REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the second annual review of the functioning of the EU-U.S. Privacy Shield
Date: 2018-12-19
Institutions: Directorate-General for Justice and Consumers, European Commission
Subjects: United States, cross-frontier data flow, data protection, data-processing law, exchange of information, human rights, personal data, protection of privacy

EN 

  EN 

   EUROPEAN COMMISSION  Brussels, 19.12.2018  COM(2018) 860 final  REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the second annual review of the functioning of the EU-U.S. Privacy Shield {SWD(2018) 497 final}  
 
 
1.  THE SECOND ANNUAL REVIEW – PURPOSE, PREPARATION AND PROCESS 

On 12 July 2016, the Commission adopted a Decision (the “adequacy decision”) in which  it 
found  that  the  EU-U.S.  Privacy  Shield  (the  “Privacy  Shield”)  ensures  an  adequate  level  of 
protection for personal data that has been transferred from the EU to organisations in the U.S.1 
The  adequacy  decision  notably  provides  for  an  annual  evaluation  of  all  aspects  of  the 
functioning of the framework by the Commission. The first annual review took place on 18 
and  19  September  2017  in  Washington,  D.C.,  and  on  18  October  2017  the  Commission 
adopted  its  report  to  the  European  Parliament  and  the  Council, 2  accompanied  by  a 
Commission Staff Working Document (SWD(2017)344 final).3  

On  the  basis  of  its  findings  from  the  first  review,  the  Commission  concluded  that  the  U.S. 
continued  to  ensure  an  adequate  level  of  protection  for  personal  data  transferred  under  the 
Privacy Shield from the Union to organisations in the U.S. At the same time, the Commission 
considered that the practical implementation of the Privacy Shield framework could be further 
improved in order to ensure that the guarantees and safeguards provided therein continued to 
function as intended. To this end, the Commission made ten recommendations. 

The  present  report  concludes  the  second  annual  review  of  the  functioning  of  the  Privacy 
Shield. This report, as well as the accompanying Staff Working Document (SWD(2018) 497), 
follow the same structure as the report on the first annual review. They cover all aspects of the 
functioning of the Privacy Shield, also in light of developments that took place during the last 
year.  A  central  element  of  the  Commission's  assessment  was  the  implementation  of  its 
recommendations from the first annual review. 

In  preparation  for  the  second  annual  review,  the  Commission  gathered  information  from 
relevant  stakeholders  (in  particular  Privacy  Shield-certified  companies,  through  their 
respective trade associations, and non-governmental organisations (NGOs) active in the field 
of  fundamental  rights,  in  particular  digital  rights  and  privacy),  as  well  as  from  the  relevant 
U.S. authorities involved in the implementation of the framework. 

The  second  annual  review  meeting  took  place  in  Brussels  on  18  and  19 October  2018.  The 
review  was opened by the Commissioner for Justice, Consumers and  Gender Equality  Věra 
Jourová,  U.S.  Secretary  of  Commerce  Wilbur  Ross,  the  Chairman  of  the  Federal  Trade 
Commission  Joseph  Simons  and  the  Chair  of  the  European  Data  Protection  Board  Andrea 
Jelinek.  It  was  conducted  for  the  EU  by  representatives  of  the  European  Commission’s 
Directorate  General  for  Justice  and  Consumers.  The  EU  delegation  also  included  seven 

1 Commission  Implementing  Decision  (EU)  2016/1250  of 12 July  2016  pursuant  to  Directive  95/46/EC  of  the 
European  Parliament  and  of  the  Council  on  the  adequacy  of  the  protection  provided  by  the  EU-U.S.  Privacy 
Shield, OJ L 2017, 1.8.2016, p. 1 
2 Report  from  the  Commission  to  the  European  Parliament  and  the  Council  on  the  first  annual  review  of  the 
functioning  of  the  EU-U.S.  Privacy  Shield  (COM(2017611  final,  see  http://ec.europa.eu/newsroom/just/item-
detail.cfm?item_id=605619 
3 Commission  Staff  Working  Document  Accompanying  the  Report  from  the  Commission  to  the  European 
Parliament  and  the  Council  on  the  first  annual  review  of  the  functioning  of  the  EU-U.S.  Privacy  Shield 
(SWD(2017)344 final), see http://ec.europa.eu/newsroom/just/item-detail.cfm?item_id=605619 

1 

 
 
 
 
                                                           
representatives  designated  by  the  European  Data  Protection  Board  (the  independent  body 
bringing together representatives of the national data protection authorities of the EU Member 
States and the European Data Protection Supervisor). 

On the U.S. side, representatives from the Department of Commerce, the Department of State, 
the Federal Trade Commission , the Department of Transportation, the Office of the Director 
of  National  Intelligence,  the  Department  of  Justice  and  members  of  the  Privacy  and  Civil 
Liberties Oversight Board  participated in the review, as well as the acting Ombudsperson and 
the  Inspector  General  for  the  Intelligence  Community.  In  addition,  representatives  from  an 
organisation that offers independent dispute resolution services under the Privacy Shield and 
the  American  Arbitration  Association  provided  information  during  the  relevant  review 
sessions.  Finally,  the  review  was  informed  by  presentations  from  Privacy  Shield-certified 
organisations on how companies comply with the requirements of the framework.  

The  Commission’s  findings  have  further  been  informed  by  a  study  commissioned  by  the 
Commission and publicly available material, such as court decisions, implementing rules and 
procedures  of  relevant  U.S.  authorities,  reports  and  studies  from  non-governmental 
organisations,  transparency  reports  issued  by  Privacy  Shield-certified  companies,  annual 
reports from independent recourse mechanisms, as well as media reports. 

This  year’s  review  took  place  in  the  context  of  the  challenges  to  data  privacy  that  are 
increasingly  global  in  nature,  as  exemplified  by  the  Facebook  /  Cambridge  Analytica  case. 
Both  the  EU  and  the  U.S.  are  aware  of  the  similar  challenges  they  face  when  it  comes  to 
protection of personal  data. During the review,  both  sides stressed the need to  address  such 
abuses of personal data, including through the vigorous enforcement actions by the EU’s Data 
Protection Authority and the U.S. Federal Trade Commission.  

The Commission’s report also reflects the ongoing debate about federal privacy legislation in 
the  U.S.  The  convergence  between  our  two  systems  in  the  long  term  would  strengthen  the 
foundations on which the Privacy Shield framework has been developed. 

2.  FINDINGS AND CONCLUSION 

The  second  annual  review  covered  both  the  “commercial  aspects”  of  the  Privacy  Shield 
framework and issues relating to government access to personal data.  

As regards the “commercial aspects”, i.e. questions concerning the administration, oversight 
and  enforcement  of  the  obligations  applying  to  certified  companies,  the  Commission  noted 
that  in  line  with  the  Commission's  recommendations  from  the  first  annual  review,  the 
Department  of  Commerce  has  further  strengthened  the  certification  process  and  introduced 
new oversight procedures. In particular, the Department of Commerce adopted a new process 
that  requires  first-time  applicants  to  delay  public  representations  regarding  their  Privacy 
Shield  participation  until  their  certification  review  is  finalised  by  the  Department  of 
Commerce.  Moreover,  the  Department  of  Commerce  has  introduced  new  mechanisms  to 

2 

 
 
 
 
 
 
 
detect  potential  compliance  issues,  such  as  random  spot-checks  (at  the  time  of  the  annual 
review, such spot checks had been performed on about 100 organisations) and the monitoring 
of public reports about the privacy practices of Privacy Shield participants. In the search for 
false claims of participation in the framework, the Department of Commerce is now actively 
using a variety of tools, for instance a quarterly review of companies that have been identified 
as more likely to make false claims and a system for image and text searches on the internet. 
As a result of these newly introduced practices and procedures, the Department of Commerce 
since  the  first  annual  review  has  referred  more  than  50  cases  to  the  Federal  Trade 
Commission, which in turn took enforcement action in those cases where the referral as such 
was not sufficient in order to make the company concerned come into compliance.  

With respect  to  enforcement, the Commission  noted that the Federal  Trade Commission,  as 
part  of  its  efforts  to  proactively  monitor  compliance  with  the  Privacy  Shield  Principles, 
recently  issued  administrative  subpoenas  to  request  information  from  a  number  of  Privacy 
Shield participants. The Federal Trade Commission has also confirmed that its investigation 
into  the  Facebook  /  Cambridge  Analytica  case  is  ongoing.  Although  the  Commission 
considers that the Federal Trade Commission's new, more proactive approach  to compliance 
monitoring is an important development, it regrets that at this stage it was not possible for to 
provide further information on its recent  investigations and will closely  monitor any further 
developments in this regard. 

The  second  annual  review  also  took  into  account  relevant  developments  in  the  U.S.  legal 
system  in  the  area  of  privacy.  These  concern,  in  particular,  the  consultation  initiated  by  the 
Department of Commerce on a federal approach to data privacy as well as the Federal Trade 
Commission’s  process  of  reflection  on  its  current  powers  in  the  area  of  privacy  and  the 
efficacy of the use of its current remedial authority.  

As  the  Facebook/Cambridge  Analytica  case  and  other  revelations  have  shown,  it  would  be 
important  that  the  EU  and  the  U.S.  further  converge  in  their  responses.  In  this  spirit,  the 
Commission  has  observed  the  abovementioned  initiatives  with  great  interest  and  has 
contributed  to  the  Department  of  Commerce’s  consultation  process  with  a  written 
submission4. 

Regarding aspects relating to access and use of personal data by U.S. public authorities, the 
second  annual  review  focused  on  relevant  developments  in  the  U.S.  legal  framework, 
including  with  regard  to  relevant  agency  policies  and  procedures,  on  recent  trends  in 
surveillance  activities,  and  on  developments  in  the  setup  and  functioning  of  important 
oversight and redress mechanisms.  

The  most  important  legal  development  in  the  area  of  government  access  was  the 
reauthorisation of Section 702 of the Foreign Intelligence Surveillance Act  (“the Act”) at the 
beginning  of  2018.  While  the  reauthorisation  did  not  lead  to  the  incorporation  of  the 
protections  of  Presidential  Policy  Directive  28  into  the  Act,  as  had  been  suggested  by  the 

4 Available at 
https://ec.europa.eu/info/sites/info/files/european_commission_submission_on_a_proposed_approach_to_consu
mer_privacy.pdf 

3 

 
 
                                                           
Commission, neither did it restrict any of the safeguards contained in the Act which were in 
place  when  the  Privacy  Shield  decision  was  adopted.  Moreover,  the  amendments  did  not 
expand  the  powers  of  the  U.S.  Intelligence  Community  to  acquire  foreign  intelligence 
information  by  targeting  non-U.S.  persons  under  Section  702.  Instead,  the  Amendments 
Reauthorization  Act  of  2017,  which  amends  the  Foreign  Intelligence  Surveillance  Act  of 
1978,  introduced  some  limited  additional  privacy  safeguards,  for  instance  in  the  area  of 
transparency. 

There  have  also  been  important  developments  concerning  the  Privacy  and  Civil  Liberties 
Oversight  Board which,  at  the time of the first  annual  review, had only  one  Board member 
left. The Commission had therefore recommended the swift appointment of the missing Board 
members. On 11 October 2018, the U.S. Senate confirmed the nominations of the Chairman 
of  the  Privacy  and  Civil  Liberties  Oversight  Board  as  well  as  of  two  other  members  of  the 
Board,  thereby  reinstalling  the  Board  to  its  full  quorum  and  allowing  it  to  exercise  all  its 
functions.  After  the  first  annual  review,  the  Commission  had  also  recommended  the  public 
release of the Board’s report on Presidential Policy Directive 28. The report was released on 
16 October 20185 and confirms that Presidential Policy Directive 28 is fully applied across the 
Intelligence Community. In particular, it confirms that further to the issuance of Presidential 
Policy  Directive  28,  the  relevant  elements  of  the  Intelligence  Community  have  adopted 
detailed  rules  on  the  implementation  of  that  Directive  and  have  changed  their  practices  in 
order to bring them in line with the requirements of Presidential Policy Directive 28. 

Finally,  although  the  Commission  had  recommended  the  swift  appointment  of  the  Privacy 
Shield Ombudsperson, the position of Under-Secretary in the State Department to whom the 
office  of  the  Ombudsperson  has  been  assigned  had  not  yet  been  filled  by  a  permanent 
appointment at the time of the present report. In that regard, the Commission took note of the 
fact  that  at  the  second  annual  review,  the  U.S.  government  recognised  the  need  for  prompt 
progress on nominating a permanent Under Secretary and confirmed that this process is well 
underway.  

At  the  time  of  the  present  report,  the  Ombudsperson  mechanism  had  not  yet  received  any 
requests. However, a complaint to the Ombudsperson had been submitted to the Croatian data 
protection authority and the relevant checks were ongoing.  

The  detailed  findings  concerning  the  functioning  of  all  aspects  of  the  Privacy  Shield 
framework after its second year of operation are presented in the Commission Staff Working 
Document  on  the  second  annual  review  of  the  functioning  of  the  EU-U.S.  Privacy  Shield 
(SWD(2018) 497) which accompanies the present report. 

The  information  gathered  in  the  context  of  the  second  annual  review  confirms  the 
Commission’s  findings  in  the  adequacy  decision,  both  with  regard  to  the  “commercial 
aspects” of the framework and aspects relating to access to personal data transferred under the 
Privacy Shield by the U.S. authorities.  

5 Report  to  the  President  on  “the  Implementation  of  Presidential  Policy  Directive  28:  Signals  Intelligence 
Activities”, available at https://www.pclob.gov/reports/report-PPD28/ 

4 

 
 
                                                           
On the basis of these findings, the Commission concludes that the United States continues to 
ensure  an  adequate  level  of  protection  for  personal  data  transferred  under  the  Privacy 
Shieldfrom the Union to organisations in the United States.  

In particular, the steps taken to implement the Commission's recommendations following the 
first  annual  review  have  improved  several  aspects  of  the  practical  functioning  of  the 
framework in order to ensure that the level of protection of natural persons guaranteed by the 
adequacy decision is not undermined. 

However,  some  of  these  steps  have  been  taken  only  recently  and  the  relevant  processes  are 
still  ongoing.  Any  further  developments  concerning  these  processes  therefore  need  to  be 
closely monitored, in particular as they affect elements that are essential for the continuity of 
the adequacy finding. This concerns notably: 

1.  The effectiveness  of the  mechanisms introduced by the Department  of Commerce in 
the second year of operation of the framework to proactively monitor compliance by 
certified companies with the Privacy Shield Principles, in particular compliance with 
substantive requirements and obligations. 

2.  The  effectiveness  of  the  tools  introduced  by  the  Department  of  Commerce  since  the 
first  annual  review  to  detect  false  claims  of  participation  in  the  framework,  with  a 
particular focus on the search of false claims by companies that have never applied for 
certification. 

3.  The  progress  and  outcome  of  ex-officio  sweeps  carried  out  by  the  Federal  Trade 
Commission  in  the  second  year  of  operation  of  the  Privacy  Shield  by  means  of 
administrative subpoenas to detect substantive violations of the Privacy Shield. 

4.  The  development  of  additional  guidance  jointly  by  the  Department  of  Commerce, 
Federal Trade Commission and EU data protection authorities on elements that require 
further clarification (e.g. HR data). 

5.  The appointment of a permanent Privacy Shield Ombudsperson. 

6.  The effectiveness of the handling and resolution of complaints by the Ombudsperson. 

In  particular,  the  Commission  reiterates  its  call  on  the  U.S.  administration  to  confirm  its 
political  commitment  to  the  Ombudsperson  mechanism  by  appointing  a  permanent  Privacy 
Shield Ombudsperson as a matter of priority. The Ombudsperson mechanism is an important 
element  of  the  Privacy  Shield  framework  and,  while  the  acting  Ombudsperson  continues  to 
carry out the relevant functions, the absence of a permanent appointee is highly unsatisfactory 
and should be remedied as soon as possible. The Commission expects the U.S. government to 
identify  a  nominee  to  fill  the  Ombudsperson  position  on  a  permanent  basis  by  28  February 
2019 and inform the Commission about the nominated individual. If this does not take place 

5 

 
 
 
 
 
 
 
 
by that date, the Commission will then consider taking appropriate measures,  in  accordance 
with  the  General  Data  Protection  Regulation 6 .  The  Commission  also  expects  to  receive 
precise and detailed information on all of the abovementioned aspects in order to be able to 
assess whether the steps taken are effective in practice. 

Finally, the Commission will continue to closely follow the ongoing debate about the federal 
privacy  legislation  in  the  U.S.  Given  the  significance  of  transatlantic  data  flows,  the 
Commission  encourages  the  U.S.  to  adopt  a  comprehensive  system  of  privacy  and  data 
protection  and  to  become  a  Party  to  the  Council  of  Europe’s  Convention  108.  It  is  through 
such comprehensive approach that convergence between our two systems can be achieved in 
the  longer  term,  which  would  also  strengthen  the  foundations  on  which  the  Privacy  Shield 
framework has been developed. 

6 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of 
natural  persons  with  regard  to  the  processing  of  personal  data  and  on  the  free  movement  of  such  data,  and 
repealing Directive 95/46/EC (General Data Protection Regulation) 

6