The European Parliament has passed a resolution calling on the European Commission to suspend the so-called Privacy Shield with the US if the US government does not improve its implementation of the data protection agreement by 01 September. A suspension of the agreement could limit the ability of companies to transfer legally data from the EU to the US.
The non-binding resolution lists a number of areas where the US has failed to fully implement the Privacy Shield or may have passed other legislation violating its terms. The mechanism was agreed in 2016 as a replacement for the previous Safe Harbour designation by the European Commission. The US was dropped as a safe harbour destination for personal data due to the widespread eavesdropping by the National Security Agency.
Problems with the Privacy Shield have centred on the inability of Europeans still to obtain legal redress in the US if their data protection rights have been violated. The US has yet to appoint a permanent ombudsman to handle complaints or fill appointments to the Privacy and Civil Liberties Oversight Board. The European Data Protection Board, which upholds data protection regulation in the EU, has also called for US authorities to address these issues, following a recent meeting with the temporary ombudsman.
Other concerns about the Privacy Shield include a possibly broad interpretation of 'national security' exceptions by the US and a continued lack of clarity about how the NSA collects and processes bulk communications data. In addition, recent legislation passed in the US, such as executive orders limiting non-citizen privacy rights and the Cloud Act, may violate agreements under the Privacy Shield.
The European Parliament's resolution comes ahead of a second annual review of the Privacy Shield by the European Commission in October. In addition, there are several cases pending before the EU Court of Justice over the validity of the Privacy Shield.
