Today the European Data Protection Authorities (the Article 29 Working Party) published their official opinion on the proposed adequacy decision by the European Commission on the EU-U.S. Privacy Shield.

The opinion acknowledges the improvements in the new framework but asks for clarification in many areas to address their ongoing concerns.

The opinion is not binding but is an important step in the approval process for the new international data transfer framework published in February to replace Safe Harbor. The EU-U.S. Privacy Shield framework is the product of two years of intensive negotiations.

It represents the commitment of the EU and the U.S. Government to securing the vital transatlantic data flows, which are an integral part of the information economy.

Path to EU Regulatory Approval

Before the Framework can come into effect, a draft adequacy decision from the European Commission must be approved by a European “comitology” procedure, which involves

    • (i) insight from the Article 29 Working Party,
    • (ii) a binding opinion from the EU Member State representatives,
    • and (iii) formal adoption of the adequacy decision by the EU College of Commissioners.

Article 29’s opinion recognizes the significant improvements in the new privacy shield arrangement but remains concerned that it does not go far enough to align with EU privacy law. The opinion asked for clarification in several areas, including ongoing national security concerns.

As a result, regulators were not yet able to confirm that the current draft adequacy decision ensures a level of protection that is essentially equivalent to that in the EU.

While the opinion of the Article 29 Working Party is important it is not binding, and the European Commission is now in a position to proceed with the adoption of a comitology Commission decision based on Article 25.6 of the Directive.

The next step in the adoption process is a review and issuance of a binding opinion by the Article 31 Committee made up of representatives from the EU Member States. It is anticipated that this final approval process will be completed by June 2016.

How TRUSTe can help?

While regulatory review of the Privacy Shield is underway, TrustArc continues to provide guidance to companies as they analyze the Privacy Shield principles in light of their own data flows and data protection practices.

Contact us for a free personal consultation 1-888-878-7830.