Interactive DATA PRIVACY AND PROTECTION
ensure the protection offered by the Privacy Shield is indeed essentially equivalent to that of the EU.’ A further blow to the credibility of the nascent
Shield came on May 2nd this year, in the form of a letter from the European Ombudsman to the European Commissioner for Justice, Consumers and Gender Equality. Under the Shield as it is currently set out, the ‘home’ DPA of a European citizen will remain the first port of call for a complaint, which will then be referred to the Department of Commerce or other appropriate body, whilst the newly created Ombudsperson mechanism will handle complaints revolving around EU citizens who fear their personal information has been used unlawfully by US authorities working in the field of national security. In the event of a complaint not being resolved, arbitration will be offered as the last resort, and the Privacy Shield Panel will offer a dispute resolution mechanism able to issue binding decisions against US self-certified companies. It shouldn’t be forgotten, either, that somewhere amidst this complex nexus of panels, departments, authorities and regulators, the CJEU will still have a part to play. In the aforementioned letter, the Ombudsman
expressed concerns around the topic of the proposed Shield Ombudsperson in both general and specific terms. Te letter complained that there is currently a lack of clarity as to who this Ombudsperson should be, a lack of adequate safeguards, the absence of a mechanism for dismissing said Ombudsperson, the lack of a framework for coordinating work between the Ombudsperson and other US Government officials and, perhaps most worrying of all, a deficit in terms of independence from the US intelligence community. Tis last is particularly concerning, given that a chief driver of the perceived lack of protection granted data which is transmitted from the EAA to the US is a concern that the latter will allow concepts of ‘national security’ to override all other concerns. As the letter states: ‘….despite the fact that the Ombudsperson
will be functionally independent from the US intelligence community, the Department of State, within which it will operate, is an executive department responsible for US foreign policy. Tis department makes use of intelligence provided by the US intelligence community. Given that fact and the Ombudsperson’s obligation to report to the Secretary of State, it could be argued that this does not provide for the necessary distance from the intelligence community that is required for the body to act in an independent manner.’ In overall terms, the concerns can be
summarised as being centred on the idea that the title ‘Ombudsperson’, in terms of the Privacy Shield, will be applied to an individual who doesn’t reach the levels of independence and public trust which would normally be associated with such a role.
P64 NEWSWIRE / INTERACTIVE /
247.COM
The varied concerns of the Article 29 Working Party, allied to the problems outlined by the European Ombudsman – it seems highly likely that the Privacy Shield will be ripe for challenge in the courts, opening up a vista of uncertainty for businesses keen to experience exactly the opposite.
Taking all of this on board – the varied
concerns of the Article 29 Working Party, allied to the specific problems outlined by the European Ombudsman – it seems highly likely that the Privacy Shield, as it currently stands, will be ripe for challenge in the courts, opening up a vista of uncertainty for businesses keen to experience exactly the opposite. In practical terms, the delay in implementing
the Privacy Shield means that companies cannot, at the moment at least, rely on it for protection when transferring data outside the EAA. Indeed, the doubts expressed around the Shield mean that if and when it finally does
come into force it may still probably come freighted with enough doubt to render it less than wholly dependable. One would hope that when it is finally implemented, companies can successfully become self-certified and it will hold weight, providing a reliable form of protection and means by which compliance with EU data protection rules can be achieved. However, in the meantime at least, businesses should, ensure they have in place one of the alternative mechanisms available to them in order to comply with the adequacy requirement regarding the data they handle. Tese include obtaining specific, freely given informed consent from Data Subjects prior to transferring data to the US. Te EU prescribed standard Model Clauses represent another method – these can be inserted into contracts in order to ensure that the recipient of any data is bound by the applicable data protection rules when processing said data. Finally, companies could draw up binding corporate rules although these can be administratively time consuming, requiring not only internal approval but approval from data protection authorities in all relevant jurisdictions. Moves such as these will not only ensure that mistakes are less likely to be made they will also leave businesses in a much stronger position to defend themselves in the event that the Privacy Shield, at least while it is bedding in, proves not to be up to the task.
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70 |
Page 71 |
Page 72 |
Page 73 |
Page 74 |
Page 75 |
Page 76