European Commission publishes Privacy Shield

The European Commission has published its Privacy Shield decision together with a Communication. The Privacy Shield will govern the transatlantic commercial flow of personal data from Europe. The European Commission follows up of its previous Safe Harbour decision that was turned down by the European Court of Justice in its Schrems decision.

The core of Privacy Shield is hidden in provision 61:

(61) In the light of the information in this section, the Commission considers that the Principles issued by the U.S. Department of Commerce as such ensure a level of protection of personal data that is essentially equivalent to the one guaranteed by the substantive basic principles laid down in Directive 95/46/EC

Earlier published drafts of the document stated “as a whole”. Unpublished Commission drafts previously unlawfully obtained by Politico.eu and made available to their paid subscribers also contain the “as such” wording.

The provision “as such” carries legal weight and provides for narrow interpretations. It demonstrates that other assurances or statements apart from the DOC Principles are mere window dressing.

Most likely the Privacy Shield decision will be tested again in High Court as the concessions made are hardly convincing for privacy advocates. The Schrems decision of the European Union Court of Justice raised the bar. We will see if the Commission decision meets these standards this time.