# L_2019128EN.01004401.xml

| 16.5.2019 | EN | Official Journal of the European Union | L 128/44 |
| --- | --- | --- | --- |

16.5.2019

EN

Official Journal of the European Union

L 128/44

---

DECISION OF THE EEA JOINT COMMITTEE

No 144/2017

of 7 July 2017

amending Annex XI (Electronic communication, audiovisual services and information society) to the EEA Agreement [2019/751]

THE EEA JOINT COMMITTEE,

Having regard to the Agreement on the European Economic Area (‘the EEA Agreement’), and in particular Article 98 thereof,

Whereas:

| (1) | Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (1) is to be incorporated into the EEA Agreement. |
| --- | --- |

(1)

Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (1) is to be incorporated into the EEA Agreement.

| (2) | Annex XI to the EEA Agreement should therefore be amended accordingly, |
| --- | --- |

(2)

Annex XI to the EEA Agreement should therefore be amended accordingly,

HAS ADOPTED THIS DECISION:

Article 1

The following point is inserted after point 5ep (Commission Implementing Decision 2013/65/EU) of Annex XI to the EEA Agreement:

| ‘5eq. | 32016 D 12 50: Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (OJ L 207, 1.8.2016, p. 1).’ |
| --- | --- |

‘5eq.

32016 D 12 50: Commission Implementing Decision (EU) 2016/1250 of 12 July 2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (OJ L 207, 1.8.2016, p. 1).’

Article 2

The text of Implementing Decision (EU) 2016/1250 in the Icelandic and Norwegian languages, to be published in the EEA Supplement to the Official Journal of the European Union, shall be authentic.

Article 3

This Decision shall enter into force on 8 July 2017, provided that all the notifications under Article 103(1) of the EEA Agreement have been made (*1).

Article 4

This Decision shall be published in the EEA Section of, and in the EEA Supplement to, the Official Journal of the European Union.

Done at Brussels, 7 July 2017.

For the EEA Joint Committee

The President

Sabine MONAUNI

---

(1)  
  OJ L 207, 1.8.2016, p. 1.

1

(*1)  No constitutional requirements indicated.

*1

---

Joint Declaration by the Contracting Parties to Decision No 144/2017 incorporating Commission Implementing Decision (EU) 2016/1250 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield into the Agreement

Implementing Decision (EU) 2016/1250 provides that, as regards the processing of human resources data collected in the context of an employment relationship or when an organisation has voluntarily submitted to oversight by Data Protection Authorities (DPAs), organisations certified under the EU-U.S. Privacy Shield will comply with advice given by the European DPAs. This advice will be given through an informal panel of DPAs established at Union level by the DPAs based on their competence to organise their work and cooperate among each other.

As regards cases that would fall under the competence of the United States’ Privacy Shield Ombudsperson, individual complaints and further communications will be channelled through a centralised EU individual complaint handling body which will be composed of Union DPAs.

The Contracting Parties understand that the participation of DPAs in such bodies is necessary to respect these authorities’ competence to hear claims lodged by any person concerning the protection of their rights and freedoms with regard to the processing of personal data and to exercise the investigative and intervention powers endowed to them by Directive 95/46/EC.

Directive 95/46/EC has been incorporated into the EEA Agreement, and therefore the EFTA States are under an obligation to guarantee the full exercise of supervisory powers by their DPA, including as regards transfers of personal data to third countries. The Contracting Parties understand that the EFTA States’ DPAs should be able to participate in the informal panel of DPAs and the EU individual complaint handling body as referred to in the EU-U.S. Privacy Shield to ensure the convergence of supervisory practices and the homogeneous protection of individuals’ rights and freedoms throughout the EEA.

Under the terms of Implementing Decision (EU) 2016/1250, EU data subjects will have access to a recourse mechanism of last resort, the Privacy Shield Panel, as regards residual claims that have not been resolved through consultation with the concerned organisation or through involvement of their DPA or of the United States’ Department of Commerce. The Privacy Shield Panel will be composed of arbitrators selected by the parties from a list developed by the European Commission and the U.S. Department of Commerce.

The Contracting Parties understand that the Commission will consult the EFTA States as regards the composition of the list of arbitrators, and take the EFTA States’ opinion into account, prior to the designation of these arbitrators.

---