On July 12th 2016, the European Commission issued an adequacy decision according to which it recognizes that the Privacy Shield provides a level of protection “essentially equivalent” to European requirements.
The “Privacy Shield”, which has been negotiated for several months between the United-States (US) and the European Commission, now replaces the Safe Harbor which was invalidated by the Court of Justice of the European Union (CJEU) on October 6th 2016.
Nevertheless, even though the European Commission ensures in its press release that “the Privacy Shield reflects the requirements set out by the European Court of Justice in its ruling on 6 October 2015”, this new legal framework seems already at risk. At this stage, nothing shows that the Internet surveillance practices conducted by the American intelligence services have significantly changed, or that such services have taken into account the requirements mentioned in the CJEU ruling.
The Privacy Shield provides that the US may monitor Europeans data in case of “national security” or “public interest” reasons. As these concepts are blurry by nature, it seems the US still have broad latitude.
On July 25th 2016, the G29, composed of all the European personal data protection authorities (including the French CNIL), published its position regarding the Privacy Shield.
Although the group considers that the Privacy Shield, as adopted, presents some improvements with regard to some unclear points included in its former version, the G29 finds regrettable the weakness of certain provisions, especially regarding American intelligence services.
The G29 considers that the US do not provide sufficient details on the manner they intend to limit their surveillance practices in order to avoid any excessive practices.
The group also criticizes one of the key provisions of the Privacy Shield which gives the right to any European citizen to claim damages before American courts, in case of wrongful use of their data.
The G29 notes that “in practice, this new mechanism could prove to be too complex to be used by European citizens, particularly for non-English speakers, and then prove to be inefficient”. To overcome this obstacle, the G29 recommends that the national data protection authorities may act as go-betweens in the context of these proceedings.
Finally, even if the G29 considers that the appointment of an American mediator meant to process European citizens claims is “a significant improvement for individual rights towards American intelligence services”, it questions the independence of this new institution and considers that it “does not have the power to fulfil its mission”.
In this context, it cannot be excluded that, in the months to come, the Privacy Shield could suffer the same fate as the Safe Harbor and be invalidated as well.
Key words: Juris Initiative – Anne-Solène Gay –Behring – Privacy Shield – Safe Harbor – Adequacy decision – July 12th 2016 – G29 – July 25th 2016
