The EU's privacy regulators have expressed concerns about the proposed Privacy Shield agreement on data transfers to the US, saying its doesn't do enough to prevent mass, indiscriminate surveillance of EU residents. The so-called Article 29 Working Group issued its opinion on the proposal and whether it lives up to EU data protection standards.
The regulators did concede that the Privacy Shield offered "significant improvements" on the previous Safe Harbour agreement, which was struck down last year by the EU Court of Justice for failure to adhere to EU data protection law. However, the Privacy Shield suffers from an "overall lack of clarity", the group said. Key concepts such as limiting access to personal data, data retention, automated processing and onward transfers beyond the US are not sufficiently defined or incoherent with definitions in EU law.
The main issue is whether the Privacy Shield does enough to prevent mass surveillance, something the regulators have long held must be subject to strict limits in a democratic society, in order to uphold fundamental rights in the EU. A forthcoming ruling by the EU Court of Justice is expected to provide more clarity on the legal limits of mass surveillance under EU law, the regulators noted, and this may impact the validity of the Privacy Shield.
Furthermore, the new redress mechanism for EU citizens proposed in the Privacy Shield may be too complex and ineffective. The national data protection authorities could be a better point of contact than the proposed Privacy Shield ombudsperson. The latter is expected to deal with complaints from Europeans about how their data has been used by US law enforcement. However, the EU regulators are concerned the ombudsperson lacks sufficient independence and powers to meet its aims.
The group also noted that the Privacy Shield may need revisions to bring its in line with the upcoming new directive and regulation on data protection in the EU. The regulation is expected to be approved this week by the European Parliament, giving EU members two years then to implement the changes.
The Article 29 group's opinion is only advice to the European Commission, which negotiated the agreement with the US. The Article 31 Committee, consisting of representatives of the EU states, must also give its opinion on the agreement, and most of the members are thought to support the Privacy Shield. The Article 31 Committee is expected to take a decision on the Privacy Shield in May.
The Commission aims to take a final decision in June, after which the agreement would come into effect immediately. EU Justice Commissioner Vera Jourova said in a statement that the Commission would incorporate the feedback from privacy regulators before taking a decision. She said the Commission also plans a practical "users guide" on how citizens can obtain redress in cases of possible privacy violations and that she counts on the privacy regulators to help enforce the new agreement.
