Over a year ago, the Privacy Shield was adopted as the replacement for the Safe Harbor decision, which was struck down in October 2015. This month, the first annual joint review of the Privacy Shield by the EU and US will take place in the United States, which will involve the European Commission, the U.S. Department of Commerce and the European data protection authorities. This joint review is the first opportunity to assess the working of the Privacy Shield and to address the criticisms that have arisen over the past year. Read more about the Privacy Shield in general in our newsflash of 16 November 2016.

In anticipation of the joint review, the Article 29 Working Party (“WP29”), which has been critical of the Privacy Shield from the beginning, issued a press release. The WP29 again points out several areas of concern, such as the bulk collection of data and the appointment and functioning of the Ombudsman. In addition, the WP29 stated that it expects to be consulted by the European Commission before the review is finalized, and indicates that it may publish its own report based on its findings. The press release is a bold reinforcement of previous statements by the WP29 that it would use this annual review to assess whether it considers the Privacy Shield to be a sufficient legal basis for data transfer between the EU and the US. In short: the European Commission may consider itself warned.