Freely subscribe to our NEWSLETTER

The Article 29 Working Party (the body that groups together the Data Protection Authorities of EU countries) has sent the European Commission (EC) back to the drawing board on the Privacy Shield, the agreement between the EU and the US on the transfer of personal data. Tech companies have eagerly awaited this agreement since the demise of Safe Harbor.

Since the EC announced the key points of its deal with the US authorities, concerns have emerged about certain aspects, such as the many exceptions under which the bulk use of personal data could still be possible for US authorities. There are also concerns that the powers and independence of the ombudsperson, which should ensure that EU citizens have the ability to seek redress in cases of privacy breaches, are not clearly defined and guaranteed.

The opinion of the Article 29 Working Party is not binding for the EC; however, it is unlikely that the EC will be able to ignore it. It represents the position of Data Protection Authorities of influential member states. Also, the EC should be worried about building a framework that is not too easily subjected to legal challenge. If the European Court of Justice finds that the flaws of Safe Harbor have not been addressed in the Privacy Shield agreement, it will not hesitate to strike the latter down too. Companies affected by this agreement should prepare to face more uncertainty, because the deal is likely to undergo further amendments before it is finalized.