Ασπίδα προστασίας της ιδιωτικής ζωής ΕΕ-ΗΠΑ: Δελτίο Τύπου της Ευρωπαϊκής Επιτροπής

Η Ευρωπαϊκή Επιτροπή δημοσίευσε την πρώτη ετήσια έκθεσή της σχετικά με τη λειτουργία της ασπίδας προστασίας της ιδιωτικής ζωής ΕΕ-ΗΠΑ, σκοπός της οποίας είναι η προστασία των δεδομένων προσωπικού χαρακτήρα οποιουδήποτε ατόμου στην ΕΕ, όταν τα δεδομένα αυτά διαβιβάζονται σε εταιρείες στις ΗΠΑ για εμπορικούς σκοπούς.

Ο αντιπρόεδρος της Επιτροπής, κ. Andrus Ansip, αρμόδιος για την Ψηφιακή Ενιαία Αγορά, δήλωσε σχετικά: «η Επιτροπή υποστηρίζει σθεναρά τη ρύθμιση για την ασπίδα προστασίας της ιδιωτικής ζωής με τις ΗΠΑ. Οι σίγουρες και ασφαλείς διαβιβάσεις δεδομένων σε διεθνές επίπεδο είναι προς όφελος των πιστοποιημένων εταιρειών και των Ευρωπαίων καταναλωτών και επιχειρήσεων, στις οποίες περιλαμβάνονται και οι ΜΜΕ της ΕΕ. Η πρώτη ετήσια επανεξέταση αποδεικνύει τη δέσμευσή μας για τη δημιουργία ισχυρού συστήματος πιστοποίησης και εποπτείας.

Η επίτροπος Δικαιοσύνης, Καταναλωτών και Ισότητας των Φύλων, κ. Věra Jourová, δήλωσε: «οι διατλαντικές διαβιβάσεις δεδομένων έχουν πολύ μεγάλη σημασία για την οικονομία μας, αλλά το θεμελιώδες δικαίωμα για την προστασία των δεδομένων πρέπει να διασφαλίζεται όταν δεδομένα προσωπικού χαρακτήρα αποστέλλονται εκτός ΕΕ. Από την πρώτη έκθεσή μας για την επανεξέταση προκύπτει ότι η ασπίδα προστασίας της ιδιωτικής ζωής λειτουργεί ικανοποιητικά, ωστόσο υπάρχουν ακόμη περιθώρια βελτίωσης της εφαρμογής της. Η ασπίδα προστασίας της ιδιωτικής ζωής δεν είναι ένα έγγραφο σε κάποιο συρτάρι. Είναι μια ζωντανή ρύθμιση την οποία τόσο η ΕΕ όσο και οι ΗΠΑ πρέπει να παρακολουθούν στενά για να εξασφαλίσουμε την τήρηση των υψηλών μας προτύπων για την προστασία των δεδομένων.

Όταν η ασπίδα προστασίας της ιδιωτικής ζωής τέθηκε σε εφαρμογή τον Αύγουστο του 2016, η Επιτροπή δεσμεύτηκε να επανεξετάζει τη ρύθμιση για την ασπίδα προστασίας της ιδιωτικής ζωής σε ετήσια βάση, ώστε να αξιολογεί αν εξακολουθεί να διασφαλίζει επαρκές επίπεδο προστασίας των δεδομένων προσωπικού χαρακτήρα. Η σημερινή έκθεση βασίζεται στις συνεδριάσεις με όλες τις αρμόδιες αρχές των ΗΠΑ που πραγματοποιήθηκαν στην Ουάσιγκτον στα μέσα Σεπτεμβρίου του 2017, καθώς και σε εισηγήσεις από ευρύ φάσμα ενδιαφερόμενων μερών (συμπεριλαμβανομένων εκθέσεων από εταιρείες και ΜΚΟ). Στη διαδικασία της επανεξέτασης συμμετείχαν και ανεξάρτητες αρχές προστασίας δεδομένων από κράτη μέλη της ΕΕ.

Γενικά, η έκθεση αποδεικνύει ότι η ασπίδα προστασίας της ιδιωτικής ζωής εξακολουθεί να διασφαλίζει επαρκές επίπεδο προστασίαςτων δεδομένων προσωπικού χαρακτήρα που διαβιβάζονται από την ΕΕ στις συμμετέχουσες εταιρείες στις ΗΠΑ. Οι αρχές των ΗΠΑ έχουν θέσει σε εφαρμογή τις απαραίτητες δομές και διαδικασίες για να εξασφαλίσουν τη σωστή λειτουργία της ασπίδας προστασίας της ιδιωτικής ζωής, όπως είναι οι νέες δυνατότητες έννομης προστασίας για τους πολίτες της ΕΕ. Η διαχείριση των καταγγελιών και οι διαδικασίες επιβολής της νομοθεσίας έχουν οργανωθεί και η συνεργασία με τις ευρωπαϊκές αρχές προστασίας των δεδομένων έχει ενισχυθεί. Η διαδικασία πιστοποίησης λειτουργεί ικανοποιητικά - περισσότερες από 2 400 εταιρείες έχουν πλέον πιστοποιηθεί από το Υπουργείο Εμπορίου των ΗΠΑ. Όσον αφορά την πρόσβαση των δημόσιων αρχών των ΗΠΑ σε δεδομένα προσωπικού χαρακτήρα για λόγους εθνικής ασφάλειας, εξακολουθούν να ισχύουν οι σχετικές διασφαλίσεις από την πλευρά των ΗΠΑ. 

Συστάσεις για την περαιτέρω βελτίωση της λειτουργία της ασπίδας προστασίας της ιδιωτικής ζωής

Η έκθεση περιλαμβάνει μια σειρά από συστάσεις προκειμένου να διασφαλιστεί η συνέχιση της επιτυχημένης λειτουργίας της ασπίδας προστασίας της ιδιωτικής ζωής. Στις συστάσεις αυτές, μεταξύ άλλων, περιλαμβάνονται και τα ακόλουθα:

• Εντατικοποίηση της προενεργού και τακτικής παρακολούθησης εκ μέρους του Υπουργείου Εμπορίου των ΗΠΑ όσον αφορά τη συμμόρφωση των εταιρειών με τις υποχρεώσεις τους που απορρέουν από τη ρύθμιση για την ασπίδα προστασίας της ιδιωτικής ζωής. Το Υπουργείο Εμπορίου των ΗΠΑ θα πρέπει επίσης να διενεργεί τακτικές έρευνες σχετικά με εταιρείες οι οποίες προβάλλουν ψευδείς ισχυρισμούς για τη συμμετοχή τους στην ασπίδα προστασίας της ιδιωτικής ζωής.
• Αύξηση της ευαισθητοποίησης των ιδιωτών στην ΕΕ σχετικά με τον τρόπο άσκησης των δικαιωμάτων τους στο πλαίσιο της ασπίδας προστασίας της ιδιωτικής ζωής, ιδίως σχετικά με τον τρόπο υποβολής καταγγελιών.
• Στενότερη συνεργασία μεταξύ των φορέων επιβολής της νομοθεσίας για την προστασία της ιδιωτικής ζωής, δηλ. του Υπουργείου Εμπορίου των ΗΠΑ, της Ομοσπονδιακής Επιτροπής Εμπορίου και των αρχών προστασίας των δεδομένων της ΕΕ, κυρίως με σκοπό την ανάπτυξη κατευθυντήριων γραμμών για τις εταιρείες και τις αρχές επιβολής της νομοθεσίας.
• Κατοχύρωση της προστασίας των μη Αμερικανών που παρέχεται από την προεδρική οδηγία πολιτικής 28 (PPD-28), στο πλαίσιο της εν εξελίξει συζήτησης στις ΗΠΑ για την επανακύρωση και μεταρρύθμιση του τμήματος 702 του νόμου περί παρακολούθησης αλλοδαπών υπηρεσιών πληροφοριών (FISA).
• Να οριστεί το συντομότερο δυνατόν ένας μόνιμος Διαμεσολαβητής της ασπίδας προστασίας της ιδιωτικής ζωής, καθώς και να πληρωθούν οι κενές θέσεις των μελών της Επιτροπής Εποπτείας της Ιδιωτικής Ζωής και των Ατομικών Ελευθεριών (PCLOB).

Επόμενα βήματα

Η έκθεση θα διαβιβαστεί στο Ευρωπαϊκό Κοινοβούλιο, στο Συμβούλιο, στην ομάδα εργασίας του άρθρου 29 στην οποία εκπροσωπούνται οι αρχές προστασίας δεδομένων και στις αρχές των ΗΠΑ. Η Επιτροπή θα συνεργαστεί με τις αρχές των ΗΠΑ για την παρακολούθηση των συστάσεών της κατά τους προσεχείς μήνες. Η Επιτροπή θα συνεχίσει να παρακολουθεί εκ του σύνεγγυς τη λειτουργία του πλαισίου της ασπίδας προστασίας της ιδιωτικής ζωής, καθώς και τη συμμόρφωση των αρχών των ΗΠΑ με τις δεσμεύσεις τους.

Ιστορικό

Η απόφαση για την ασπίδα προστασίας της ιδιωτικής ζωής ΕΕ-ΗΠΑ εκδόθηκε στις 12 Ιουλίου 2016 και το πλαίσιο της ασπίδας προστασίας της ιδιωτικής ζωής άρχισε να λειτουργεί την 1η Αυγούστου 2016. Το πλαίσιο αυτό προστατεύει τα θεμελιώδη δικαιώματα των πολιτών της ΕΕ κατά τη διαβίβαση δεδομένων προσωπικού χαρακτήρα στις Ηνωμένες Πολιτείες για εμπορικούς σκοπούς και παρέχει νομική σαφήνεια στις επιχειρήσεις που βασίζονται στις διατλαντικές διαβιβάσεις δεδομένων.

Για παράδειγμα, όταν ψωνίζουμε μέσω του διαδικτύου ή χρησιμοποιούμε τα κοινωνικά μέσα δικτύωσης στην ΕΕ, κάποιο υποκατάστημα ή επιχειρηματικός εταίρος συμμετέχουσας αμερικανικής εταιρείας μπορεί να συλλέγει δεδομένα προσωπικού χαρακτήρα στην ΕΕ και στη συνέχεια να τα διαβιβάζει στις ΗΠΑ. Π.χ. ένας ταξιδιωτικός πράκτορας στην ΕΕ μπορεί να στέλνει ονοματεπώνυμα, στοιχεία επικοινωνίας και αριθμούς πιστωτικών καρτών σε κάποιο ξενοδοχείο στις ΗΠΑ το οποίο έχει εγγραφεί στην ασπίδα προστασίας της ιδιωτικής ζωής.

Περισσότερες πληροφορίες

Έκθεση και έγγραφο εργασίας των υπηρεσιών της Επιτροπής σχετικά με την ετήσια επανεξέταση για τη λειτουργία της ασπίδας προστασίας της ιδιωτικής ζωής ΕΕ-ΗΠΑ

European Parliament Resolution with regard the Privacy Shield Rules

The Commission adopted on 12 July 2016 its decision on the EU-U.S. Privacy Shield.
See: http://europa.eu/rapid/press-release_IP-16-2461_en.htm

This new framework protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States as well as bringing legal clarity for businesses relying on transatlantic data transfers. The new arrangement includes:

• strong data protection obligations on companies receiving personal data from the EU
• safeguards on U.S. government access to data;
• effective protection and redress for individuals;
• annual joint review to monitor the implementation.

The new arrangement lives up to the requirements of the European Court of Justice. On 6 October 2015, the Court of Justice of the European Union had declared the Commission’s 2000 Decision on EU-US Safe Harbour invalid. So far, more than 1,900 companies have joined the scheme.

However, new rules were adopeted recently, which allow the US National Security Agency (NSA) to share private data with other US agencies without court oversight. Moreover, recent revelations about surveillance activities by a US electronic communications service provider and vacancies on US oversight bodies have brought about concerns raised by MEPs in a resolution passed on Thursday.

In the resolution, adopted by 306 votes to 240, with 40 abstentions, MEPs call on the EU Commission to conduct a proper assessment and ensure that the EU-US “Privacy Shield” for data transferred for commercial purposes provides enough personal data protection for EU citizens to comply with the EU Charter of Fundamental Rights and new EU data protection rules. The first annual review of the Privacy Shield framework is expected in September.

"This resolution aims to ensure that the Privacy Shield stands the test of time and that it does not suffer from critical weaknesses”, said Civil Liberties Committee Chair Claude Moraes (S&D, UK). “We acknowledge the significant improvements made compared to the former EU-US Safe Harbour, but there are clearly deficiencies that remain to be urgently resolved to provide legal certainty for the citizens and businesses that depend on this agreement”, he added.

MEPs are particularly worried about recent revelations about surveillance activities conducted by a US electronic communications service provider at the request of the NSA and FBI in 2015, one year after Presidential Policy Directive 28 limited the amount of data intelligence that can be collected and processed, new rules that from January 2017 allow the NSA to share vast amounts of private data, gathered without warrant, court orders or congressional authorisation, with 16 other agencies, including the FBI, the rejection of rules to protect the privacy of broadband customers by the Senate and the House of Representatives in March, which “ eliminates (…) rules that would have required internet service providers to get consumers’ explicit consent before selling or sharing web browsing data and other private information with advertisers and other private companies”, vacancies on the Privacy and Civil Liberties Oversight Board, which means that it lost its quorum on 7 January, making it more limited in its authority, while at the same time the Federal Trade Commission, which enforces the Privacy Shield, has three of its five seats vacant, insufficient independence of the Ombudsperson mechanism set up by the US Department of State plus the fact that the incoming US administration has not appointed a new Ombudsperson , and the fact that neither the Privacy Shield Principles nor letters from the US administration demonstrate the existence of effective judicial redress rights for EU individuals whose data are transferred to the US.

Source: http://www.europarl.europa.eu/news/en/news-room/20170329IPR69067/data-privacy-shield-meps-alarmed-at-undermining-of-privacy-safeguards-in-the-us

EU-U.S. Privacy Shield

Today the European Commission adopted the EU-U.S. Privacy Shield, i.e. an adequacy decision to allow the transfer of personal data from the EU to the U.S.

This new agreement replaces the Safe Harbor Agreement, which was based on the Commission Decision 2000/520/EC of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce (OJ 2000 L 215, p. 7).

The Safe Harber Agreement was declared invalid by the CJEU  in the Case C-362/14 Maximillian Schrems v Data Protection Commissioner. See Press Release 6.10.2015. Therefore, it had to be renogotiated and so was, the EU - US Privacy Shield scheme adopted.

The European Digital Rights organization has qualified this agreement as a privacy sham ! See here


It follows the Press release of the EU Commission:

European Commission - Press release

European Commission launches EU-U.S. Privacy Shield: stronger protection for transatlantic data flows

Brussels, 12 July 2016

Today the European Commission adopted the EU-U.S. Privacy Shield.

This new framework protects the fundamental rights of anyone in the EU whose personal data is transferred to the United States as well as bringing legal clarity for businesses relying on transatlantic data transfers.

Andrus Ansip, Commission Vice-President for the Digital Single Market, said: "We have approved the new EU-U.S. Privacy Shield today. It will protect the personal data of our people and provide clarity for businesses. We have worked hard with all our partners in Europe and in the US to get this deal right and to have it done as soon as possible. Data flows between our two continents are essential to our society and economy – we now have a robust framework ensuring these transfers take place in the best and safest conditions".

Věra Jourová, Commissioner for Justice, Consumers and Gender Equality said: "The EU-U.S. Privacy Shield is a robust new system to protect the personal data of Europeans and ensure legal certainty for businesses. It brings stronger data protection standards that are better enforced, safeguards on government access, and easier redress for individuals in case of complaints. The new framework will restore the trust of consumers when their data is transferred across the Atlantic. We have worked together with the European data protection authorities, the European Parliament, the Member States and our U.S. counterparts to put in place an arrangement with the highest standards to protect Europeans' personal data".

The EU-U.S. Privacy Shield is based on the following principles:

• Strong obligations on companies handling data: under the new arrangement, the U.S. Department of Commerce will conductregular updates and reviews of participating companies, to ensure that companies follow the rules they submitted themselves to. If companies do not comply in practice they face sanctions and removal from the list. The tightening of conditions for the onward transfers of data to third parties will guarantee the same level of protection in case of a transfer from a Privacy Shield company.

• Clear safeguards and transparency obligations on U.S. government access: The US has given the EU assurance that the access of public authorities for law enforcement and national security is subject to clear limitations, safeguards and oversight mechanisms. Everyone in the EU will, also for the first time, benefit from redress mechanisms in this area. The U.S. has ruled out indiscriminate mass surveillance on personal data transferred to the US under the EU-U.S. Privacy Shield arrangement. The Office of the Director of National Intelligence further clarified that bulk collection of data could only be used under specific preconditions and needs to be as targeted and focused as possible. It details the safeguards in place for the use of data under such exceptional circumstances. The U.S. Secretary of State has established a redress possibility in the area of national intelligence for Europeans through anOmbudsperson mechanism within the Department of State.

• Effective protection of individual rights: Any citizen who considers that their data has been misused under the Privacy Shield scheme will benefit from several accessible and affordable dispute resolution mechanisms. Ideally, the complaint will be resolved by the company itself; or free of charge Alternative Dispute resolution (ADR) solutions will be offered. Individuals can also go to theirnational Data Protection Authorities, who will work with the Federal Trade Commission to ensure that complaints by EU citizens are investigated and resolved. If a case is not resolved by any of the other means, as a last resort there will be anarbitration mechanism. Redress possibility in the area of national security for EU citizens' will be handled by an Ombudspersonindependent from the US intelligence services.
• Annual joint review mechanism: the mechanism will monitor the functioning of the Privacy Shield, including the commitments and assurance as regards access to data for law enforcement and national security purposes. The European Commission and the U.S. Department of Commerce will conduct the review and associate national intelligence experts from the U.S. and European Data Protection Authorities. The Commission will draw on all other sources of information available and will issue a public report to the European Parliament and the Council.

Since presenting the draft Privacy Shield in February, the Commission has drawn on the opinions of the European data protection authorities (Art. 29 working party) and the European Data Protection Supervisor, and the resolution of the European Parliament to include a number of additional clarifications and improvements. The European Commission and the U.S. notably agreed on additional clarifications on bulk collection of data, strengthening the Ombudsperson mechanism, and more explicit obligations on companies as regards limits on retention and onward transfers. 

Next steps: The "adequacy decision" will be notified today to the Member States and thereby enter into force immediately. On the U.S. side, the Privacy Shield framework will be published in the Federal Register, the equivalent to our Official Journal. The U.S. Department of Commerce will start operating the Privacy Shield. Once companies have had an opportunity to review the framework and update their compliance, companies will be able to certify with the Commerce Department starting August 1. In parallel, the Commission will publish a short guide for citizens explaining the available remedies in case an individual considers that his personal data has been used without taking into account the data protection rules.

Background

On 2 February 2016 the European Commission and the U.S. Government reached a political agreement on a new framework for transatlantic exchanges of personal data for commercial purposes: the EU-U.S. Privacy Shield (IP/16/216). The Commission presented the draft decision texts on 29 February 2016. Following the opinion of the article 29 working party (data protection authorities) of 13 April and the European Parliament resolution of 26 May, the Commission finalised the adoption procedure on 12 July 2016.

The EU-U.S. Privacy Shield reflects the requirements set out by the European Court of Justice in its ruling on 6 October 2015, which declared the old Safe Harbour framework invalid.

For more information

Adequacy decision

(This decision enters into force upon notification to Member States)

Annexes

Q&A

Factsheet

Communication: Transatlantic Data Flows: Restoring Trust through Strong Safeguards

EU Commission and United States agree on new framework for transatlantic data flows: EU-US Privacy Shield

Press release

The European Commission and the United States have agreed on a new framework for transatlantic data flows: the EU-US Privacy Shield.

Today, the College of Commissioners approved the political agreement reached and has mandated Vice-President Ansip and CommissionerJourová to prepare the necessary steps to put in place the new arrangement. This new framework will protect the fundamental rights of Europeans where their data is transferred to the United States and ensure legal certainty for businesses. 

The EU-US Privacy Shield reflects the requirements set out by the European Court of Justice in its ruling on 6 October 2015, which declared the old Safe Harbour framework invalid. The new arrangement will provide stronger obligations on companies in the U.S. to protect the personal data of Europeans and stronger monitoring and enforcement by the U.S. Department of Commerce and Federal Trade Commission (FTC), including through increased cooperation with European Data Protection Authorities. The new arrangement includes commitments by the U.S. that possibilities under U.S. law for public authorities to access personal data transferred under the new arrangement will be subject to clear conditions, limitations and oversight, preventing generalised access. Europeans will have the possibility to raise any enquiry or complaint in this context with a dedicated new Ombudsperson. 

Vice-President Ansip said: "We have agreed on a new strong framework on data flows with the US. Our people can be sure that their personal data is fully protected. Our businesses, especially the smallest ones, have the legal certainty they need to develop their activities across the Atlantic. We have a duty to check and we will closely monitor the new arrangement to make sure it keeps delivering. Today's decision helps us build a Digital Single Market in the EU, a trusted and dynamic online environment; it further strengthens our close partnership with the US. We will work now to put it in place as soon as possible."

Commissioner Jourová said: "The new EU-US Privacy Shield will protect the fundamental rights of Europeans when their personal data is transferred to U.S. companies. For the first time ever, the United States has given the EU binding assurances that the access of public authorities for national security purposes will be subject to clear limitations, safeguards and oversight mechanisms. Also for the first time, EU citizens will benefit from redress mechanisms in this area. In the context of the negotiations for this agreement, the US has assured that it does not conduct mass or indiscriminate surveillance of Europeans. We have established an annual joint review in order to closely monitor the implementation of these commitments."

The new arrangement will include the following elements: 

• Strong obligations on companies handling Europeans' personal data and robust enforcement: U.S. companies wishing to import personal data from Europe will need to commit to robust obligations on how personal data is processed and individual rights are guaranteed. The Department of Commerce will monitor that companies publish their commitments, which makes them enforceable under U.S. law by the US. Federal Trade Commission. In addition, any company handling human resources data from Europe has to commit to comply with decisions by European DPAs. 

• Clear safeguards and transparency obligations on U.S. government access: For the first time, the US has given the EU written assurances that the access of public authorities for law enforcement and national security will be subject to clear limitations, safeguards and oversight mechanisms. These exceptions must be used only to the extent necessary and proportionate. The U.S. has ruled out indiscriminate mass surveillance on the personal data transferred to the US under the new arrangement. To regularly monitor the functioning of the arrangement there will be an annual joint review, which will also include the issue of national security access. The European Commission and the U.S. Department of Commerce will conduct the review and invite national intelligence experts from the U.S. and European Data Protection Authorities to it. 

• Effective protection of EU citizens' rights with several redress possibilities: Any citizen who considers that their data has been misused under the new arrangement will have several redress possibilities. Companies have deadlines to reply to complaints. European DPAs can refer complaints to the Department of Commerce and the Federal Trade Commission. In addition, Alternative Dispute resolution will be free of charge. For complaints on possible access by national intelligence authorities, a new Ombudsperson will be created. 

Next steps

The College has today mandated Vice-President Ansip and Commissioner Jourová to prepare a draft "adequacy decision" in the coming weeks, which could then be adopted by the College after obtaining the advice of the Article 29 Working Party and after consulting a committee composed of representatives of the Member States. In the meantime, the U.S. side will make the necessary preparations to put in place the new framework, monitoring mechanisms and new Ombudsman. 

Background

On 6 October, the Court of Justice declared in the Schrems case that Commission’s Decision on the Safe Harbour arrangement was invalid. The judgment confirmed the Commission's approach since November 2013 to review the Safe Harbour arrangement, to ensure in practice a sufficient level of data protection as required by EU law.

On 15 October, Vice-President Ansip, Commissioners Oettinger and Jourová met business and industry representatives who asked for a clear and uniform interpretation of the ruling, as well as more clarity on the instruments they could use to transfer data.

On 16 October, the 28 national data protection authorities (Article 29 Working Party) issued a statement on the consequences of the judgment.

On 6 November, the Commission issued guidance for companies on the possibilities of transatlantic data transfers following the ruling until a new framework is put in place.

On 2 December, the College of Commissioners discussed the progress of the negotiations. Commissioner Jourová received a mandate to pursue the negotiations on a renewed and safe framework with the US.