Source: http://blog.kuan0.com/2016/09/
Timestamp: 2018-04-19 13:53:13
Document Index: 716969210

Matched Legal Cases: ['CJEU ', 'arty 29', 'arty 29', 'Art. 31', 'Art. 31', 'Art. 31', 'Art. 93', 'Art. 31', 'Art. 31', 'CJEU\n', 'CJEU\n', 'Art. 1', 'Art. 25', 'Art. 3', 'Art. 28', 'Art. 1', 'Art. 3', 'CJEU ', 'Art.25', 'Art. 3', 'Art. 31', 'Art.31', 'Art. 25', 'Art. 31', 'Art.29']

Kuan0: September 2016
Privacy Shield – history, key links
This blog contains a chronology and key official links regarding the EU-US Privacy Shield, which replaced the EU-US Safe Harbor scheme, as a resource for ease of historical reference. As I’m UK-based, this inevitably has a UK slant, so any suggestions of further links would be welcome. (I aim to record official links only, not links to news stories, unless they provide useful information not available officially)
Snowden’s revelations of mass surveillance by US and other countries’ intelligence or security authorities kickstarted Safe Harbor’s demise and its replacement by the Privacy Shield. With a few exceptions, the chronology below starts with the Schrems ruling by the Court of Justice of the European Union (CJEU) on 6 October 2015, where the CJEU invalidated the EU-US Safe Harbour framework.
The links in this blog are up to date as of 6 August 2017.
Challenges to the Privacy Shield are in progress before the Court of Justice of the EU: by Digital Rights Ireland (Case T-670/16) and La Quadrature du Net & others (Case T-738/16)
Privacy Shield Framework website, including list of participants
The page on How to Submit a Request Relating to U.S. National Security Access to Data hasn’t been completed as at the date of this blog
Unfortunately, unlike with the old Safe Harbor page, no running total of the current aggregate number of Shield subscribers is shown; this isn’t hard to code, and I hope they’ll introduce that feature (which I’ve requested)
Fees for Privacy Shield 81 FR 47752 (July 22, 2016)
Plus an annual contribution to an arbitration fund, TBA
Old Safe Harbour list – still available for historical reference
Privacy Shield webpage
See also the 12 July 2016 entry (in red) in the Chronology below, for Commission and US links on the finalised Privacy Shield framework.
Data Privacy Shield: MEPs alarmed at undermining of privacy safeguards in the US, press release 6 April 2017
Privacy Shield Joint Review, WP29 letter to Commissioner Jourová, 15 June 2017
Preparation of the Privacy Shield annual Joint Review, WP29 press release 13 June 2017 - lists WP29's key concerns: legal guarantees regarding automated decision making, any DoC guidance on the application of the Privacy Shield principles to organisations acting as agents/processors, definition of human resources data; evidence that bulk collection, when it exists, is “as tailored as feasible”, limited and proportionate, information on the nomination of the four missing members of the PCLOB, the appointment of the Ombudsperson and procedures governing the Ombudsperson mechanism
Feedback from the visit of Working Party 29 Chair, Isabelle Falque-Pierrotin to Washington, WP29 press release, 5 April 2017 - emphasis added:
"...The FTC and the Ombudsperson reiterated their general support to the Privacy Shield and their willingness to help the European Commission and the WP29 in their annual review. However, some of the key functions in the Privacy Shield architecture still need to be definitely appointed following the US election (Ombudsperson, FTC commissioners and PCLOB members). In addition, the organization of the annual review must be discussed in depth and in detail with the US authorities especially regarding access to documents. In that regard, Isabelle Falque-Pierrotin recalls that the objective of this annual review exercise is to verify through concrete evidences if US commitments under the Privacy Shield are fulfilled. It is essential that US authorities provide substance and demonstrate to EU stakeholders that the system is in place and works effectively so that this instrument ensures real and effective protection to EU data according to EU standards. The civil society expressed its concerns on the current context at national level especially on the renewal of Section 702 and on the overturn of FCC ebroadband privacy rules. The US Business industry supports the Privacy Shield as a solution bringing legal certainty to their transfers of data from the EU. In this context, the WP29 engaged at this plenary the discussions with the Commission as regard the organization of the joint review."
Visit of Working Party 29 Chair, Isabelle Falque-Pierrotin, in Washington, WP29 press release, 31 March 2017
Form for submission of requests to the US Ombudsperson
Rules of procedure for the submission of requests to the Ombudsperson via the “EU Centralised Body” under Rec.119 Shield Decision and Annex III on Privacy Shield Ombudsperson mechanism
Rules of procedure for the informal panel of DPAs under Rec.49 Shield Decision & supplemental principle III.5 ( Operation of DPA Panels), Annex II
Complaint form for submitting commercial related complaints (i.e. complaints about US organisations under the Privacy Shield) to EU DPAs
Pinsent Masons note on the final Privacy Shield (full disclosure – I was involved in this).
Chronology (reverse order)
For abbreviations, see the end.
EU-U.S. data flows and data protection: opportunities and challenges in the digital era: speech by Commissioner Jourová in Washington D.C., announcing the first joint annual review of the Privacy Shield for September 2017.
Announcement of Commissioner Jourová's visit to Washington D.C. to discuss, inter alia, the Privacy Shield.
Taking data protection into a digital and globalised era: Joint Statement by Vice-President Ansip and Commissioner Jourová ahead of the 2017 Data Protection day, including: "Now, over 1700 companies have signed up to the Privacy Shield, with 700 further applications in the pipeline. We will continue to promote our data protection values at international level. This is why we will actively engage with key partners, such as Japan and South Korea, to reach adequacy decisions."
Re-certifications under Safe Harbor will no longer be accepted (see US Department of Commerce Safe Harbor webpage).
Subscribers to Privacy Shield as at this date (see the list) include, among cloud providers, Amazon, Google, Microsoft, Salesforce and Workday, but not yet Dropbox, Facebook, IBM or Twitter.
Privacy Shield Framework - 81 Fed Reg 51042 (Aug 2, 2016)
Privacy Shield Framework in force.
Press release - EU-U.S. Privacy Shield fully operational from today
Guide to the EU-U.S. Privacy Shield for citizens
US Department of Commerce note about commencement date (on old Safe Harbor webpage)
Press release – statement on the decision of the European Commission on the EU-U.S. Privacy Shield, noting:
the continuing lack of ‘specific rules on automated decisions and of a general right to object’
lack of clarity regarding how the Privacy Shield’s principles apply to processors
guarantees regarding the Ombudsperson were less strict than ‘expected’
lack of ‘concrete assurances’ that US authorities do not engage in mass indiscriminate data collection (despite ODNI’s commitment not to do so)
the first joint annual review of the Privacy Shield will be a ‘key moment’ for assessing its robustness and efficiency, and the review’s results regarding US authorities’ access to data transferred under the Privacy Shield ‘may also impact’ Mechanisms such as SCCs and BCRs
Does this imply that most DPAs will hold off from taking action regarding SCCs or BCRs until the first annual review?
Privacy Shield adequacy decision adopted by Commission.
Commissioner Jourová's remarks at the EU-U.S. Privacy Shield press point – changes from the February drafts (corresponding with many of the issues in WP29’s April 2016 opinion, see below):
‘further strengthened and clarified the role of the new Ombudsperson dealing with citizens' enquiries about possible access to data by national intelligence agencies’
‘clarified better when “bulk” collection of data may occur and what distinguishes it from “mass surveillance”’; and
‘strengthening and clarifying’ some obligations on companies, e.g. on data deletion
Commission adequacy decision including Annexes - Commission Implementing Decision (EU) 2016/1250 of 12.7.2016 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the EU-U.S. Privacy Shield (notified under document C(2016) 4176), OJ L207/1, 1.8.2016
The EU-U.S. Privacy Shield Framework FAQs
Criticism by Max Schrems and MEP Jan-Philipp Albrecht, Irish Times
Art. 31 Committee meeting approving Privacy Shield.
Press release - Statement by Vice-President Ansip and Commissioner Jourová on the occasion of the adoption by Member States of the EU-U.S. Privacy Shield
Art. 31 Committee:
24 in favour representing 95.66% of the EU population
4 abstentions - reportedly (Baker), these were Austria, Bulgaria, Croatia and Slovenia)
Generally, see my flowchart of decision-making regarding Commission adequacy decisions and the Art. 31 Committee
GDPR - there’s also a flowchart of decision-making regarding Commission adequacy decisions and certain other decisions involving a new Art. 93(2) Committee
Note: 8 meetings of the Art. 31 Committee were held between 7 April 2016 and 8 July 2016 inclusive; find them by searching the EU Comitology register.
At the 4 July 2016 meeting, ‘It was agreed to make a limited number of amendments to the draft decision and, in agreement with the U.S., to the Annexes’
At the 29 June 2016 meeting, the Commission explained it had worked with the US to amend the draft documents, particularly Annexes I, II, III and VI, and made changes to the draft adequacy decision ‘aimed at reflecting the new elements in the Annexes as well as better presenting and clarifying certain aspects’
The redrafted documents were circulated to the Committee before the 29 June meeting; some documents were leaked in June, presumably the same as this set
Press release - statement on EU-US Privacy Shield
Reiterating WP29’s April opinions, in view of forthcoming Art. 31 Committee meeting
Opinion on the EU-U.S. Privacy Shield draft adequacy decision
Similar to WP29’s April opinion
Executive summary of the opinion of the European Data Protection Supervisor on the EU-US Privacy Shield draft adequacy decision (OJ C 257/8, 15.7.2016)
Press release - EU-US “Privacy Shield” for data transfers: further improvements needed, MEPs say
Resolution of 26 May 2016 on transatlantic data flows (2016/2727(RSP)), P8_TA(2016)0233
Irish Data Protection Commissioner announces it is to refer the validity of SCCs to the CJEU
Note: the model clauses Decisions suffer from the same flaw regarding DPA powers as the Safe Harbor Decision, see Schrems summary below, and the Commission has not corrected that defect despite its November 2015 Communication (see below), so the SCCs Decisions could well be invalidated on that basis alone, regardless of US surveillance issues
WP29 issued its opinion on draft Privacy Shield documents and a document on essential guarantees regarding state surveillance.
Press release - statement on the opinion on the EU-US Privacy Shield
Opinion 01/2016 on the EU–U.S. Privacy Shield draft adequacy decision (WP238):
‘Significant improvements’ over Safe Harbour, but 3 key concerns…
no obligation to delete personal data that had served its purpose
no full exclusion of massive and indiscriminate data collection; and
the sufficiency of the proposed Ombudsperson’s powers and independence.
key EU data protection law principles were not reflected in the draft Shield documents (notably purpose limitation, data retention/deletion and automated decision-making)
‘onward transfers’ were ‘insufficiently framed’, especially their scope, purpose limitation and ‘guarantees’ applying to transfers to agents
the proposed new recourse mechanisms seemed difficult for individuals to use and needed further clarification; and
the draft decision contained only limited information regarding the complex issue of access to Privacy Shield data by US law enforcement authorities.
The Privacy Shield will need review after the GDPR becomes applicable in 2018.
Working Document 01/2016 on the justification of interferences with the fundamental rights to privacy and data protection through surveillance measures when transferring personal data (European Essential Guarantees) (WP237) - 4 essential guarantees regarding intelligence activities, based on Schrems and other relevant EU and European Court of Human Rights case law:
Clear, precise, accessible rules for processing, enabling individuals to have reasonable foreknowledge of what might happen to their personal data
Demonstrating necessity and proportionality regarding the legitimate objectives pursued (generally national security)
An independent, effective oversight mechanism; and
Effective remedies for individuals before an independent body.
Newsroom item – Sending data to the US: how to safeguard your privacy, including video of interview with Max Schrems
Question to the Commission by MEP Sophia in 't Veld on EU-US Privacy Shield framework and processing for incompatible purposes (purpose limitation)
Answered by Ms Jourová on behalf of the Commission on 14 June 2016
Draft Privacy Shield documents released.
Commission Communication, Transatlantic Data Flows: Restoring Trust through Strong Safeguards, COM(2016) 117 final - with factsheet
Press release - Restoring trust in transatlantic data flows through strong safeguards: European Commission presents EU-U.S. Privacy Shield - with links to FAQs, Factsheet, draft Privacy Shield adequacy decision and Annexes
Note: the 29 Feb draft adequacy decision, linked to from that press release, now links only to the final July 2016 adequacy decision, which is problematic from a historical accuracy and research perspective. Fortunately, the Internet Archive has archived the original 29 Feb 2016 draft Privacy Shield adequacy decision.
Press release – statement on the presentation by the European Commission of the EU-US Privacy Shield
Privacy Shield framework text (US documents only)
We’re clear that organisations can continue to use other tools such as SCCs and BCRs for transfers to the USA
We will not be seeking to expedite complaints about Safe Harbor while the process to finalise its replacement remains ongoing and businesses await the outcome.
Data transfers to the US and Safe Harbor – interim guidance, 10 Feb 2016
Press release – statement on the consequences of the Schrems judgment following the political agreement
Political agreement between EU and US on new Privacy Shield.
Press release EU Commission and United States agree on new framework for transatlantic data flows: EU-US Privacy Shield
Commission Communication on the Transfer of Personal Data from the EU to the United States of America under Directive 95/46/EC following the Judgment by the Court of Justice in Case C-362/14 (Schrems), COM(2015) 566 final
Model clauses (SCCs) and BCRs still usable for transfers to US; also derogations
The Commission is ‘shortly’ preparing a decision, to be adopted pursuant to the applicable comitology procedure, replacing the provision limiting DPAs’ powers (one of the bases on which the Schrems court invalidated the Safe Harbour Decision) in all existing adequacy decisions (pgs. 14-15)
No such decision has been issued as at 19 September 2016
There is still a measure of protection for personal data transferred under the scheme – the privacy principles that members sign up to are still positive, for instance. But the assurance that meant Safe Harbor was automatically considered to provide the adequate protection required under the 8th data protection principle is no longer there
Don’t panic, take stock, make your own mind up (self-assessment of adequacy)
We’re certainly not rushing to use our enforcement powers
We’ll consider complaints from affected individuals, whatever transfer mechanism you’re relying on, but we’ll be sticking to our published enforcement criteria
Rhineland-Pfalz’s DPA asked 122 large organizations how they were implementing their US transfers; 53% answered satisfactorily, with the DPA remarking, without mentioning SCCs, that their privacy-protective positions regarding ‘no-cloud policies’ or preference of EU providers had paid off
DSK Position Paper - Special meeting of the Conference of Data Protection Commissioners (DSK) (German DPAs) in Frankfurt
Transfers to the US based ‘exclusively’ on Safe Harbor are ‘inadmissible’
The admissibility of transfers to the US based on model clauses (standard contractual clauses) or binding corporate rules (BCR), is also questionable
For the time being, [German] data protection authorities will not issue any new permission for data transfers to the US based on binding corporate rules (BCR) or data export contracts.
Presumably “data export contracts” are ad hoc contracts not model clauses, which strictly under the DPD should not require authorisation
Numerous individual German DPA positions – not linked to here
Statement on implementing Schrems
transfers to the US relying on Safe Harbour are invalid
‘massive and indiscriminate surveillance’ was a ‘key element’ of the CJEU’s analysis
urgent ‘legal and technical’ solutions needed to enable transfers to ‘the territory’ of the US ‘that respect fundamental rights’
SCCs and BCRs still usable (although DPAs could still investigate complaints)
if, by the end of January 2016, no appropriate solution was found with the US, and depending on its assessment of transfer tools, EU DPAs were ‘committed to take all necessary and appropriate actions, which may include coordinated enforcement actions’.
C-362/14 Maximillian Schrems v Data Protection Commissioner, ECLI:EU:C:2015:650, CJEU
Commission’s 2000 Safe Harbour Decision was invalid:
Art. 1 was invalid – it did not comply with Art. 25(6) DPD or the Charter as it did not find, duly stating reasons, that that the US in fact ‘ensures’ an adequate level of protection by reason of its domestic law or its international commitments. No need to consider content of Safe Harbour principles.
Art. 3 was invalid – it constrained national DPAs’ powers ‘under restrictive conditions establishing a high threshold for intervention’, which the Commission had no legislative competence to do because DPAs must have ‘complete independence’ to review data subject claims under Art. 28 DPD and the Charter
As Art. 1 and Art. 3 were inseparable from the rest of the Decision, the entire Decision was invalid
No Commission adequacy decision may prevent national DPAs from examining individuals’ claims regarding the inadequate protection of their personal data transferred to a third country; but neither national courts nor DPAs can declare Commission decisions invalid, only the CJEU can do so
When considering the ‘adequacy’ of protection in a third country for the purposes of a Commission Art.25(6) decision, the test is whether the country’s legal regime provides ‘essentially equivalent’ protection
Although strictly the court’s decision rested on the Safe Harbor Decision being invalid for the reasons stated above, but it also outlined requirements for EU legislation interfering with the Charter’s fundamental rights to private life and data protection to be valid (drawn on by WP29 in its April 2016 opinion)
Note: all other Commission adequacy decisions, eg on SCCs or ‘whitelisting’ certain countries for transfers, contain the same wording as the invalidated Art. 3 of the Safe Harbour Decision - so they are all also at risk of invalidation for that reason alone
Letter to Commissioner Reding recommending ‘some additional elements that should be improved in the Safe Harbor Decision’
FTC, Privacy Enforcement and Safe Harbor: Comments of FTC Staff to European Commission Review of the U.S.-EU Safe Harbor Framework, 12 Nov 2013
Department of Commerce’s International Trade Administration, Clarifications Regarding the U.S.-EU Safe Harbor Framework and Cloud Computing, April 2013
Communication on the Functioning of the Safe Harbour from the Perspective of EU Citizens and Companies Established in the EU, COM(2013) 847 final, 27 Nov 2013 – with 13 recommendations to improve Safe Harbour
News breaks in June 2013 regarding NSA contractor Edward Snowden’s revelations, notably, from the Guardian:
NSA collecting phone records of millions of Verizon customers daily and
(for a detailed timeline of stories see https://wiki.openrightsgroup.org/wiki/Guardian_and_Snowden_revelations_2013)
Art. 31 Committee – a Committee of EU Member State representatives, under Art.31 DPD, that votes on Commission adequacy (or inadequacy) decisions proposed under Art. 25(6) or 25(4) DPD, and certain other decisions under the DPD (flowchart of Art. 31 Committee voting and decisions)
Charter – EU Charter of Fundamental Rights
Commission – European Commission
DPA – EU national data protection authority
DPD – EU Data Protection Directive 95/46/EC
FTC – US Federal Trade Commission
ICO – UK Information Commissioner
Member State – EU Member State (see diagram on the differences between the EU, EEA, EFTA etc)
Model clauses – see SCCs
SCCs – standard contractual clauses, aka ‘model clauses’, for enabling transfers of personal data outside the EEA, under various Commission Decisions
WP29 – Article 29 Working Party, comprising EU data protection regulators, with an advisory function under Art.29 DPD.
Posted by Kuan at 10:26
Labels: Article 31 Committee, Commission adequacy decisions, data protection directive, international data transfers, international transfers, law reform, model clauses, Privacy Shield, Safe Harbor, United States