On 6th and 7th April 2016, the German Data Protection Authorities (“DPAs”) met to discuss several current privacy topics.
One point on the agenda has of course been the assessment of the proposed EU-US Privacy Shield (the successor of the Safe Harbor regime). Currently, the European Data Protection Authorities (the so called “Article 29 Working Party”) are finalizing their common position on the proposed adequacy decision by the European Commission (pdf).
Today, the resolution of the DPAs for the mandate of the German representatives in the Article 29 Working Party has been published (German, pdf).
In this resolution, the DPAs present two original wordings apparently taken from the current draft assessment of the Article 29 Working Party:
Until these issues are addressed, the WP29 considers it is not in a position to reach an overall conclusion on the draft adequacy decision. It stresses that some of the clarifications and concerns – in particular relating to national security – may also impact the viability of the other transfer tools.
And:
Therefore, the WP29 is not yet in a position to confirm that the current draft adequacy decision does, indeed, ensure a level of protection that is essentially equivalent to that in the EU.
These excerpts show that the European Data Protection Authorities are not able to okay the draft adequacy decision by the European Commission.
Since the opinion of the Article 29 Working Party is not binding and a negative opinion would therefore not deter the European Commission from proceeding with the adoption of a (comitology) Commission decision based on Article 25.6 of the Directive, such a result would not necessarily stop the whole the EU US Privacy Shield from becoming effective.
Apparently, the DPAs already assume that the European Commission might proceed despite a negative opinion by the European Data Protection Authorities. For this reason, the DPAs include in their mandate for the German representatives the demand that if the European Commission proceeds without patching the deficiencies, the Article 29 Working Party shall support test cases and legal actions against the adequacy decision in order to find its way to the European Court of Justice in Luxembourg (see No. 4 of the resolution).
Update:
The linked document of the DPAs has now been deleted from all websites of the German authorities. This, from my point of view, supports the theory that the document contained parts of the draft Art. 29 Working Party opinion and that the publication perhaps has not been agreed upon with other European authorities. The document is still available
here.
(Crosspost from www.delegedata.de)