It has been a very busy week for data protection and transatlantic data flows. Following the announcement by the European Commission that political agreement has now been reached on a new framework for transatlantic data flows, the new EU-US Privacy Shield, the Article 29 Working Party has issued a statement in relation to same.
While the new EU-US Privacy Shield is welcomed by the Article 29 Working Party, it is cautious to endorse the new framework until it receives sight of the relevant documentation. The Article 29 Working Party stresses the importance of the four “essential guarantees”, which are:
- Processing should be based on clear, precise and accessible rules
- Necessity and proportionality with regard to the legitimate objectives pursued need to be demonstrated
- An independent oversight mechanism should exist, that is both effective and impartial
- Effective remedies need to be available to the individual
The Article 29 Working Party has stated that it will consider in detail the new legal framework in light of the above four essential guarantees, however, in the interim it continues to have concerns on the current U.S. legal framework. It reiterated that the old Safe Harbour decision cannot be used as a basis to legitimise transatlantic data flows and in such cases, the EU data protection authorities will need to deal with such complaints on a case-by-case basis.
The European Commission has been given until the end of February to provide the Article 29 Working Party with all documentation in relation to the new EU-US Privacy Shield. While it will continue to consider the validity of the Model Clauses and BCRs, it provides that these alternative measures can continue to be used until a decision has been reached.