This morning (May 26, 2016) the European Parliament (“EP”) approved a non-binding resolution on the proposed EU – U.S. Privacy Shield (see resolution here and press release here). The resolution is far more positive in relation to the Privacy Shield than some of the proposals floated by some political groups earlier this week (see, for instance, the resolution proposed by the European Green Party here).
MEPs welcomed the efforts of the European Commission and the US administration to achieve “substantial improvements” in the Privacy Shield. They also highlighted specific advancements such as the introduction of a further redress mechanism for individuals under the Privacy Shield, the appointment of an Ombudsperson in the US Department of State and the prominent role given to Member State data protection agencies. The resolution also highlighted the importance of the transatlantic relationship.
At the same time, the EP asked the Commission, among other steps, to:
- fully implement the recommendations expressed by the Article 29 Data Protection Working Party in its Opinion on the EU-US Privacy Shield draft adequacy decision (see here and Covington’s blog post here);
- conduct robust periodic reviews of its adequacy finding and the legal justifications thereof, in particular in the light of the new General Data Protection Regulation (GDPR) coming into effect in 2018; and
- continue its dialogue with the US administration, to negotiate further improvements to the Privacy Shield in light of its current deficiencies.
The “deficiencies” identified by the EP related to:
- the US authorities’ access to data transferred under the Privacy Shield and the possibility of collecting bulk data;
- the proposed US ombudsperson; and
- the complexity of the redress mechanism, which the Commission and US administration need to make more “user-friendly and effective,” according to MEPs.
The EP’s resolution will feed into the Article 31 Committee process. The Committee, which is composed of Member State representatives and chaired by the Commission, is continuing to deliberate on the Privacy Shield. The Commission is expected to present a revised adequacy decision to the Article 31 Committee at the beginning of June, for a vote later that month. The Committee must support the draft adequacy decision on the Privacy Shield by a qualified majority, in order for the Commission to be able to adopt the decision without having to refer the draft decision to an appeal committee. A positive vote by the Article 31 Committee at the end of June would enable the College of Commissioners to adopt the adequacy decision before the summer break.
The European Data Protection Supervisor, Giovanni Buttarelli, will publish his (non-binding) opinion on the proposed Privacy Shield on May 30, 2016.