Article 29 Working Party Has 'Strong Concerns' About Privacy Shield

On Wednesday, the EU's Article 29 Working Party issued its much-anticipated statement on the viability of the proposed EU-US Privacy Shield. As we've detailed previously, EU and US officials reached agreement on the Privacy Shield arrangement, which was meant to serve as a replacement for the invalidated Safe Harbor program, back in February, and released details of the Privacy Shield scheme a few weeks later. Observers then began eagerly awaiting the Article 29 Working Party's opinion on the Privacy Shield, because even though the group's opinion is not binding on the European Commission - which is responsible for shepherding the Privacy Shield through the approval and adoption process - it nevertheless may prove influential as that process moves forward.

The Working Party's statement begins by recognizing the "significant improvements brought by the Privacy Shield compared to the Safe Harbor" program, but nevertheless goes on to cite "strong concerns" about the security of the data that would be transferred under the Privacy Shield. More specifically, the Working Party believes that the Privacy Shield does not adequately address a number of data protection principles enshrined in EU law, such as purpose limitation (the requirement that personal data be processed for a specific purpose, and that additional processing be carried out in line with this purpose), data retention, and protection of data subjects from automated decisionmaking. Moreover, the statement claims that it may be too difficult for Europeans to resort to recourse mechanisms in the US if they feel their personal data has been misused. This last part of the statement may prove to be a major hurdle going forward, as granting Europeans the right to pursue such recourse was a cornerstone of the US approach to addressing EU data security concerns and, as such, facilitated the negotiations that ultimately led to the Privacy Shield agreement. Along those same lines, the...