The Article 29 Working Party (WP 29) published their initial response to the new Privacy Shield yesterday.

Here's the good news:

  • WP 29 welcomes the conclusion of negotiations by the deadline (actually, the deal was announced on Tuesday which is a couple of days late but let's overlook that).
  • WP 29 looks forward to receiving the relevant documents to analyse the detail. They want to look at the content and legal bindingness of the arrangement to assess whether it deals with the risk of massive and indiscriminate surveillance (as per the Schrems judgment).

Here's another interesting development:

  • WP 29 has been assessing the current legal framework and practices of US intelligence and has decided on 4 "essential guarantees" that will be required: (a) clear, precise and accessible rules on surveillance; (b) access to be proportionate at all times; (c) independent oversight mechanism (judge/independent body); and (d) effective remedies.

Next Steps

The Commission now has to deliver on the detail. It will communicate all documents pertaining to the new arrangement to WP 29 by the end of February. WP 29 will then run its assessment on the Privacy Shield proposal (it's not the law yet). It will also review other transfer mechanisms such as model clauses and BCRs.

What does this mean for business now?

  • Don't rely on the Privacy Shield just yet. It's not an "adequacy decision" and the detail needs to be provided and assessed.
  • Ensure data transfers are either covered by model clauses or BCRs or one of the other derogations.
  • As we recommended previously: do a "fact find" (to identify what data is collected and shared, data flows, data centres and purposes of onward transfer);
  • Consider prioritising data flows to ensure that model contracts are applied to the important data flows as early as possible;
  • Unless an alternative transfer mechanism in place, there is a risk of enforcement action. WP 29 is clear that you can no longer rely on old Safe Harbor.

Dentons is the world's first polycentric global law firm. A top 20 firm on the Acritas 2015 Global Elite Brand Index, the Firm is committed to challenging the status quo in delivering consistent and uncompromising quality and value in new and inventive ways. Driven to provide clients a competitive edge, and connected to the communities where its clients want to do business, Dentons knows that understanding local cultures is crucial to successfully completing a deal, resolving a dispute or solving a business challenge. Now the world's largest law firm, Dentons' global team builds agile, tailored solutions to meet the local, national and global needs of private and public clients of any size in more than 125 locations serving 50-plus countries. www.dentons.com.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.