Menu
EU adds detail to Privacy Shield agreement, prepares to give it force of law

EU adds detail to Privacy Shield agreement, prepares to give it force of law

The agreement that will allow the export of EU citizens' personal data to the US for processing is taking shape

The European Commission has detailed the steps businesses must take to comply with the Privacy Shield data protection agreement reached with U.S. authorities earlier this month, and published a draft of the order that will give it force of law.

Privacy Shield is the replacement for the Safe Harbor agreement torn up by the Court of Justice of the European Union last October.

Like its predecessor, is intended to ensure that the personal data of EU citizens benefits from the same privacy protections when processed in the U.S. as it would within the EU. The court found the Safe Harbor agreement lacking in a number of respects, prompting officials on both sides of the Atlantic to negotiate a new agreement that would answer the court's concerns.

On Feb. 2, the Commission announced that it expected written assurances from the U.S. on a number of points, but did not immediately publish the details.

Last Tuesday, U.S. Secretary of Commerce Penny Pritzker forwarded those assurances to Věra Jourová, European Commissioner for Justice, Consumers and Gender Equality, and on Monday, the Commission made these letters public, and issued a draft adequacy decision, the legal mechanism by which Privacy Shield is formally recognized as providing the same privacy guarantees as EU law.

EU member states and national data protection authorities will have a chance to review and comment on the draft adequacy decision before it becomes final.

The Commission also published the principles to which businesses will have to agree when they self-certify their compliance with the Privacy Shield agreement.

The agreement includes the creation of an ombudsperson to deal with complaints from EU citizens regarding U.S. surveillance of their communications and online activities.

Brussels-based business lobby group DigitalEurope said it welcomed the publication of the draft adequacy decision. The group counts Apple, Google and Microsoft among its members.

"Our companies are committed to ensuring a high level of data protection when executing transatlantic data transfers and are committed to working quickly to assess and implement the new framework, which contains additional new obligations," said its director general John Higgins via email.

For the Computer and Communications Industry Association (CCIA), based in Washington, D.C., "The Privacy Shield will provide strong privacy safeguards and legal certainty for companies, and enhances transatlantic trust." CCIA's members include Amazon.com, Ebay, Google, Microsoft and Yahoo.

However, Max Schrems, the Austrian whose complaint to the Irish Data Protection Commissioner about Facebook's handling of his personal data led to the end of Safe Harbor, remains unsatisfied with the new deal.

"The EU and the U.S. tried to put about ten layers of lipstick on a pig, but the core problems were obviously not solved," he said via email.

Schrems highlighted a number of unsatisfactory elements in the letters from U.S. authorities published by the Commission on Monday, including an authorization of bulk surveillance in Presidential Policy Directive 28.

PPD28 provides for six conditions under which bulk surveillance may be used: detecting and countering certain activities of foreign powers; counterterrorism; counter-proliferation; cybersecurity; detecting and countering threats to U.S. or allied armed forces, and combating transnational criminal threats, including sanctions evasion.

It also allows for some circumstances under which it must be used, such as to identify new or emerging threats, but notes that, whenever practicable, signals intelligence collection activities are conducted in a targeted manner rather than in bulk.

However, the CJEU found all use of bulk surveillance compromised the right to respect for private life.

"Basically, the U.S. openly confirms that it violates EU fundamental rights in at least six cases," Schrems said. "The Commission claims that there is no 'bulk surveillance' anymore, when its own documents say the exact opposite thing."

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise

Ingram Micro completed its nationwide roadshow in Auckland last month, kicking off its Innovation Hour series with Hewlett Packard Enterprise. Uncovering the latest in storage, networking and servers, the event outlined key market trends for resellers in 2016 and beyond.

IN PICTURES: Ingram Micro Innovation hits Auckland with Hewlett Packard Enterprise
IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference

FireEye welcomed 143 channel partners and distributors to FireEye's 2016 annual Partner Conference, FireEye A/NZ Momentum - held at Establishment in Sydney. Delegates heard from senior trans-Tasman channel leaders, marketing and the product divisions in the morning, with FireEye customers, incident responders and threat intelligence analysts sharing knowledge during the afternoon.

IN PICTURES: FireEye celebrates channel at 2016 Partner Conference
​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​

With New Zealand businesses now open to innovation, the industry sits on the cusp of significant disruption in the data centre. Driven by software-defined networking, the future of the data centre is fast becoming reality, as the channel seeks to keep up, keep innovating and keep growing. APC by Schneider Electric, Lenovo and key partners outlined how the channel can capitalise at The Grill restaurant in Auckland.

​IN PICTURES: Disruption in the data centre - Can the Kiwi channel capitalise?​
Show Comments