8 July 2016 – Dragged across the finish line, today members of the EU approved the proposed ‘Privacy Shield’ agreement with the U.S. on the transfer of personal data between the EU and US.
Four countries abstained: Austria, Bulgaria, Hungary and Slovenia.
Proposed in February, the agreement is designed to replace the former ‘safe harbor’ status for the US as a safe destination for personal data of EU citizens. This status was struck down last year by the European Court of Justice, which found that the U.S. did not provide enough safeguards for personal data or the opportunity for legal redress by EU citizens whose data may have been compromised. This put it in violation with fundamental rights to privacy in the EU.
European commissioners Andrus Ansip and Vera Jourova said in a statement that the Privacy Shield “will ensure a high level of protection for individuals and legal certainty for business.
It is fundamentally different from the old ‘Safe Harbor'”. The US has given written assurances to the EU that U.S. law enforcement authorities will be subject to clear limitations on their access to the data of EU residents, a key concern of the EU court in light of the revelations of mass surveillance by US intelligence services. In addition, a new ombudsman will be able to mediate in disputes over use of personal data in the U.S., and EU residents will be able to seek legal redress in the U.S.
On Monday afternoon Jourová faces a grilling from MEPs sitting on the justice and civil liberties committee, but at that point it will be too late for any intervention. one insider told me it will be more of a “bitch session”.
The new agreement must still be formally approved by the European Commission, expected this Tuesday, before it can take effect.
The agreement is expected to be formally discussed by the European Commission this next Monday, then be formally approved on Tuesday, followed by the deal being inked by Jourová and U.S. Secretary of Commerce Penny Pritzker on Tuesday.
Earlier this week, Germany’s Hamburg data protection watchdog Johannes Caspar told local media that the negotiations behind closed doors lacked transparency. He argued that the Commission’s desire to push the deal through as quickly as possible may undermine any real regulatory certainty. And privacy watchers have predicted that the deal will end up back before the European Court of Justice before too long. Test cases are already being constructed to see how EU citizens’ personal data is handled in the new system, and several privacy activists told me they are certain to challenge the new deal in court if they are not satisfied with its details.
