EU-US Privacy Shield Passes its Third Annual Review

The Privacy Shield became operational on 1 August 2016 and is designed to protect the rights of EU persons whose data are transferred to certified companies in the US for commercial purposes.

The Privacy Shield has passed its third review and the Commission has confirmed that it continues to ensure an adequate level of protection for personal data transferred from the EU to participating companies in the US.

Some key developments have taken place since the last review, including:

1. the appointment of a permanent Privacy Shield Ombudsman, and
2. the confirmation of two additional members to the Privacy and Civil Liberties Oversight Board (the “Board”), meaning that the Board is now fully staffed for the first time since its inception in 2016.

Enforcement action in respect of the Privacy Shield has also improved, with the Federal Trade Commission taking enforcement action in seven cases. A growing number of individuals continue to assert their rights under the Privacy Shield and the redress mechanisms available appear to be functioning effectively in their current format. The US Department of Commerce have also begun conducting monthly reviews in order to monitor compliance across participating companies.

Notwithstanding the positive report, certain cases currently before the Court of Justice of the European Union (“CJEU”) may effect the validity of the Privacy Shield. Once judgment has been issued in these cases (expected in 2020), the Commission will carry out an assessment of their impact.

Finally, the Commission has:

1. made recommendations for measures to address shortcomings in the certification process, (particularly those related to false claims of participation in the Privacy Shield framework), and
2. expressed its expectation of increased cooperation from the Federal Trade Commission concerning ongoing investigations and has stressed the importance of sharing information gathered from such investigations with the Commission and the wider EU Data Protection authorities.