In their press release today the Art. 29 Data Protection Working Party confirm that for the time being Model Clauses and BCR are valid for international transfers of personal data from EU to other countries including US. They are reviewing the Privacy Shield and need to see more detail, and they will continue to assess Model Clauses and BCR. Please click here to read the release in full.
The release stresses once more the importance of the four essential guarantees for intelligence activities within any new US framework, those being:
Processing should be based on clear, precise and accessible rules: this means that anyone who is reasonably informed should be able to foresee what might happen with her/his data where they are transferred;
Necessity and proportionality with regard to the legitimate objectives pursued need to be demonstrated: a balance needs to be found between the objective for which the data are collected and accessed (generally national security) and the rights of the individual;
An independent oversight mechanism should exist, that is both effective and impartial: this can either be a judge or another independent body, as long as it has sufficient ability to carry out the necessary checks;
Effective remedies need to be available to the individual: anyone should have the right to defend her/his rights before an independent body.
The WP29 stands ready to analyse the result of the negotiations in light of the above guarantees and whether the concerns with the US framework can be alleviated following the introduction of the EU - U.S. Privacy Shield.