24

# _The E.U.‐U.S. Privacy Shield_

In 2016, the United States and the EU concluded the Privacy Shield – an arrangement that the EU Commission has deemed “adequate” under the Data Directive – thereby enabling the transfer of personal information from the EU to businesses in the United States participating in the Privacy Shield (EC 2016). The Privacy Shield replaced the EU‐U.S. Safe Harbor framework, which in 2015 the CJEU found did not provide an adequate level of privacy protection due to an absence of rights of redress for EU citizens with respect to government access to their data (Schrems v. Data Protection Commissioner 2015).

Under the Privacy Shield, U.S. companies through an industry body or individually self‐certify to the U.S. Department of Commerce that they will protect personal data consistent with the Privacy Framework, which includes the Privacy Shield Principles (Privacy Shield Framework 2018). These seven Principles (and supplemental principles) largely reflect the key elements of the EU Data Directive (U.S. Department of Commerce 2016). The mains ones are:

- To give European data subjects notice that a US entity is processing their data;

- To provide choice including whether to opt out of providing personal information;

- Accountability for any onward transfers to third parties of personal information;

- To take reasonable and appropriate steps to protect personal data from loss or misuse;

- To process personal data only for purposes the organization intends to use it;

- To give European data subjects access to their personal information and the ability to correct,

- amend or delete inaccurate information; and

- To enforce the principles and to give European data subjects access to affordable enforcement

- mechanisms.

U.S. businesses are required to publish their privacy policies, and the Privacy Shield gives the U.S. Federal Trade Commission jurisdiction over such businesses should they breach their own policy. In addition, the United States provides various means of redress for people, whose personal data has been compromised, including a direct complaint to the business or a complaint to the Department of Commerce. Also, under the Privacy Shield, the United States has agreed to establish an ombudsperson to address complaints about government agencies’ access to personal information from the EU on national security grounds.

Despite the upgrading of privacy protection under the Privacy Shield compared with Safe Harbor, the stability of the arrangement is in doubt. The first annual review of the Privacy Shield by the Commission and the Department of Commerce identified a number of concerns on the EU side that the operation of the Privacy Shield is not providing a sufficient level of privacy protection. In particular, the EU expressed concern over inadequate access by Europeans to redress mechanisms, including failure to appoint officials at the State Department Ombudsperson (EC 2017).

**VI. A PROPOSED APPROACH:  BUILDING ON THE CPTPP AND THE PRIVACY SHIELD**

Divergence in national privacy regulation is inevitable and even desirable, as discussed above. At the same time, developing global privacy principles can ensure a baseline of privacy protection and help to avert the negative impact of restrictions on cross‐border data flows. Yet, even getting agreement on global privacy standards would not necessarily mean that such protection is extended to foreign citizens.