Yesterday the Article 31 Committee met to discuss the recently agreed privacy shield text, one of the last steps before the deal enters into force. Yesterday was also the day – as Commissioner Věra Jourová had expressed her wish for – the Article 31 Committee were supposed to agree by strong consent on the text – however things didn’t quite go as one could have hoped for.
On Friday 24 June, the European Commission and the U.S. government finally announced that an agreement on the text had been reached and that it would be sent to the Article 31 Committee for approval. However sandwiched between two historical press statements on Brexit, it was an important missed occasion for gathering support and trust in the text.
In the meantime, the unilateral support to the text from the representatives of 27 Member States and a representative from the UK with a new and unclear role within the Article 31 Committee, has been shaken up by an unexpectedly long waiting period and parallel events with high impact on the Committee members’ judgment call such as Brexit but also new inquiries from the Irish Data Protection Commissioner into the use of model contract clauses to transfer data across the Atlantic. Countries such as Slovenia and Austria are rumoured to abstain from positioning on the current text, which weakens the legal credibility of the text.
Wide support for the privacy shield deal will be crucial to ensure its longevity, as any weaknesses or loopholes in the text will be an open goal for privacy activists like Max Schrems who first brought Safe Harbour to Court and who are looking for an opportunity to challenge. This would create another, deeper phase of legal uncertainty for businesses, which would only be intensified by the Brexit factor.
Businesses and politicians alike agree to this and it also explains why last week at the Connected Citizen Summit in Amsterdam, two key stakeholders on the issue, namely Giovanni Butarelli the European Data Protection Supervisor and Isabelle Falque-Pierrotin, chair of the Article 29 Working Party, both supported the view that a two months delay to signing the deal would not be an issue, on the contrary the extra time could prove beneficial.
According to sources close to the negotiation table, the latest text has taken on board the critical points from the Article 29 Working Party Opinion in April. A key addition is a new commitment by the U.S. requiring the collection of bulk data to be focused and targeted. However it doesn’t add anything to the fundamental difference in approach to surveillance on each side of the Atlantic.
The new text has also clarified the role, legitimacy and accountability of the newly appointed American ombudsperson, who will be responsible for tracking violations of the deal and receiving privacy complaints.
It remains to be seen if the latest changes to the text will be sufficient for Member States. The British influence could be missed, with its longstanding relationship with the U.S., useful in the past to help broke a wide agreement. Will the Article 31 Committee give the deal a green light at their next meeting on Fourth of July, for fireworks on American Independence Day?