The EU-US Privacy Shield (“Privacy Shield“) adequacy decision is set for joint review by the European Commission and the US Department of Commerce in June 2017.

Privacy Shield is an adequacy decision agreed between European and US authorities on 12 July 2016 which permits the transfer of personal data from the European Economic Area by European based companies to the US companies that are Privacy Shield certified. The review will be conducted on a mandatory basis in line with the terms of the Privacy Shield adequacy decision.

The Article 29 Working Party (the “A29WP“), a body composed of national data protection authorities, has stated that the joint review will be a “key moment” for national data protection authorities to challenge, assess and resolve:

• the inherent and outstanding issues with Privacy Shield (e.g. rights of individuals and the Privacy Shield Principles); and
• the effectiveness and practicalities of the Privacy Shield’s safeguards.

Until the formal joint review process is underway, it remains to be seen whether the A29WP, who has questioned the Privacy Shield adequacy decision from its first draft, will opt to formally challenge it once the year-long stay of execution expires.

It is clear that many organisations will keep a close eye on the joint review particularly since a challenge to the Privacy Shield adequacy decision was filed by Digital Rights Ireland to the EU General Court in 2016 (as previously reported by us here).

Follow us on Twitter @WFIDEA

Contributed by John Farrell