The European Commission has sent the final draft of the EU-US Privacy Shield to national representatives and expect to get a yay or nay next Monday with a view to “adopting the implementing act” one day later on July 5.
Sources from the Article 31 group told Ars last week that they did not want to be rushed, but the Commission clearly has other ideas. The text, seen by Ars, has also been sent to the European Parliament who can give their opinion, but can’t actually block it.
The so-called Article 31 committee, which includes representatives from all 28 member states, as well as the European Commission, held a meeting on Wednesday and has another scheduled for Monday.
Technically the committee is entitled to two weeks to review the text, but the Commission is pushing hard for approval much sooner than that.
Privacy Shield, which replaces the defunct Safe Harbour agreement between the EU and the US, aims to provide legal certainty to companies transferring personal data from the EU to the US. Under EU law, such data can only be sent to countries that guarantee European citizens an adequate level of data protection or privacy that is “essentially equivalent” to that they receive at home, and the US does not meet that standard, hence the need for a special deal.
It was whistleblower Edward Snowden’s disclosures that the US National Security Agency was snooping on private data that led to Safe Harbour being annulled by the European Court of Justice (CJEU) last October.
When a first draft of Privacy Shield was sent to national data protection authorities earlier this year, they said that while there were some improvements over Safe Harbour, a lot of loopholes remained—specifically the potential for bulk collection of data, a carve out of judicial redress for data collected for US national security purposes, and the independence, or not, of an oversight ombudsman.
The latest draft says that “bulk collection will only be authorised exceptionally where targeted collection is not feasible, and will be accompanied by additional safeguards to minimise the amount of data collected and subsequent access (which will have to be targeted and only be allowed for specific purposes).” How “feasible” is actually defined in practice remains to be seen.
"Overall we think it's an improvement," one source from the Article 31 group told Ars after an initial analysis of the draft. "There will be more discussions next week."
Listing image by Game of Thrones
reader comments
8