13.04.2016

Art. 29 WP: Opinion on the EU – U.S. Privacy Shield draft adequacy decision

Opinion 01/2016 on the EU – U.S. Privacy Shield draft adequacy decision:
[...] 5.1 Three points of concern
However, three major points of concern do remain, that in the view of the WP29 will need to be addressed. The first concern is that the language used in the draft adequacy decision does not oblige organisations to delete data if they are no longer necessary. This is an essential element of EU data protection law to ensure that data is kept for no longer than necessary to achieve the purpose for which the data were collected. Secondly, the WP29 understands from Annex VI that the U.S. administration does not fully exclude the continued collection of massive and indiscriminate data. The WP29 has consistently held that such data collection, is an unjustified interference with the fundamental rights of individuals. The third point of concern regards the introduction of the Ombudsperson mechanism. Even though the WP29 welcomes this unprecedented step creating an additional redress and oversight mechanism for individuals, concerns remain as to whether the Ombudsperson has sufficient powers to function effectively. As a minimum, both the powers and the position of the Ombudsperson need to be clarified in order to demonstrate that the role is truly independent and can offer an effective remedy to non-compliant data processing. [...]