European regulators to issue opinion on data transfer deal

European regulators to issue opinion on data transfer deal
© Getty Images

European privacy regulators are set to issue an opinion this week on a pending data transfer deal between the United States and the European Union.

ADVERTISEMENT

The agreement, dubbed Privacy Shield, is intended to keep commercial data flowing across the Atlantic.

But leaks from the upcoming assessment suggest the working group of Europe's 28 data privacy authorities is likely to reject the agreement in its current form, leaving the European Commission to potentially send the deal back to the negotiating table.

“There’s a real chance that it won’t sail through, that there will be some significant comments to the point where the Commission might decide to go back to the U.S. and reopen the negotiations, which extends the period of uncertainty for businesses,” said Susan Foster, a privacy attorney at Mintz Levin who works in both the EU and the U.S.

Although the group’s support is not a prerequisite to the deal’s ultimate approval by the EU and the U.S. — where the Commerce Department led negotiations — it would be a blow to the fragile agreement.

According to the leaked assessment, the working group is "not yet in a position to confirm that the current draft adequacy decision does, indeed, ensure a level of protection [in the U.S.] that is essentially equivalent to that in the EU."

In other words, the regulators are not satisfied the new deal protects EU citizens’ privacy well enough.

The group’s approval may hinge on whether it is satisfied by the U.S.’s assurances that the deal’s exception for national security purposes does not permit mass surveillance.

If the European working group is not satisfied with the explanations from the Commerce Department, the consequences could be economically dire. Businesses fear a chilling of transatlantic trade, valued at $1 trillion in 2014.

If the working party does approve Privacy Shield, the pact must still clear other hurdles before it can be finalized by the two governments, including a resolution by the European Parliament.

And even if the deal is finalized, the European high court will likely still weigh in on its validity. Privacy Shield’s predecessor, the 15-year-old Safe Harbor framework, was struck down when the court deemed that the U.S. could not be trusted to adequately protect EU citizens’ privacy because of its surveillance practices.

Foster notes that the working party’s opinion will be a barometer for the deal’s ultimate survival.

“The opinion is vital because it’s an indicator of how well Privacy Shield will fare when it’s attacked,” Foster said. “If it’s robust enough to satisfy the working party, then it has a good chance of surviving scrutiny by the European Court of Justice.”