EU–US Privacy Shield

From Wikipedia, the free encyclopedia
  (Redirected from EU-US Privacy Shield)
Jump to navigation Jump to search

The EU–U.S. Privacy Shield is a framework for regulating transatlantic exchanges of personal data for commercial purposes between the European Union and the United States.[1] One of its purposes is to enable US companies to more easily receive personal data from EU entities under EU privacy laws meant to protect European Union citizens.[2] The EU–US Privacy Shield is a replacement for the International Safe Harbor Privacy Principles, which were declared invalid by the European Court of Justice in October 2015.[3]


In October 2015 the European Court of Justice declared the previous framework called the International Safe Harbor Privacy Principles invalid.[3] Soon after this decision the European Commission and the U.S. Government started talks about a new framework and on February 2, 2016 they reached a political agreement.[1] The European Commission published the "adequacy decision" draft, declaring principles to be equivalent to the protections offered by EU law.[4]

The Article 29 Data Protection Working Party delivered an opinion on April 13, 2016, stating that the Privacy Shield offers major improvements compared to the Safe Harbor decisions, but that three major points of concern still remain. They relate to deletion of data, collection of massive amounts of data, and clarification of the new Ombudsperson mechanism.[5] The European Data Protection Supervisor issued an opinion on 30 May 2016 in which he stated that "the Privacy Shield, as it stands, is not robust enough to withstand future legal scrutiny before the [European] Court".[6]

On 8 July 2016 EU Member States representatives (article 31 committee) approved the final version of the EU-U.S. Privacy Shield, paving the way for the adoption of the decision by the Commission.[7] The European Commission adopted the framework on 12 July 2016 and it went into effect the same day.[8][9]

U.S. President Donald Trump signed an Executive Order entitled "Enhancing Public Safety" which states that U.S. privacy protections will not be extended beyond US citizens or residents:

Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.[10]

The European Commission has stated that:

The US Privacy Act has never offered data protection rights to Europeans. The Commission negotiated two additional instruments to ensure that EU citizens’ data is duly protected when transferred to the US:
  • The EU–U.S. Privacy Shield, which does not rely on the protections under the US Privacy Act.
  • The EU–US Umbrella Agreement, which enters into force on 1 February (2017). To finalize this agreement, the US Congress adopted a new law in 2017, the US Judicial Redress Act,[11] which extends the benefits of the US Privacy Act to Europeans and gives them access to US courts."[12]

The Commission said it will "continue to monitor the implementation of both instruments".[12]


German MEP Jan Philipp Albrecht and campaigner Max Schrems criticized the new ruling, with the latter predicting that the Commission might be taking a "round-trip to Luxembourg" (where the European Court of Justice (CJEU) is located).[13] Many Europeans demanded a mechanism for individual European citizens to lodge complaints over the use of their data, as well as a transparency scheme to assure that European citizens' data does not fall into the hands of U.S intelligence agencies.[14]


The Privacy Shield has been challenged legally by privacy groups.[15][16] As of November 2016, it is not clear whether the cases will be considered admissible.[17][18]

As of February 2017 the future of the Privacy Shield is contested. One consultant, Matt Allison, predicts that "The EU's citizen-driven, regulated model will swiftly come into conflict with the market forces of the US and the UK."[19] Allison summarizes a new paper in which the European Commission lays out its plans for adequacy decisions and global strategy.[20]

As of December 2019, an opinion has been published that may influence the CJEU decision. It outlines various scenarios that may result from the conflict in regimes. The author concludes that the opinion "should generate equal measures of relief and alarm for the U.S. government and for companies dependent on data transfers. A final judgment from the CJEU, which may or may not follow the advocate general’s recommendations, is expected in a few months." [21]

See also[edit]


  1. ^ a b European Commission - Press release: political agreement on framework
  2. ^ "The new transatlantic data "Privacy Shield"". The Economist. ISSN 0013-0613. Retrieved 2016-03-26.
  3. ^ a b Vera Jourová, "Commissioner Jourová's remarks on Safe Harbour EU Court of Justice judgement before the Committee on Civil Liberties, Justice and Home Affairs (LIBE)", 26 October 2015
  4. ^ "5 things you need to know about the EU-U.S. Privacy Shield agreement". PCWorld. Retrieved 2016-03-26.
  5. ^ Chapter 5 of Opinion 01/2016 on the EU – U.S. Privacy Shield draft adequacy decision, the Article 29 Data Protection Working Party
  6. ^ European Data Protection Supervisor, Privacy Shield: more robust and sustainable solution needed, 30 May 2016
  7. ^ Statement by European Commission Vice-President Ansip and Commissioner Jourová, Adoption by Member States of the EU-U.S. Privacy Shield, 8 July 2016
  8. ^ European Commission - Press release: launch privacy shield
  9. ^ Privacy Shield adequacy decision
  10. ^ Executive Order: Enhancing Public Safety in the Interior of the United States, Section 14, 25 January 2017, accessed 27 March 2017
  11. ^ Public Law 114-126, 24 February 2016
  12. ^ a b Muncaster, P., Trump Order Sparks Privacy Shield Fears, InfoSecurity Magazine, accessed 27 March 2017
  13. ^ Max Schrems: "EU US Privacy Shield" (Safe Harbor 1.1) "European Commission may be issuing a round-trip to Luxembourg" [1] 16:45 (2nd Feb. 2016), PDF retrieved 3rd Feb. 2016
  14. ^ Lomas, Natasha. "EU-US Data Transfers Won't Be Blocked While Privacy Shield Details Are Hammered Out, Says WP29". TechCrunch. Retrieved 2016-02-03.
  15. ^ Case T-670/16, Digital Rights Ireland v the commission, 16 Sep 2016
  16. ^ Case T-738/16, La Quadrature du Net and Others v. the Commission, 25 Oct 2016
  17. ^ Reuters article EU-U.S. personal data pact faces second legal challenge from privacy groups, 2 Nov 2016
  18. ^ Case information on T-738/16 at Curia
  19. ^ Allison, Matt. "A Template for Adequacy: EU Pitches for Data Protection Gold Standard, Feb 09, 2017". CircleID. Retrieved 2017-02-14.
  20. ^ "Exchanging and Protecting Personal Data in a Globalised World", 10.1.2017, COM(2017) 7 final". European Commission. Retrieved 2017-02-14.
  21. ^ Propp, Kenneth. "European Court of Justice Opinion Clouds Future of Transatlantic Commercial Data Transfers, December 24, 2019". Lawfare. Retrieved December 27, 2019.

External links[edit]