Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright size-full wp-image-4355" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2015/12/Data_Security_208x186.jpg" alt="Data_Security_208x186" width="208" height="186" />Digital Rights Ireland, an Irish privacy advocacy group, has filed the first legal challenge to the EU-U.S. Privacy Shield, the Trans-Atlantic agreement reached earlier this year to permit the lawful transfer of personal data from the European Union to the United States. The <a href="https://www.dataprivacymonitor.com/tag/privacy-shield/">Privacy Shield</a> was formally adopted on July 12, 2016, by the European Commission, which released an <a href="http://ec.europa.eu/justice/data-protection/files/privacy-shield-adequacy-decision_en.pdf">Adequacy Decision</a> concluding that “the United States ensures an adequate level of protection for personal data transferred under the EU-U.S. Privacy Shield from the Union to self-certified organisations in the United States.” <a href="https://www.digitalrights.ie/">Digital Rights Ireland’s</a> application to the EU General Court seeks annulment of the Commission’s Adequacy Decision. A spokesman for the European Commission <a href="http://www.reuters.com/article/us-eu-dataprotection-usa-idUSKCN12Q2JK">stated</a> that it was aware of the application and “is convinced that the Privacy Shield will live up to the requirements set out by the European Court of Justice.”

Very limited information regarding the case is publicly available at this time; the CJEU’s <a href="http://curia.europa.eu/juris/fiche.jsf?id=T%3B670%3B16%3BRD%3B1%3BP%3B1%3BT2016%2F0670%2FP&amp;pro=&amp;lgrec=en&amp;nat=or&amp;oqp=&amp;dates=&amp;lg=&amp;language=en&amp;jur=C%2CT%2CF&amp;cit=none%252CC%252CCJ%252CR%252C2008E%252C%252C%252C%252C%252C%252C%252C%252C%252C%252Ctrue%252Cfalse%252Cfalse&amp;num=T-670%252F16&amp;td=%3BALL&amp;pcs=Oor&amp;avg=&amp;mat=or&amp;jge=&amp;for=&amp;cid=782466">website</a> shows that the application for annulment (concerning an “area of freedom, security and justice”) was filed on September 16, 2016. The U.S. Department of Commerce <a href="https://www.dataprivacymonitor.com/international-privacy-law/privacy-shield-to-open-for-business-august-1/">began accepting applications</a> for self-certification to the Privacy Shield on Aug. 1, 2016.

Although the Article 29 Working Party <a href="http://ec.europa.eu/justice/data-protection/article-29/press-material/press-release/art29_press_material/2016/20160726_wp29_wp_statement_eu_us_privacy_shield_en.pdf">issued a statement</a> in late July indicating that EU data protection authorities themselves would not challenge the validity of the Privacy Shield for at least a year, many expected some form of legal challenge in the interim. Digital Rights Ireland’s application for annulment is permitted under an EU treaty allowing individuals or companies to seek an annulment of an EU act before the EU Court of Justice or General Court if they can prove direct or individual concern with the act.

Currently more than 600 companies are included on the Department of Commerce’s <a href="https://www.privacyshield.gov/list">Privacy Shield List</a> of self-certified entities, with more being added each week.

&nbsp;

Privacy Rights Group Files First Legal Challenge to EU-U.S. Privacy Shield