Access Alert: Behind the EU-US Privacy Shield – What is ‘Safe Harbour 2.0’?

Posted on 10th February 2016

EU and US negotiators reached a non-legally-binding agreement on 2 February on a new mechanism for legal data transfers across the Atlantic – the ‘EU-US Privacy Shield’ – to replace the Safe Harbour agreement, which the European Court of Justice (ECJ) ruled invalid in October 2015.

What’s in the Agreement?

  1. A right of redress for EU citizens through various dispute mechanisms, including a new, last-resort arbitration entity (to be independent of US agencies)
  2. Strong and clear safeguards for personal data protection and oversight of those US agencies
  3. A US Department of State ombudsman for EU citizens’ data concerns
  4. Provision for annual joint review of the agreement
  5. Sanctions for non-compliant companies (including removing offenders from the list of authorised data handlers).

What’s Next?

The text is being finalised, but it must be sent to the Article 29 Working Party (WP29), a body comprising Europe’s data protection authorities, by the end of February. WP29 will then distribute it to its members and assess whether the Privacy Shield would bring all EU-US data transfers up to the standard required by the ECJ. This determination will come in April at the latest, at the same time as a judgement on other mechanisms for data transfer, such as binding corporate rules and model contracts.

It will also require approval from the College of Commissioners. This could take up to three months, during which time companies will need to continue using the alternative measures. The US Department of Commerce will require a few weeks to determine implementation procedures and institute an ombudsman.

What will WP29 Look For?

WP29 will be asking whether the Privacy Shield meets four criteria:

  1. Processing should be based on clear, precise and accessible rules.
  2. Necessity and proportionality with regard to the legitimate objective pursued need to be demonstrated.
  3. An independent oversight mechanism should exist that is both effective and impartial.
  4. Effective remedies need to be available to the individual.

Impact

Back to document archive