As the second annual EU-US Privacy Shield review begins, advocacy groups for business and digital technology in the EU have urged representatives to strengthen and maintain the existing privacy framework.
In a joint press release BusinessEurope, which represents business and industry in the EU, and DigitalEurope, representing the digital technology industry, called on the EU not to “turn off the taps” of data exchange at the 2018 EU-US Privacy Shield review.
With trade in services functionally reliant on transfers of data, the joint statement advised that neglecting the Privacy Shield would put US-EU data flows at risk, impacting the manufacturing, engineering, business-to-business and government goods and services sectors, among many others.
According to the joint statement: “The stability in EU-US data transfers provided by the EU-US Privacy Shield framework is part and parcel of the continued success of many sectors of the European economy…[w]e look forward to continued EU-US dialogue [at the EU-US Privacy Shield review] to strengthen practical implementation of the Privacy Shield framework.”
The Privacy Shield programme was designed by the USA Department of Commerce and the European Commission in order to provide businesses in the US and the EU with a mechanism to observe data protection restrictions when transferring personal data across the Atlantic. It is evaluated annually at the EU-US Privacy Shield review. US companies can join the programme voluntarily and self-certify through the Department of Commerce, renewing their certification every year.
Queries have been raised about the efficacy of the Privacy Shield, with critics calling it unfit for purpose. They point out sluggishness on the part of programme operators to make changes and take action over issues – recommendations made by the 2017 EU-US Privacy Shield review last October have not yet been entirely implemented; and the US ombudsman for national security issues, Judith Garber, was nominated by President Donald Trump as the US ambassador to Cyprus and has not yet been replaced.
Self-certification has also been raised as a concern, with Facebook and the now-bankrupt Cambridge Analytica self-certifying to the Privacy Shield with no pushback. In July 2018 the European Parliament adopted a resolution to suspend the programme unless the US took action to meet its obligations under the agreement by 1 September. As of the 2018 EU-US Privacy Shield review, neither has happened.
