REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL

on the first annual review of the functioning of the EU–U.S. Privacy Shield

1.THE FIRST ANNUAL REVIEW – PURPOSE, PREPARATION AND PROCESS

In its Decision of 12 July 2016 (“the adequacy decision”), the Commission found that the EU-U.S. Privacy Shield (“Privacy Shield”) ensures an adequate level of protection for personal data that has been transferred from the European Union to organisations in the U.S.

The Privacy Shield reflects the principles and requirements laid down by the European Court of Justice in its decision in the Schrems case, which invalidated the previous Safe Harbour framework. It provides for a number of novel elements, compared to Safe Harbour, which enhance the protection of personal data when it is transferred to the United States. This includes stricter obligations on Privacy Shield-certified companies, for example regarding limitations on how long a company may retain personal data (so-called “data retention” principle) or the conditions under which data can be shared with third parties outside the framework (so-called “accountability for onward transfers” principle). It also provides for more regular and rigorous monitoring by the Department of Commerce (DoC) and significantly strengthens the possibilities for EU individuals to obtain redress. In addition, the Privacy Shield builds on specific written representations and assurances made by the U.S. government that access by public authorities to personal data transferred under the Privacy Shield for national security, law enforcement and other public interest purposes is subject to clear limitations and safeguards. To this end, it also creates an entirely new redress mechanism, the Ombudsperson.

The Commission committed to evaluate its adequacy finding on an annual basis, and, to this end, conducts an annual review of the functioning of the Privacy Shield. The first annual review of the functioning of the Privacy Shield is concluded with the present report. The review covered all aspects of the Privacy Shield, i.e. the implementation, administration, supervision and enforcement of the Privacy Shield framework by the competent U.S. authorities and bodies as well as questions relating to the access by U.S. public authorities to personal data transferred under the Privacy Shield for public interest purposes, in particular national security. It also included a dialogue on the specific topic of automated decision-making and an assessment of developments in the U.S. legal system over the past year which could have an impact on the functioning of the Privacy Shield.

The Privacy Shield framework has been operational since 1 August 2016. Taking into account that this has been the first year of its operation, the Commission’s annual review has focused on verifying that all the mechanisms and procedures provided for in the framework – many of which were newly created – have been fully implemented and are functioning in the way that is foreseen in the adequacy decision. Moreover, the Commission has put particular emphasis on checking whether and how the various U.S. authorities involved in the implementation of the framework have lived up to their representations and commitments, both as regards the administration and supervision of the commercial aspects of the Privacy Shield, and with respect to government access to personal data. The change of the U.S. administration in January 2017 made this particularly relevant.

In preparation of the annual review, the Commission gathered information and feedback on the implementation and functioning of the Privacy Shield framework from relevant stakeholders, more specifically from Privacy Shield-certified companies through their respective trade associations, and from non-governmental organisations (NGOs) active in the field of fundamental rights and in particular digital rights and privacy. It also sought and obtained written information from the U.S. authorities involved in the implementation of the framework, including relevant documents and material.

The first Annual Joint Review took place on 18 and 19 September 2017 in Washington, DC. It was opened by Commissioner for Justice, Consumers and Gender Equality, Věra Jourová, and U.S. Secretary of Commerce Wilbur Ross. The annual review was conducted for the EU by representatives of the European Commission’s Directorate General for Justice and Consumers. The EU delegation also included eight representatives designated by the Article 29 Working Party, the advisory body bringing together the national data protection authorities of the Member States (DPAs) as well as the European Data Protection Supervisor.

On the U.S. side, representatives of the DoC, the Federal Trade Commission (FTC), the Department of Transportation, the Department of State, the Office of the Director of National Intelligence and the Department of Justice participated in the review, as well as the acting Ombudsperson, a Member of the Privacy and Civil Liberties Oversight Board (PCLOB) and the Office of the Inspector General of the Intelligence Community. Moreover, representatives of organisations that offer independent dispute resolution under the Privacy Shield, the American Arbitration Association as administrator of the Privacy Shield Arbitration Panel and some Privacy Shield-certified companies provided input during the annual review.

The annual review has further been informed by publicly available material, such as court decisions, implementing rules and procedures of relevant U.S. authorities, reports and studies from NGOs, transparency reports issued by Privacy Shield-certified companies, press articles and other media reports.

2.FINDINGS, CONCLUSIONS AND RECOMMENDATIONS

The annual review has demonstrated that the U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield. The certification process has been handled in an overall satisfactory manner and more than 2400 companies have been certified so far. The U.S. authorities have put in place the complaint-handling and enforcement mechanisms and procedures to safeguard individual rights. This includes also the new additional redress avenues for EU individuals such as the arbitration panel and the Ombudsperson mechanism. Regarding the latter, an Acting Ombudsperson was designated following the change of Administration in January 2017, whereas the nomination of a permanent Ombudsperson is pending. Cooperation with European data protection authorities has been stepped up. As regards access to personal data by public authorities for national security purposes, relevant safeguards on the U.S. side remain in place, notably those based on Presidential Policy Directive 28 issued in 2014 which sets out limitations and safeguards on use by national security authorities of personal data, regardless of nationality of the individual. In this context, it should also be noted that section 702 of the U.S. Foreign Intelligence Surveillance Act (FISA) is set to expire on 31 December 2017 and that reform proposals are under discussion in the U.S. Congress.

The detailed factual findings concerning the functioning of all aspects of the Privacy Shield framework after its first year of operation are presented in the Commission Staff Working Document on the annual review of the functioning of the EU–U.S. Privacy Shield (SWD(2017) 344 final) which accompanies the present report.