"EU-US Privacy Shield Replaces Safe Harbor"
The European Commission and the U.S. Department of Commerce have reached a last-minute deal on a new trans-Atlantic data sharing agreement. Initially coined as “Safe Harbor 2.0” this new agreement will instead be referred to as the “EU-US Privacy Shield.” EU Justice Commissioner, Vera Jourová, addressed the new agreement at a press conference earlier today. The Commissioner indicated that the EU-US Privacy Shield will be in force “as soon as possible,” and estimated a time-table of three months. Andrus Ansip, Vice-President of the EU Commission also spoke at the press conference and explained that there will be an annual joint review of the new data sharing agreement. Jourová added that she anticipates the first review will be next year.
The original EU-US Safe Harbor agreement, in place since 2000, had enabled thousands of businesses to transfer personal information of EU citizens to the U.S. for storage. However, the agreement was abruptly invalidated by the Court of Justice of the EU (CJEU) in October, 2015. The Article 29 Working Party announced after the CJEU ruling that it would begin taking enforcement actions if a new agreement was not reached. It originally gave the EU Commission and U.S. officials a deadline of January 31, 2015 to reach a new agreement. It is no coincidence that with the Article 29 Working Party set to meet today, a deal was finally reached this morning after lengthy negotiations between the parties.
The new agreement specifically addresses the following:
- Strong obligations on companies handling Europeans’ personal data and robust enforcement;
- Clear safeguards and transparency obligations on U.S. government access; and
- Effective protection of EU citizens’ rights with several redress possibilities.
Jourová believes the new agreement will withstand future court challenges and stated that the parties used the CJEU ruling “in the formulation of the new structure.” Ansip added that “this solution is much better than the one we had in the year 2000.” The EU Commission has instructed Ansip and Commissioner Jourová to prepare a draft “adequacy decision” in the coming weeks, which could then be adopted by the EU Commission after consulting with the Article 29 Working Party and representatives of the EU member States. The U.S. will also prepare to put the new framework in place, and create a special ombudsman to follow up on complaints from EU citizens. According to Jourová, the EU-US Privacy Shield is “a unique step in order to restore trust” between the parties.