On Friday 25 January, the European Data Protection Board (EDPB), which comprises the personal data protection authorities of all the EU Member States, published its report on the second joint review of the EU-US data protection system, the ‘Privacy Shield’.
Seven representatives of the EDPB participated in this review in mid-October in Brussels (see EUROPE 12120). All in all, the Board considers that several recommendations made during the first review by its predecessor, the Article 29 Working Party, have been taken into account (see EUROPE 11920); however, it still has some concerns.
In particular, the EDPB welcomed the appointment of three new members of the US Privacy and Civil Liberties Oversight Board (PCLOB) and the publication of a declassified version of a PCLOB report on the implementation of Presidential Directive no. 28, which shows the limitations of access to European personal data by the US authorities.
There remains the thorny issue of the appointment of a permanent mediator (‘Ombudsperson’) to handle complaints from Europeans whose data are processed by American companies under the scheme. The EDPB, like the European Commission, is firmly expecting the United States to make this appointment as soon as possible.
When the findings of the second review of the scheme were published in mid-December, the European Commission gave the US authorities until 28 February 2019 to appoint the Ombudsperson (see EUROPE 12163).
As far as the EDPB is concerned, the actual powers of the Ombudsperson must also be clarified. “Given the elements provided, the EDPB is not in a position to conclude that the Ombudsperson is vested with sufficient powers to access information and to remedy noncompliance, and it can thus not state that the Ombudsperson can be considered an ‘effective remedy before a tribunal’ in the meaning of Art. 47 of the EU Charter of Fundamental Rights”, it writes in its report.
On the commercial aspects of the scheme, the EDPB acknowledges that significant progress has been made. It particularly welcomed the implementation of the system of random checks to ensure that companies comply with the Privacy Shield, and the reinforcement of the initial certification process.
However, one concern remains: the lack of oversight in substance. The EDPB continues to believe that the checks carried out focus mainly on formal aspects and that companies' compliance with the substance of the scheme is not verified. In addition, the certification renewal process could be further refined, according to the European data protection authorities.
The report is available at: https://bit.ly/2zU40eD. (Original version in French by Marion Fontana)