We reported previously (see here and here) on the status of Safe Harbour following the ruling of the Court of Justice of the European Union (CJEU) invalidating the Safe Harbor framework. It was reported on 2 February 2016 in an official press release that a new framework, known as the EU-US Privacy Shield, has been agreed between the European Commission and the United States for transatlantic data flows.
It is reported that the agreement for the new framework reflects the requirements set out by the CJEU in its ruling in the Schrems case on 6 October 2015 (see here) and will protect the fundamental rights of EU citizens. The new arrangement will put “stronger obligations on companies in the US to protect the personal data” of EU citizens. US companies importing personal data from the EU will need to commit to robust obligations, which will be enforceable by the US Federal Trade Commission.
It has been agreed that the new framework will set out clear safeguards and transparency obligations on US government access. According to Commissioner Jourová this is the first time ever that “the United States has given the EU binding assurances that the access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms.”
Also included in the new arrangement are various redress mechanisms for EU citizens. It is stated that US companies will have deadlines to reply to complaints and European Data Protection Authorities will be able to refer complaints to the department of Commerce and the Federal Trade Commission.
A draft agreement is to be drawn up in the upcoming weeks, reflecting the deal reached between the European Commission and the US. In the meantime it is envisaged that the US will start making the necessary preparations to put in place the new framework and monitoring mechanisms.
This new development is an important step to facilitate EU-US data flows but only time will tell if this deal really is the “major achievement” that many organisations hope it will be, or a mechanism masking some people’s underlying concerns.