‘Concerns’ remain about personal data transfers to US

Group of EU data protection commissioners seeks further information on new EU-US deal

Max Schrems, whose case was referred to the European Court of Justice, said he may challenge the arrangement depending on its final text. Photograph: Collins Courts

Max Schrems, whose case was referred to the European Court of Justice, said he may challenge the arrangement depending on its final text. Photograph: Collins Courts

 

EU data protection commissioners have asked the European Commission to produce all documents relating to the new EU-US data transfer arrangement – known as the EU-US Privacy Shield – by the end of February, indicating they still have “concerns” about the protection of citizens’ privacy.

The independent Article 29 working party (WP29), comprised of a representative of every data protection authority in the EU, was responding to the European Commission’s announcement of a proposed new mechanism to legitimise personal data transfers to the US, replacing the dead Safe Harbour arrangement.

The commission said on Monday that it would look to the new EU-US Privacy Shield arrangement to make transfers of personal data to the US legal. However, it has yet to fully sign off on that proposal.

Safe Harbour was struck down last October by the Court of Justice of the European Union, essentially as it was not capable of ensuring adequate protection for EU citizen data due to the level of mass surveillance by US national security authorities.

Conclusion

However, she said the group still wanted to receive the relevant documents from the commission to assess whether it was legally binding and whether it could address the wider concerns raised by the Schrems judgment. It still had “concerns” about the current US legal framework.

Ms Falque-Pierrotin noted that since Schrems, transfers of data to the US may not take place on the basis of the invalidated Safe Harbour decision.

“EU data protection authorities will therefore deal with related cases and complaints on a case-by-case basis.”

Documents

After that date, the WP29 will consider whether transfer mechanisms, such as standard contractual clauses and binding corporate rules, can still be used for personal data transfers to the US. In the meantime, the working party still considered such mechanisms to be valid.

Data protection consultant Daragh O’Brien of Irish firm Castlebridge Associates said the lack of any documentary evidence for the privacy shield deal, and its “questionable legal status”, was clearly a problem for the A29 working party. Safe Harbour remained dead and there was “every chance” the working party would have no option but to suspend all data transfers to the US once that review was concluded, he said.

Austrian campaigner Max Schrems, whose case against the Irish Data Protection Commissioner over its refusal to investigate Facebook’s US data transfers was referred to the Court of Justice, said he may challenge the arrangement depending on its final text.