Pixelated shield icon on digital background,

EU US Privacy Shield Framework 2nd annual review: Per European Regulator, the European Data Protection Board (EDPB), the U.S. has made significant progress but some issues remain.

Progress includes: 

  • Adapting the initial certification process to avoid inconsistencies between the Privacy Shield List and the representations made by the organizations on their websites
  • Oversight and enforcement actions by the US Department of Commerce (DoC) and the FTC
  • Further guidance by DoC for EU individuals and for US business

Outstanding issues include:

  • Enforcement of compliance with the substance of the Privacy Shield principles
  • Enforcement of “onward transfers” of personal information to third parties
  • Clarification of Privacy Shield requirements regarding HR data
  • Refinement of the re-certification process
  • Addressing data subject rights
  • Lack of guarantees on transfers for regulatory purpose in the field of medical context
  • Lack of specific rules on automated decision making
  • Overly broad exemption for publicly available information.

Details in the full text of the Second Annual Joint Review.