European Data Watchdog WP29 Mulls Data-Sharing Deal

The working group of European data protection watchdogs, known as WP29, has revealed it will take a couple of months to examine the new data sharing agreement between the EU and the United States.

The new transatlantic data sharing agreement was reached earlier this week and technically replaces the previous Safe Harbour legislation that was ruled invalid by Europe’s top court on 6 October last year.

New Deal

The suspension of previous Safe Harbour deal caused a great deal of anxiety for many firms, especially since they could potentially face legal action over the matter

But it seems that the late arrival of the new deal, means that businesses still face a period of uncertainty, as WP29 will take time to examine the agreement to determine whether the United States was committed to limiting intelligence surveillance of Europeans.

“We want to receive the documents in order to assess whether this (newly agreed) EU-U.S. Privacy Shield can answer the privacy concerns raised,” Isabelle Falque-Pierrotin, chair of the WP29 grouping of data protection authorities, was quoted by Reuters as saying.

Although WP29 only issues recommendations, it is influential as its members enforce data protection across Europe, and the European Commission has asked for its expert guidance on the new pact.

Falque-Pierrotin reportedly said the group expected to have relevant documents by the end of February and to be able to reach a conclusion by the end of April.

Pending its final verdict, some data transfers will not be allowed, she added.

“We have concerns on the transfer regarding the scope of surveillance and particularly the remedies. The question is whether the (new) arrangement answers these concerns or not,” Falque-Pierrotin was quoted as saying.

Business Uncertainty

And at least one think tank also believes that businesses face a couple of months of uncertainty until the March conclusion.

“Art.29 WP (a college all EU countries data protection authorities) statement on the newly agreed EU-US Privacy Shield can be best described as “cautiously positive,” said Bojana Bellamy, President of Hunton & Williams LLP’s Centre for Information Policy Leadership.

“They welcome the new deal, but still have some concerns over practices of the US surveillance agencies and effective remedies for Europeans in the US,” said Bellamy. “They also have to examine in detail the actual substantive data protection requirements of Privacy Shield and will give the final pronouncement by the end of March. They will also examine other transfer mechanisms (contracts and binding corporate rules) in light of the new deal between the US and EU.

“This means that there is still some uncertainty for business,” warned Bellamy. “What is certain is that the old Safe Harbour is dead and buried. It is also certain businesses can continue to use other data transfer mechanisms (contracts and corporate codes) to provide protection for Europeans’ data in the US, but only for the time being and until Art. 29WP confirms either way at the end of March.”

Enforcement Action?

“One has to stay optimistic that legal reason, legal certainty and pragmatism will prevail and Art. 29WP will both “bless” the new Privacy Shield and continued use of other data transfer mechanisms,” concluded Bellamy.

That said, Techcrunch reported that WP29 will not be taking enforcement action against companies using alternative transfer mechanisms.

WP29 reportedly admitted it has concerns about the legality of transfer mechanisms, in light of US intelligence agencies’ access to European citizens’ data. However it is suspending these concerns until it gets the details of the new data transfer deal.

“We will have to receive the proper documents on this announcement because it’s still words from the Commission,” Isabelle Falque-Pierrotin, chair of the WP29 and head of France’s CNIL DPA, was quoted as telling reporters. “The legal format of the arrangement is still unclear for us.”

What do you know about privacy? Try our quiz!