On 23 October 2019, the European Commission (the Commission) released its report on the third annual review of the functioning of the EU–U.S. Privacy Shield (Privacy Shield). The report summarises various improvements in the functioning of the framework, and further ‘concrete steps’ that need to be taken to ensure its continued effectiveness.
The Commission’s Privacy Shield adequacy decision obligates the Commission to carry out annual reviews of the framework. To date, there have been two annual reviews (September 2017 and October 2018). The 2019 review took place in Washington D.C., with representatives from the Commission, European Data Protection Board (EDPB), and various U.S. government departments and offices in attendance. The Commission’s findings are divided between:
- commercial aspects of the framework (compliance, administration, oversight, enforcement by U.S. authorities); and
- aspects concerning public authorities’ access to personal data transferred under Privacy Shield.
We focus our discussion on the commercial aspects of the review.
Continue Reading EU–U.S. Privacy Shield: EU Commission issues its third annual review report