EUROPEAN
COMMISSION

Brussels, 19.12.2018
COM(2018) 860 final

REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND
THE COUNCIL
on the second annual review of the functioning of the EU-U.S. Privacy Shield{SWD(2018) 497 final}

ENEN

1. THE SECOND ANNUAL REVIEW – PURPOSE, PREPARATION AND PROCESSOn 12 July 2016, the Commission adopted a Decision (the “adequacy decision”) in which it
found that the EU-U.S. Privacy Shield (the “Privacy Shield”) ensures an adequate level ofprotection for personal data that has been transferred from the EU to organisations in the U.S.1
The adequacy decision notably provides for an annual evaluation of all aspects of thefunctioning of the framework by the Commission. The first annual review took place on 18and 19 September 2017 in Washington, D.C., and on 18 October 2017 the Commission
adopted its report to the European Parliament and the Council, 2 accompanied by aCommission Staff Working Document (SWD(2017)344 final).3
On the basis of its findings from the first review, the Commission concluded that the U.S.
continued to ensure an adequate level of protection for personal data transferred under thePrivacy Shield from the Union to organisations in the U.S. At the same time, the Commission
considered that the practical implementation of the Privacy Shield framework could be further
improved in order to ensure that the guarantees and safeguards provided therein continued tofunction as intended. To this end, the Commission made ten recommendations.
The present report concludes the second annual review of the functioning of the Privacy
Shield. This report, as well as the accompanying Staff Working Document (SWD(2018) 497),
follow the same structure as the report on the first annual review. They cover all aspects of thefunctioning of the Privacy Shield, also in light of developments that took place during the lastyear. A central element of the Commission's assessment was the implementation of its
recommendations from the first annual review.
In preparation for the second annual review, the Commission gathered information fromrelevant stakeholders (in particular Privacy Shield-certified companies, through theirrespective trade associations, and non-governmental organisations (NGOs) active in the fieldof fundamental rights, in particular digital rights and privacy), as well as from the relevantU.S. authorities involved in the implementation of the framework.
The second annual review meeting took place in Brussels on 18 and 19 October 2018. Thereview was opened by the Commissioner for Justice, Consumers and Gender Equality VěraJourová, U.S. Secretary of Commerce Wilbur Ross, the Chairman of the Federal Trade
Commission Joseph Simons and the Chair of the European Data Protection Board AndreaJelinek. It was conducted for the EU by representatives of the European Commission’s
Directorate General for Justice and Consumers. The EU delegation also included seven
1Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of theEuropean Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy
Shield, OJ L 2017, 1.8.2016, p. 1
2
Report from the Commission to the European Parliament and the Council on the first annual review of thefunctioning of the EU-U.S. Privacy Shield (COM(2017611 final, see http://ec.europa.eu/newsroom/just/itemdetail.cfm?item_id=605619
3
Commission Staff Working Document Accompanying the Report from the Commission to the EuropeanParliament and the Council on the first annual review of the functioning of the EU-U.S. Privacy Shield(SWD(2017)344 final), see http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=605619

1representatives designated by the European Data Protection Board (the independent bodybringing together representatives of the national data protection authorities of the EU Member
States and the European Data Protection Supervisor).
On the U.S. side, representatives from the Department of Commerce, the Department of State,
the Federal Trade Commission , the Department of Transportation, the Office of the Directorof National Intelligence, the Department of Justice and members of the Privacy and Civil
Liberties Oversight Board participated in the review, as well as the acting Ombudsperson andthe Inspector General for the Intelligence Community. In addition, representatives from anorganisation that offers independent dispute resolution services under the Privacy Shield andthe American Arbitration Association provided information during the relevant review
sessions. Finally, the review was informed by presentations from Privacy Shield-certified
organisations on how companies comply with the requirements of the framework.
The Commission’s findings have further been informed by a study commissioned by theCommission and publicly available material, such as court decisions, implementing rules andprocedures of relevant U.S. authorities, reports and studies from non-governmentalorganisations, transparency reports issued by Privacy Shield-certified companies, annual
reports from independent recourse mechanisms, as well as media reports.
This year’s review took place in the context of the challenges to data privacy that areincreasingly global in nature, as exemplified by the Facebook / Cambridge Analytica case.
Both the EU and the U.S. are aware of the similar challenges they face when it comes toprotection of personal data. During the review, both sides stressed the need to address suchabuses of personal data, including through the vigorous enforcement actions by the EU’s Data
Protection Authority and the U.S. Federal Trade Commission.
The Commission’s report also reflects the ongoing debate about federal privacy legislation in
the U.S. The convergence between our two systems in the long term would strengthen thefoundations on which the Privacy Shield framework has been developed.
2. FINDINGS AND CONCLUSION
The second annual review covered both the “commercial aspects” of the Privacy Shieldframework and issues relating to government access to personal data.
As regards the “commercial aspects”, i.e. questions concerning the administration, oversightand enforcement of the obligations applying to certified companies, the Commission notedthat in line with the Commission's recommendations from the first annual review, theDepartment of Commerce has further strengthened the certification process and introduced
new oversight procedures. In particular, the Department of Commerce adopted a new processthat requires first-time applicants to delay public representations regarding their Privacy
Shield participation until their certification review is finalised by the Department ofCommerce. Moreover, the Department of Commerce has introduced new mechanisms to2

detect potential compliance issues, such as random spot-checks (at the time of the annualreview, such spot checks had been performed on about 100 organisations) and the monitoringof public reports about the privacy practices of Privacy Shield participants. In the search for
false claims of participation in the framework, the Department of Commerce is now actively
using a variety of tools, for instance a quarterly review of companies that have been identified
as more likely to make false claims and a system for image and text searches on the internet.
As a result of these newly introduced practices and procedures, the Department of Commercesince the first annual review has referred more than 50 cases to the Federal TradeCommission, which in turn took enforcement action in those cases where the referral as such
was not sufficient in order to make the company concerned come into compliance.
With respect to enforcement, the Commission noted that the Federal Trade Commission, as
part of its efforts to proactively monitor compliance with the Privacy Shield Principles,
recently issued administrative subpoenas to request information from a number of Privacy
Shield participants. The Federal Trade Commission has also confirmed that its investigation
into the Facebook / Cambridge Analytica case is ongoing. Although the Commission
considers that the Federal Trade Commission's new, more proactive approach to compliancemonitoring is an important development, it regrets that at this stage it was not possible for toprovide further information on its recent investigations and will closely monitor any furtherdevelopments in this regard.
The second annual review also took into account relevant developments in the U.S. legalsystem in the area of privacy. These concern, in particular, the consultation initiated by theDepartment of Commerce on a federal approach to data privacy as well as the Federal Trade
Commission’s process of reflection on its current powers in the area of privacy and theefficacy of the use of its current remedial authority.
As the Facebook/Cambridge Analytica case and other revelations have shown, it would be
important that the EU and the U.S. further converge in their responses. In this spirit, theCommission has observed the abovementioned initiatives with great interest and has
contributed to the Department of Commerce’s consultation process with a written
submission4.
Regarding aspects relating to access and use of personal data by U.S. public authorities, thesecond annual review focused on relevant developments in the U.S. legal framework,
including with regard to relevant agency policies and procedures, on recent trends insurveillance activities, and on developments in the setup and functioning of important
oversight and redress mechanisms.
The most important legal development in the area of government access was thereauthorisation of Section 702 of the Foreign Intelligence Surveillance Act (“the Act”) at thebeginning of 2018. While the reauthorisation did not lead to the incorporation of theprotections of Presidential Policy Directive 28 into the Act, as had been suggested by the4

Available athttps://ec.europa.eu/info/sites/info/files/european_commission_submission_on_a_proposed_approach_to_consu
mer_privacy.pdf

3Commission, neither did it restrict any of the safeguards contained in the Act which were inplace when the Privacy Shield decision was adopted. Moreover, the amendments did not
expand the powers of the U.S. Intelligence Community to acquire foreign intelligence
information by targeting non-U.S. persons under Section 702. Instead, the Amendments
Reauthorization Act of 2017, which amends the Foreign Intelligence Surveillance Act of1978, introduced some limited additional privacy safeguards, for instance in the area oftransparency.
There have also been important developments concerning the Privacy and Civil Liberties
Oversight Board which, at the time of the first annual review, had only one Board member
left. The Commission had therefore recommended the swift appointment of the missing Board
members. On 11 October 2018, the U.S. Senate confirmed the nominations of the Chairmanof the Privacy and Civil Liberties Oversight Board as well as of two other members of theBoard, thereby reinstalling the Board to its full quorum and allowing it to exercise all its
functions. After the first annual review, the Commission had also recommended the public
release of the Board’s report on Presidential Policy Directive 28. The report was released on
16 October 20185 and confirms that Presidential Policy Directive 28 is fully applied across theIntelligence Community. In particular, it confirms that further to the issuance of Presidential
Policy Directive 28, the relevant elements of the Intelligence Community have adopted
detailed rules on the implementation of that Directive and have changed their practices inorder to bring them in line with the requirements of Presidential Policy Directive 28.
Finally, although the Commission had recommended the swift appointment of the Privacy
Shield Ombudsperson, the position of Under-Secretary in the State Department to whom theoffice of the Ombudsperson has been assigned had not yet been filled by a permanent
appointment at the time of the present report. In that regard, the Commission took note of thefact that at the second annual review, the U.S. government recognised the need for prompt
progress on nominating a permanent Under Secretary and confirmed that this process is wellunderway.
At the time of the present report, the Ombudsperson mechanism had not yet received anyrequests. However, a complaint to the Ombudsperson had been submitted to the Croatian dataprotection authority and the relevant checks were ongoing.
The detailed findings concerning the functioning of all aspects of the Privacy Shieldframework after its second year of operation are presented in the Commission Staff Working
Document on the second annual review of the functioning of the EU-U.S. Privacy Shield(SWD(2018) 497) which accompanies the present report.
The information gathered in the context of the second annual review confirms theCommission’s findings in the adequacy decision, both with regard to the “commercialaspects” of the framework and aspects relating to access to personal data transferred under thePrivacy Shield by the U.S. authorities.
5Report to the President on “the Implementation of Presidential Policy Directive 28: Signals IntelligenceActivities”, available at https://www.pclob.gov/reports/report-PPD28/

4

On the basis of these findings, the Commission concludes that the United States continues toensure an adequate level of protection for personal data transferred under the Privacy
Shieldfrom the Union to organisations in the United States.
In particular, the steps taken to implement the Commission's recommendations following thefirst annual review have improved several aspects of the practical functioning of theframework in order to ensure that the level of protection of natural persons guaranteed by theadequacy decision is not undermined.
However, some of these steps have been taken only recently and the relevant processes arestill ongoing. Any further developments concerning these processes therefore need to beclosely monitored, in particular as they affect elements that are essential for the continuity of
the adequacy finding. This concerns notably:
1. The effectiveness of the mechanisms introduced by the Department of Commerce inthe second year of operation of the framework to proactively monitor compliance bycertified companies with the Privacy Shield Principles, in particular compliance withsubstantive requirements and obligations.
2. The effectiveness of the tools introduced by the Department of Commerce since thefirst annual review to detect false claims of participation in the framework, with aparticular focus on the search of false claims by companies that have never applied forcertification.
3. The progress and outcome of ex-officio sweeps carried out by the Federal Trade
Commission in the second year of operation of the Privacy Shield by means ofadministrative subpoenas to detect substantive violations of the Privacy Shield.
4. The development of additional guidance jointly by the Department of Commerce,
Federal Trade Commission and EU data protection authorities on elements that require
further clarification (e.g. HR data).
5. The appointment of a permanent Privacy Shield Ombudsperson.
6. The effectiveness of the handling and resolution of complaints by the Ombudsperson.

In particular, the Commission reiterates its call on the U.S. administration to confirm its
political commitment to the Ombudsperson mechanism by appointing a permanent Privacy
Shield Ombudsperson as a matter of priority. The Ombudsperson mechanism is an importantelement of the Privacy Shield framework and, while the acting Ombudsperson continues tocarry out the relevant functions, the absence of a permanent appointee is highly unsatisfactoryand should be remedied as soon as possible. The Commission expects the U.S. government toidentify a nominee to fill the Ombudsperson position on a permanent basis by 28 February
2019 and inform the Commission about the nominated individual. If this does not take place5

by that date, the Commission will then consider taking appropriate measures, in accordancewith the General Data Protection Regulation 6 . The Commission also expects to receive
precise and detailed information on all of the abovementioned aspects in order to be able toassess whether the steps taken are effective in practice.
Finally, the Commission will continue to closely follow the ongoing debate about the federal
privacy legislation in the U.S. Given the significance of transatlantic data flows, theCommission encourages the U.S. to adopt a comprehensive system of privacy and dataprotection and to become a Party to the Council of Europe’s Convention 108. It is throughsuch comprehensive approach that convergence between our two systems can be achieved in
the longer term, which would also strengthen the foundations on which the Privacy Shieldframework has been developed.

6Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection ofnatural persons with regard to the processing of personal data and on the free movement of such data, andrepealing Directive 95/46/EC (General Data Protection Regulation)

6