Mason Hayes & Curran takes a close look at the recommendations and criticisms of the draft Privacy Shield adequacy decision.
Earlier this year, the European Commission announced the potential replacement for the EU-US Safe Harbour scheme. The so-called ‘Privacy Shield’ is intended to be the new mechanism upon which EU-US personal data transfers will be based.
A month after the Commission’s announcement, the draft text of the Privacy Shield adequacy decision, complete with lengthy and numerous annexes, was published. Since its publication, the Draft has been under review by the Article 29 Working Party – the collective group of European data protection authorities (DPAs) also known as WP29.
Following the conclusion of this review process, WP29 recently published Opinion 01/2016 on the EU-US Privacy Shield draft adequacy decision. The Opinion analyses and reviews the entirety of the Draft, with WP29 making various comments and recommendations, and voicing certain criticisms.
Unclear and inconsistent
Although welcoming to many aspects of the Privacy Shield, particularly with respect to improvements made over Safe Harbour, WP29 highlights inconsistencies and a general lack of clarity in the Draft. In particular, given the length of the draft text and annexes, WP29 does not consider the Draft accessible.
Similarly, WP29 draws attention to the lack of clarity in the language used in the Draft and the need for it to be clear and based on a common understanding on both sides of the Atlantic. In this respect, WP29 has recommended:
- A separate annex providing a glossary of core terms for all stakeholders
- Where possible, the use of vocabulary and terminology that is consistent with EU data protection law
- Consistent use of terminology throughout the Draft
- The inclusion of various missing definitions throughout the Draft
‘Essential equivalency’ and ‘European essential guarantees’
One of the key concepts arising from Schrems, and underpinning the Opinion, is that of ‘essential equivalency’. In Schrems, the EU Court of Justice (CJEU) indicated that the wording, “adequate level of protection,” in respect of an Article 25(6) adequacy decision (such as Safe Harbour or the Privacy Shield) must be understood as requiring a level of data protection that is “essentially equivalent” to that under EU law.
WP29 notes that the Draft does not contain any adequacy report, which would have provided a comprehensive assessment of the domestic and international commitments of the US.
Interestingly, WP29 has established a separate doctrine, dubbed the ‘European essential guarantees’. These guarantees were developed by WP29 in the context of CJEU and European Court of Human Rights decisions. The guarantees provide a useful yardstick to appraise the laws and practices of any non-EEA recipient country that could be deemed to interfere with a fundamental right (such as processing for national security or law enforcement purposes).
The guarantees are not intended to be applied rigidly or independently; instead, they are meant to be considered in the round. Furthermore, WP29 intends that they be applied whatever the transfer mechanism, condition or derogation that is relied upon.
In short, the four guarantees require that processing (which could be deemed as an interference with a fundamental right):
- Should be in accordance with the law and based on clear, precise and accessible rules
- Must be necessary and proportionate
- Be accompanied by an independent oversight mechanism
- Permits effective remedies
WP29 has provided further insight into its development of these guarantees in its Working Document 1/2016.
Exceptions for law enforcement and national security
In its Opinion, WP29 applies these newly developed ‘guarantees’ to analyse the circumstances in which the Privacy Shield obligations can be disapplied due to the needs of national security or law enforcement. In applying the guarantees, WP29 underlines the fact that, while exceptions for national security and law enforcement may be permitted, they must still be “justifiable in a democratic society”.
Despite welcoming the advances in transparency and indicating that oversight mechanisms are largely satisfactory, WP29 highlights a number of points in respect of national security.
Firstly, in certain circumstances, non-US-based individuals lack equivalent rights and protection, particularly in the context of Fourth Amendment rights, which prohibit unreasonable searches and seizures and require probable cause for warrants.
Sufficient restrictions on US government surveillance activities do not appear to be envisaged in the Draft.
The Draft also indicates the potential for continuing existence of “massive and indiscriminate” data collection. Sufficient restrictions on US government surveillance activities do not appear to be envisaged in the Draft.
Finally, the existence of effective remedies for individuals remains a concern for WP29, particularly given both a lack of clarity on what situations in which individuals can bring a claim, and questions around the independence of the proposed ombudsperson.
In terms of access to personal data for law enforcement purposes, WP29 welcomes and recognises the effort of US authorities. The investigative tools and limitations and safeguards proposed in the Draft, according to WP29, are both extensive and complex. In particular, WP29 notes the fairly robust oversight mechanism under the Draft.
WP29 does suggest that, despite the availability of no-cost redress mechanisms, there is a need to involve DPAs given individuals’ language barriers and lack of knowledge of the US legal system. However, given the limited information available in the Draft and the fragmented nature of the applicable US laws, procedures and policies, WP29 was unable to provide a comprehensive assessment of the law enforcement guarantees. Despite this, WP29 envisages that a full review of these guarantees might be part of an annual review of the Privacy Shield.
Data processors left in the dark
One of the core issues raised by WP29 relates to the application of the Privacy Shield to US-based data processors.
Under EU data protection law, data processors are entities that act on behalf of and on the instructions of data controllers. Processors are often likened to an agent of the controller. In particular, WP29 points to the fact that the draft text is primarily controller rather than processor focused.
WP29 has pointed to a number of the principles contained in the Privacy Shield, which it believes are unsuitable for data processors. It suggests that specific rules must be provided to address data processors.
Problem principles
As described in our previous post, the Draft includes seven key principles, which reflect similar principles that applied under Safe Harbour. WP29 has reviewed these principles and raised various concerns.
According to WP29, a number of the principles do not adequately address the obligations and requirements arising under EU data protection law. In particular, it has “serious concerns” around the inconsistency in terminology across the principles.
One such issue relates to the potential clash between the principles of purpose limitation and choice. In this respect, WP29 points to the ability for a US-based importer to rely on an opt-out mechanism under the choice principle in order to process data for additional, materially different purposes, which is not adequately defined. This, however, appears to erode the purpose limitation principle which restricts the processing of personal data for new purposes that go beyond the original purposes for which it was collected.
WP29 has highlighted an apparent gap in the Draft regarding the data retention principle, as it does not oblige organisations to delete data
Furthermore, WP29 has particularly highlighted an apparent gap in the Draft regarding the data retention principle, as the Draft does not oblige organisations to delete data if the data is no longer necessary.
Onward transfers
Another concern raised by WP29 relates to ‘onward transfers’ – transfers of personal data from the US-based importer to a third party.
The Privacy Shield is, according to WP29, equally applicable to both initial transfers to the US entity and to onward transfers. However, WP29 has raised national security and law enforcement concerns around onward transfers, particularly highlighting “the risk of unjustified interferences with … fundamental rights”.
Where onward transfers are envisaged, US-based organisations participating in Privacy Shield must assess the third-party recipient’s local laws and confirm that the personal data will be subject to the same level of protection. Despite this, WP29 takes the position that where the EU data controller is aware of the onward transfer before the US transfer takes place, or where the EU controller is jointly responsible for such transfer, it will be considered a direct transfer, meaning that the data is deemed to be transferred directly from the EU entity to the third-party recipient. This means that an alternative transfer condition or mechanism – such as Standard Contractual Clauses – must instead be relied upon.
What comes next for Privacy Shield?
It is worth noting that during its assessment of the Draft, WP29 had the opportunity to meet with the Commission and US representatives. In the course of these meetings, some clarifications were provided, albeit informally. WP29 expects these to be put on a firm footing. Furthermore, WP29 signalled that, in addition to its existing comments and recommendations, it may find further issues with the Draft at a later date.
Strictly speaking, the Opinion cannot halt the progress of the Draft. However, the WP29 members – the DPAs – play an important role in data protection in the EU. Consequently, the Commission may take on board and implement some of the recommendations and suggestions made, with the intention of staving off potential challenges down the line.
Next, a committee made up of representatives from each EU Member State – the Article 31 committee – will consider the Draft. It must be approved by a qualified majority of this committee.
Once the Draft has been through this procedure, the Commission may adopt the decision formally, and it will become effective. Of course, it is always open to the committee or the European Parliament to refer aspects of the Draft to the CJEU for a determination of their compatibility with EU law.
Based on current progress, and in the absence of any significant stumbling blocks, the Privacy Shield could be published by mid-summer. Watch this space.
The content of this article is provided for information purposes only and does not constitute legal or other advice.
Tech Law is a weekly series brought to you by Irish law firm Mason Hayes & Curran, whose legal tech team advises the world’s top social media organisations and emerging start-ups. Check out www.mhc.ie for more.
Want stories like this and more direct to your inbox? Sign up for Tech Trends, Silicon Republic’s weekly digest of need-to-know tech news.
Focus image via Shutterstock
