Type: Acts of the European Union: European Parliament Resolution on the adequacy of the protection afforded by the EU-US Privacy Shield

Authority: European Authorities - European Union: European Parliament

Date: 04/06/2017

Subject: The European Parliament acknowledges that the EU-US Privacy Shield contains significant improvements regarding the clarity of standards compared with the former EU-US Safe Harbour and that US organisations self-certifying adherence to the EU-US Privacy Shield will have to comply with clearer data protection standards than under Safe Harbour; it notes that, in line with the ruling of the CJEU in the Schrems case, the powers of the European DPAs remain unaffected by the adequacy decision and they can, therefore, exercise them, including the suspension or the ban of data transfers to an organisation registered with the EU-US Privacy Shield; it welcomes in this regard the prominent role given by the Privacy Shield Framework to Member State DPAs to examine and investigate claims related to the protection of the rights to privacy and family life under the EU Charter and to suspend transfers of data, as well as the obligation placed upon the US Department of Commerce to resolve such complaints; Considers that, despite the commitments and assurances made by the US Government by means of the letters attached to the Privacy Shield arrangement, important remain as regards certain commercial aspects, national security and law enforcement; however, it specifically notes the significant difference between the protection provided by Article 7 of Directive 95/46/EC and the ‘notice and choice’ principle of the Privacy Shield arrangement, as well as the considerable differences between Article 6 of Directive 95/46/EC and the ‘data integrity and purpose limitation’ principle of the Privacy Shield arrangement; points out that instead of the need for a legal basis (such as consent or contract) that applies to all processing operations, the data subject rights under the Privacy Shield Principles only apply to two narrow processing operations (disclosure and change of purpose) and only provide for a right to object (‘opt-out’); it takes the view that these numerous concerns could lead to a fresh challenge to the decision on the adequacy of the protection being brought before the courts in the future; it emphasises the harmful consequences as regards both respect for fundamental rights and the necessary legal certainty for stakeholders

Classification: Freedoms - Art. 7 Privacy - Art. 8 Personal data: fairly processing

Text