June 7, 2016

In the Resolution, passed by 501 votes to 119 with 31 abstentions, MEPs welcome the efforts of the Commission and the US administration to achieve “substantial improvements” in the Privacy Shield compared to the Safe Harbour decision, which it is to replace.

However, they also voice concern about “deficiencies” in the proposed new arrangement negotiated by the Commission, notably:

• the US authorities’ access to data transferred under the Privacy Shield;
• the collection of bulk data, which in some cases does not meet the criteria of “necessity” and “proportionality” as laid down in the EU Charter of Fundamental Rights;
• the proposed US ombudsperson, a new institution that MEPs accept is a step forward, but believe to be neither “sufficiently independent”, nor “vested with adequate powers to effectively exercise and enforce its duty”; and
• the complexity of the redress mechanism, which the Commission and US administration need to make more “user-friendly and effective”.

The European Parliament stresses that the Privacy Shield framework should give EU Member States’ data protection authorities a prominent role in examining data protection claims and notes their power to suspend data transfers.  It also notes the obligation placed upon the US Department of Commerce to resolve complaints.

Finally, MEPs call on the Commission to conduct periodic “robust reviews” of its decision that Privacy Shield protection is adequate, particularly once the new EU data protection rules take effect in two years time.  To read the European Parliament’s press release in full and for a link to the Resolution, click here.