April 26, 2019

April 25, 2019

Subscribe to Latest Legal News and Analysis

April 24, 2019

Subscribe to Latest Legal News and Analysis

April 23, 2019

Subscribe to Latest Legal News and Analysis

EU-U.S. Privacy Shield Package Released

Today, the European Commission published the text of the new EU-U.S. Privacy Shield (see the Commission’s press release here), which consists of:

  • a draft adequacy decision;

  • the EU-U.S. Privacy Shield Framework Principles issued by the U.S. Department of Commerce; and

  • the official representations and commitments contained in separate letters from:

    • Secretary of Commerce Penny Pritzker (Annex I);

    • Secretary of State John Kerry (Annex III);

    • Federal Trade Commission Chairwoman Edith Ramirez (Annex IV),

    • Secretary of Transportation, Anthony Foxx (Annex V);

    • General Counsel Robert Litt, Office of the Director of National Intelligence (Annex VI); and

    • Deputy Assistant Attorney General Bruce Swartz, U.S. Department of Justice (Annex VII).

In addition, the European Commission issued a Communication titled “Transatlantic Data Flows: Restoring Trust through Strong Safeguards” which presents the developments and the Commission’s findings since its critical 2013 Communication on the Functioning of the Safe Harbor, a Q&A and a Fact sheet.

Procedural next steps

The new framework for transatlantic data flows was announced February 2, 2016 (see EU Commission press release here). The draft adequacy decision which was released today has to be adopted via the “comitology” procedure.  This procedure will involve:

  • a non-binding opinion by Art. 29 Working Party.  This group is named after Article 29 of the Data Protection Directive and is made up of a representative from the data protection authority of each EU Member State, the European Data Protection Supervisor and the European Commission.Their opinion is expected by the end of March / mid-April;

  • a binding opinion by qualified majority of the Art. 31 Committee (composed of EU Member State representatives); and

  • the formal adoption of the adequacy decision by the EU College of Commissioners.

At any time up to the adoption of the decision, the European Parliament and the Council may request that the European Commission amend or withdraw the adequacy decision. The Commission aims at the formal adoption in June or early summer.

© 2019 Covington & Burling LLP


About this Author

Repeatedly ranked as having one of the best privacy practices in the world, Covington combines exceptional substantive expertise with an unrivaled understanding of the IT industry, and of e-commerce and digital media business models in particular.  Our practice provides exceptional coverage of all of the substantive areas of privacy, including IT/technology, data security, financial privacy, health privacy, employment privacy, litigation and transactions.  One of our core strengths is the ability to advise clients on relevant privacy and data security rules worldwide,...