- The Privacy Shield draft is currently not sufficient to adequately protect EU data protection rights and judicial remedies.
- Routine access by US authorities to transferred data is only acceptable if necessary and proportionate with additional guarantees.
- In the long term, binding federal legislation is needed in the USA that reflects the key principles of EU data protection.
The European Data Protection Supervisor, Giovanni Buttarelli (“EDPS”) commented on the Privacy Shield on May 30, 2016 (Opinion 4/2016; PDF). He comes to the following conclusion, among others:
The draft Privacy Shield may be a step in the right direction but as currently formulated it does not adequately include, in our view, all appropriate safeguardsto protect the EU rights of the individual to privacy and data protection also with regard to judicial redress. Significant improvements are needed should the European Commission wish to adopt an adequacy decision. In particular, the EU should get additional reassurances in terms of necessity and proportionality, instead of legitimising routine access to transferred data by U.S. authorities on the basis of criteria having a legal basis in the recipient country, but not as such in the EU, as affirmed by the Treaties, EU rulings and constitutional traditions common to the Member States.
Moreover, in an era of high hyperconnectivity and distributed networks, self-regulation by private organizations, as well as representation and commitments by public officials, may play a role in the short term whilst in the longer term they would not be sufficient to safeguard the rights and interests of individuals and fully satisfy the needs of a globalised digital world where many countries are now equipped with data protection rules.
Therefore, a longer term solution would be welcome in the transatlantic dialogue, to also enact in binding federal law at least the main principles of the rights to be clearly and concisely identified, as is the case with other non EU countries which have been ’strictly assessed’ as ensuring an adequate level of protection; what the CJEU in its Schrems judgment expressed as meaning ‘essentially equivalent’ to the standards applicable under EU law, and which according to the Article 29 Working Party, means containing ‘the substance of the fundamental principles’ of data protection.
The EDPS also notes that the draft Adequacy Decision for the Privacy Shield is based on the Data Protection Directive, even though the GDPR will enter into force in 2018.