The European Parliament has voted for the suspension of the Privacy Shield unless the U.S. complies by 1 September 2018. The non-binding resolution was passed 303 to 223 votes, with 29 abstentions. Parliament takes the view that the current Privacy Shield arrangement does not provide the adequate level of protection required by EU data protection law and the EU Charter as interpreted by the European Court of Justice (CJEU). It considers that, if the US is not fully compliant by 1 September, then the Commission has failed to act in accordance with Article 45(5) GDPR and the Commission should suspend the Privacy Shield until the US authorities comply with its terms.
Following the Facebook-Cambridge Analytica data breach, Parliament emphasised the need for better monitoring of the Shield, given that both companies are certified under the Shield. Parliament is also concerned about the recent adoption in the US of the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) which permits the US and foreign police to access personal data stored in Europe; the reauthorisation of FISA Section 702, and the failure to appoint members to the Privacy and Civil Liberties Oversight Board (PCLOB). Parliament’s vote follows a statement in May 2018 from its Committee on Civil Liberties, Justice and Home Affairs calling upon the Commission to suspend the Shield.
Earlier this week, the US Ombudsperson responsible for handling national security complaints under the Privacy Shield, Ambassador Judith Garber, was invited to a plenary meeting of the European Data Protection Board (EDPB). The EDPB addressed raised by the EDPB’s predecessor WP29, especially the appointment of a permanent Ombudsperson, formal appointments to the PCLOB, and the lack of additional information on the Ombudsperson mechanism and further declassification of the procedural rules, in particular on how the Ombudsperson interacts with the intelligence services. The EDPB called for supplementary evidence to be given by the US authorities in order to address these concerns. The EDPB noted that the same concerns will be addressed by the CJEU in cases that are already pending, and to which the EDPB offered to contribute its view, if invited by the CJEU.