No substitute for the safe harbor: The EU-US Privacy Shield

Following the debate on data transfer outside Europe, the EU initially favored the 'Safe Harbor Agreement' with the US government. When the European Court of Justice declared this agreement invalid due to obvious shortcomings in the transfer of personal data, the EU-US Privacy Shield came into force on July 12, 2016. The Obama administration had previously passed the Judicial Redress Act, which gives EU citizens the opportunity to sue in the USA.

At the heart of the Privacy Shield is an EU 'adequacy decision', which requires the mutual recognition of rules: "The guarantees for the transfer of data on the basis of the new EU-US Privacy Shield should correspond to the data protection standards in the EU". Since the Privacy Shield, American companies that want to do business with data in the EU have entered themselves on a list that obligesthem to cooperate in data protection.

Since then, EU citizens in the USA have been able to contact an ombudsman at the State Department to punish violations. In the event of a dispute, i.e. when EU citizens file complaints against American companies, those affected contact the national data protection authorities, which then investigate possible violations with the Federal Trade Commission. Every year, the European Data Protection Commission publishes a report listing progress and violations.

There was massive criticism of the Privacy Shield right from the start. Above all, it was criticized that it would be difficult to complain against 'mass surveillance in the USA' of which no one was aware. The ombudsman was also said to be far from independent. On May 24, 2016, the European Parliament called on the Commission to fundamentally revise the Privacy Shield.

Furthermore, on January 25, 2017, the new US President Donald Trump signed an executive order stating that the Privacy Shield does not apply to persons who are not US citizens or permanent residents of the USA.

In other words, the Privacy Shield does not currently offer EU citizens sufficient protection against the transfer of personal data overseas.