Brussels, Belgium - Today, the European Commission announced that it has reached a new agreement with the United States on data transfer between the E.U. and U.S. The so-called Safe Harbor agreement will now be called the “E.U.-U.S. Privacy Shield.”
According to a statement by the European Commission, a draft outline will be presented tomorrow to European data protection authorities, and it will then take a few weeks to finalize the language of the framework and get adoption on both sides.
This announcement comes in the wake of three months of intense negotiations after the previous Safe Harbor mechanism was invalidated by the Court of Justice of the European Union (“CJEU”).
“Today’s deal is an attempt at a political fix to a legal problem. Contrary to the announcement from the Commission, we have no indication of how users’ privacy will be protected or how it provides companies with legal certainty about the future,” said Estelle Massé, European Policy Analyst at Access Now. “Since both sides failed to conduct the necessary surveillance and privacy reforms, this deal is not fit to resist future legal challenges. ”
The ruling that invalidated the Safe Harbor agreement called for substantial reform to upgrade protection for users’ privacy. From a data protection perspective, this would mean, at a minimum, implementing the European Commission’s 13 recommendations from 2013 for improving the Safe Harbor agreement. However, to adequately protect privacy following the CJEU ruling, it would take more than that; in knocking down the agreement, the CJEU specifically called out government surveillance practices.
Access Now believes that it’s necessary to make robust legislative changes to meet the requirements that follow from the CJEU’s decision. Only this would create a meaningful agreement that could withstand further legal scrutiny. Rather than work toward that goal, however, the U.S. and some E.U. member states have taken giant steps backward since the decision was published. They have enacted new surveillance laws that unnecessarily trample on users’ privacy and infringe upon free expression. Even the limited benefit provided by the much-trumpeted Judicial Redress Act will be eclipsed by the 11th-hour exceptions and qualifications advanced by the U.S. Senate. Today’s political agreement disregards these facts and is a major setback for users’ rights globally.
“It is disheartening that the U.S. Congress was unable to pass anything by way of meaningful surveillance reform, though they have pushed through provisions that further infringe upon privacy rights,” said Amie Stepanovich, U.S. Policy Manager at Access Now. “Users benefit from a free and open internet, where they can explore freely without being locked in a closed environment. A rights-respecting data transfer agreement between the E.U. and the U.S. would allow users to engage meaningfully with one another in the digital space, but it is unclear if the ‘Privacy Shield’ gets us there.”
“It is not only in the U.S. where reforms are needed,” added Massé. “The E.U. member states have approved and implemented some of the most invasive surveillance authorities on record, and also need to be reined in. The global state of surveillance is a threat to all users.”
Access Now urges the U.S. Congress, the Obama Administration, the European Parliament, and E.U. member states to oppose this deal and work toward legislative reform that protects our rights.
Media Contacts
Amie Stepanovich
U.S. Policy Manager, Access Now
Estelle Massé
European Policy Analyst, Access Now