Two weeks ago, European Commissioner Věra Jourová tweeted that the text for Privacy Shield, a new framework for transatlantic data flows, will be finalized by the end of February. The agreement between the EU and the U.S. will replace the invalidated Safe Harbor framework to provide EU citizens with stronger privacy protections as their personal data is being transferred to the U.S., according to a statement from the European Commission.
Very few details about Privacy Shield have been made public. What we do know is that the agreement aims to fix inadequate privacy protections in the now-defunct Safe Harbor. Other than these differences, Privacy Shield largely keeps Safe Harbor’s structure in place, said Jacqueline Klosek, senior counsel at Goodwin Procter LLP.
“Based upon the information that is presently available, the changes in the Privacy Shield are minor, but move the U.S. incrementally toward greater privacy protection of EU citizens,” she said.
How exactly does Privacy Shield aim to achieve this? From what the European Commission (EC) has revealed so far, there are three noteworthy components of the agreement, according to Klosek:
Strong privacy obligations for U.S. companies that handle personal data. The U.S. Department of Commerce will monitor whether companies are publishing privacy standards, and the Federal Trade Commission (FTC) will enforce these obligations under U.S. law. “Note that although the precise standards remain to be fleshed out, this requirement largely parrots the Safe Harbor program,” said Klosek.
Limits on the surveillance of personal data being transferred to the U.S. The Schrems decision that invalidated Safe Harbor determined that the agreement allowed the indiscriminate collection and surveillance of EU citizens’ data. “The United States has given the EU binding assurances that the access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms,” Jourová said in a statement. According to the EC, these safeguards and limitations will be subject to an annual joint review by the EC and U.S. Commerce Department, although there is little detail about how rigorous this review will be.
However, there are a few holes in this aspect of Privacy Shield that still need to be addressed, Klosek pointed out. First, an investigation of U.S. intelligence legal frameworks shows that the U.S. government was already under these types of limitations. “This was the main U.S. government objection to the Schrems decision. … It did not accurately characterize the state of U.S. intelligence programs,” Klosek said. One notable difference between Privacy Shield and Safe Harbor is a requirement to appoint a privacy “ombudsman” in the U.S. that would field EU citizens’ complaints regarding U.S. surveillance. But the responsibilities of this role are also still unclear, said Klosek.
She added that the EU’s stance on requiring these oversight mechanisms for U.S. intelligence programs excludes the fact that EU national governments’ intelligence programs are subject to “far less oversight” than their U.S. counterparts.
Redress mechanisms to protect EU citizens’ right to privacy. EU citizens who believe their data has been misused will be able to file complaints using “accessible and affordable” dispute resolution mechanisms, according to Jourová. European Data Protection Authorities will refer these complaints to the FTC and the U.S. Commerce Department for possible enforcement. Furthermore, the Judicial Redress Act, which has already passed both houses of U.S. Congress, would allow foreign citizens to sue if they believe their privacy rights were compromised by the U.S. government.
Head to part two this blog post, where we explore the likely challenges Privacy Shield will face from EU authorities, the possible impact of the agreement on businesses and their customers, and more