authorities over the past year, he welcomed.
There remains the thorny issue of the appointment of a permanent mediator (‘Ombudsperson’) to handle complaints from Europeans whose data are processed by American companies. In the Commission left until 28 February 2019 for the US authorities to make this appointment, failing which it would take measures, including the suspension of the scheme.
When asked about this, Mr Sullivan did not seem worried. He assured that the process was ongoing and that the appointment would take place in “short order”.
But all these European concerns about the fact that there is still no “permanent” senior official in the position seem to be misunderstood across the Atlantic.
The Under-Secretary for Economic Growth, Energy and Environment should normally act as the permanent mediator. While waiting for a nomination, several people have already held the position on an interim basis, the most recent being Manisha Singh, appointed by the State Department on 28 September and who has furthermore participated in this second interview.
Each person who has held the position on an interim basis has done so as well and with all the necessary powers as a permanent mediator," said Mr Sullivan. "The office is in place, it has resources, it works,” he continued. Moreover, no complaints have been received so far, he recalled.
Asked about Facebook's continued certification as a Privacy Shield despite recent scandals (see EUROPE 12054), the Deputy Under-Secretary assured that the Federal Trade Commission's investigation was ongoing. And to add: "If participants do not fully comply with the requirements of the Privacy Shield, the Federal Trade Commission has made it clear that it will remove them from the program.
On the European side too, the Commission's positive assessment was welcomed. Several European organisations, including BusinessEurope, Digital Europe, The Software Alliance (BSA) and the Computer and Communication Industry Association (CCIA), considered that the framework had been significantly improved both in terms of commercial and national security.
“Privacy shield is a living mechanism and we encourage both sides to continue their fruitful cooperation in the months and years to come so as to ensure the continuation of EU-US data flows, which underpins the economy on both sides of the Atlantic,” said Thomas Boué, BSA's CEO.
The report must now be sent to the European Parliament and the European Data Protection Committee, which should probably be less lenient than the European Commission. (Original version in French by Marion Fontana)