Privacy Shield, Revealed: A Look At The Proposed Replacement Of Safe Harbor

Since 6 October 2015 when the Court of Justice of the European Union ("CJEU") found that Safe Harbor was invalid, organisations which operate across the United States and the European Economic Area ("EEA") have been in an uncertain position when it comes to data transfers. Many hoped for a replacement to Safe Harbor. The Article 29 Working Party (the collective group of European data protection authorities, or "DPAs") indicated that no general enforcement action would be taken until the end of January 2016. This gave organisations some welcome breathing space to put in place alternative measures to legitimise data transfers to the United States. However, it also put pressure on the Commission to finalise a replacement data transfer scheme with the United States, which had been under negotiation for two years. On 2 February 2016, the Commission delivered - announcing the Privacy Shield, the replacement of Safe Harbor.

Since then, we have been waiting for the details, and on 29 February 2016, the Commission released an extensive set of documents, which set out how the Privacy Shield will operate. In this post, we look at some of the key issues relating to the Privacy Shield.

When will the Privacy Shield come into effect?

The Privacy Shield, while agreed in principle with the United States, must still be formally adopted as a matter of EU law, as a Commission Decision. The Commission is aiming for adoption in June 2016. However, before that can take place, the current draft decision must go through a procedure known as "comitology". This involves a series of steps:

Review by the Article 29 Working Party and the European Data Protection Supervisor: The Article 29 Working Party released a statement on 29 February welcoming the Commission's publication of the draft decision and related texts, and indicating its intention to adopt an opinion on its analysis of the documents in mid-April. Examination by Member State Committee: Next, a committee made up of representatives of each EU Member State will consider the draft decision. The decision must be approved by a qualified majority of the committee. Adoption of the Decision by the Commission: Once the draft decision has been through this procedure, the Commission may adopt the decision formally, and it will become effective. However, there a number of roadblocks that could derail or lengthen this process. First, at any time during the comitology procedure, the European Parliament or Council could...