Statement of the WP29 on the “EU – U.S. Privacy Shield”
After the Press Conference held by Věra Jourová and Andrus Ansip from the European Commission about the proposal for a new agreement between EU and U.S. to carry out international data transfers, the WP29 met on the 2-3 February in order to discuss the consequences of the sentence from the ECJ and the future of international data transfers between EU and the U.S.
The WP29 has remarked that the following four guarantees should be ensured when international data transfers take place:
a) Transparency: the data subject whose data is processed should be informed so that he/she is able to foreseen the consequences of the data transfer.
b) Proportionality and necessity: the finality for which personal data is collected and accessed and the rights of the data subject should be balanced.
c) Independency of a control body that carries out checks in an effective and impartial manner.
d) Effective remedies: the individual should have the possibility to defend his/her rights before an independent body.
The WP29 will also analyze the existing mechanisms to carry out international data transfers, which currently can only take place if Standard Contractual Clauses or Binding Corporate Rules (BCR) are used. In any case, European DPAs will examine data transfers on a case-by-case basis.
However, the WP29 is still looking forward to receive the relevant documents related to the EU – U.S. Privacy Shield in order to analyze its content and to determine to which extent the agreement is legally binding.
If you would like to be updated on a regular basis on this and other data protection issues such as the General Data Protection Directive (GDPR), sign in for one of our newsletters:
German / European Data Protection http://www.datenschutzticker.de/newsletter/ (German Language)
International Data Protection http://www.privacy-ticker.com/newsletter/ (English language)
For how to proceed with your companies´ policies on internal or external data protection transfers to third countries and prepare for the GDPR seek individual advice.
