On April 13, 2016, the body of European Data Protection Authorities (DPAs)—the “Article 29 Working Party” (WP29)—issued its opinion on the new EU-U.S. Privacy Shield. The WP29 acknowledged that progress has been made with the Privacy Shield, but called for several significant changes to the shield before it can be found to provide protection that is “essentially equivalent” to EU data protection law. Importantly, the WP29 also concluded that it will not examine the validity of EU Model Contracts and Binding Corporate Rules (BCRs) until after an adequacy determination has been made regarding the Privacy Shield. Those data transfer mechanisms remain valid for now.
The WP29 opinion is not legally binding, but its issuance is a key step on the road to formal adoption of the Privacy Shield. The opinion holds important political value, as it gives an indication as to how DPAs would evaluate data transfers made under the Privacy Shield. If ultimately approved by the EU Commission, the Privacy Shield will provide a legal basis for data transfers from the EU to the U.S.
Click here to read our complete WSGR Alert examining the WP29 opinion.