It may be a brand new day (and a whole new month), but Privacy Shield’s fate seems to be the same as ever: Uncertain.
Created to replace the old Safe Harbor agreement, which was ruled invalid last October, EU and US regulators are trying to smooth over the differences between the US and EU’s different treatment of data. With the commission required to provide the full agreement by the end of February, they snuck in just under the wire, with a little help from leap day.
Supporters argue that the new privacy shield comes a lot more specific oversight than its predecessor, but many are worried that it’s still not going to be enough.
Yesterday’s leap day announcement involved the European Commission finally publishing the written promises of the U.S., along with the draft “adequacy decision,” or the legal instrument by which the Privacy Shield provisions will be declared equivalent to current EU law. Included under the new specifics of the Privacy Shield:
- Clear system of transparency and checks and balances on the part of the government: U.S. intelligence services will adhere to new limits and oversight mechanisms when using EU data. In a statement, the European Commission even stated that “for the first time, the U.S. government has given the EU written assurance from the Office of the Director of National Intelligence that any access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms.”
- Clear pathways for EU citizens to redress: EU citizens who feel their data has been compromised in some way will have several avenues to pursue help. The State Department will enact an ombudsman position (which will apparently be independent of national security services) to follow up on written complaints and enquiries by individuals and inform them of whether the laws have been complied with. Citizens can also go to local data protection authorities who will work with the FTC to ensure a response.
- Clear conditions on the part of companies in the U.S.: These rules also include stronger obligations for U.S. companies that wish to handle EU data. If companies wish to handle data of EU citizens in the U.S., they’ll need to sign up for the Privacy Shield register, which the Department of Commerce must monitor and ensure all privacy policies on the Privacy Shield meet the standards in the agreement. Companies will also be expected to be more conscious of the amount of data they’re collecting (in addition to where that data is going). Complaints made by EU citizens must be resolved within 45 days by companies, and there will be free-of-charge Alternative Dispute Resolution solution made available.
- Clear expectations of system review: A joint review will happen annually, where both the European Commission and the U.S. Department of Commerce sides will monitor the functioning of the Privacy Shield, including “commitments and assurance as regards access to data for law enforcement and national security purposes.” The European Commission will also issue a public report to the European Parliament and the Council about the broader developments in the area of U.S. privacy law, and their impact on Europeans.
It’s attacking the problem on a lot of fronts: When the Safe Harbor agreement was invalidated last fall, one of the main issues people had with it was the way it exposed the data of EU citizens to access by the U.S. government, specifically noting that amidst the mass and indiscriminate surveillance had no independent authority able to monitor breaches of the Safe Harbor principles. Now, the Privacy Shield is aiming to step in and restore some checks, balances, and transparency to the whole process.
“The EU-U.S. Privacy Shield is a strong new framework, based on robust enforcement and monitoring, easier redress for individuals and, for the first time, written assurance from our U.S. partners on the limitations and safeguards regarding access to data by public authorities on national security grounds,” said Vera Jourová, the EU’s justice chief, who was among the most measured in her statements.
But some aren’t so sure. From here, the proposal will face a committee comprising representatives of the 28 EU member states and the Article 29 Working Party, the body through which the EU’s data protection authorities work together, who will examine the legal text. And it is by no means a done deal.
The draft adequacy decision is still open to challenge by both the governments and the data protection authorities of the EU’s 28 states. And even if it were enacted (regulators are hoping to have it on the books sometime around June or early summer) the annual review means all parties will analyze whether the principles are still being respected and if they aren’t it could, in theory, be suspended. The question as it stands now is, does the text go far enough in protecting the information of Europeans from the prying eyes of U.S. industry and government? So far the answer among many privacy advocates, including Max Schrems, whose court case set off the Safe Harbor invalidation, is a no, as TechCrunch writes:
…while [Schrems] conceded the text contains “a large number of new improvements”, vis-a-vis EU-US data transfers, he argued it does not address the “core concerns and fundamental flaws of US surveillance law and the lack of privacy protections under US law” — and is therefore vulnerable to future legal challenges.
Schrems notes, for example, that a page from one of the documents published today sets out six exceptions where the US can still collect data “in bulk” — namely: detecting and countering certain activities of foreign powers; counterterrorism; counter-proliferation; cybersecurity; detecting and countering threats to U.S. or allied armed forces; and combating transnational criminal threats, including sanctions evasion — going on to argue the ECJ ruling made it clear that no such bulk-based surveillance activity is acceptable under European privacy law.
“The Court held that any form of ‘mass surveillance’ of content data violates the EU’s Charter of Fundamental Rights and that a country has to provide ‘essentially equivalent’ protections to EU law in the public and private sector,” Schrems writes.
And of course, there’s already plenty of talk of what would happen if the Privacy Shield found itself in front of the European Court of Justice like the Safe Harbor did.
So where does that leave businesses? Potentially with a lot more headaches, whether or not the Privacy Shield passes muster. As Jeffrey L. Nagel writes for E-Discovery Law Alert, it’s not exactly smooth sailing anyway you cut it:
There are simply fundamental differences between how the EU and the U.S. view and treat personal data – how it is tracked, maintained, shared, transferred, erased, and subject to surveillance based on security concerns – and those differences cannot be papered-over with press-releases, frameworks, or inter-governmental agreements that, at bottom, fail to address the hard choices that must be made and enormous burdens required for balancing privacy and security in the digital age. At best these safeguards are band-aids, and numerous privacy groups and individual citizens will continue to challenge them because at their heart they cannot really guarantee that an individual’s information is both secure and private. The EU and U.S. need to agree at a more fundamental level about how much of one’s privacy can and should be sacrificed in order for commerce to function, for security to be adequate, and for the world to be digitally connected. Until the EU and U.S. have a shared perspective about those questions, no framework will be safe.
As always cross-Atlantic data transfers relief may just be on the horizon. Or, it could be utterly unpredictable.