ARTICLE 29 DATA PROTECTION WORKING PARTY

which data may not be processed (including disclosed) for incompatible purposes within the
onward transfer principle (in addition to the opt-out principle).
Need for more additional obligations for Privacy Shield organisations acting as processor
(Agent) onward data to another processor (Agent)
The absence of clear rules where the Shield organisation is acting as an Agent (i.e. on behalf
an EU controller) imply a loophole and might prevent the EU controller to remain into
control. A Shield organisation receiving the data as an Agent of an EU controller has to
respect the EU controller’s instructions. This should be expressly stated in the Principles in
order to ensure that the non-respect of those instructions will not only lead to a breach of the
contract (Annex II, III.10.a.ii) but also to a violation of the Privacy Shield principles.
The possibility for a Shield organisation acting as an Agent to subsequently transfer data to a
third party Agent has to be made transparent to the Controller and be subject to its prior
approval. It should therefore be clearly stated that it is the contract signed by the Agent with
the EU controller (referred to in F.A.Q. 10 as the ‘Article 17 contract’) that determines
whether an onward transfer is allowed. 22
The current conditions applicable to the onward transfer to an Agent are built on the
assumption that the Shield organisation acts as a controller and can therefore decide by itself
on the possible intervention of a third party Agent. This should however not be possible
where the Shield organisation acts as an Agent. Otherwise, the EU controller will be deprived
from its control capacities.
The relevant privacy provisions of the contract concluded with the third party Agent must be
made available to the controller and must also to provide at least the same level of protection
as provided by the contract signed with the controller.
2.2.4 Data Integrity and Purpose Limitation
a) Proportionality
On a minor point, the WP29 refers to its letter to Vice-President Reding in which it wrote that
“a processing of personal data could, even under a strict respect of Notice and Choice, be not
proportionate with regards to the interests’ rights and freedoms of the data subject or society.
The principle of proportionality or reasonableness is to be respected at all stages of the
processing and should be applicable in addition to the principles of Notice and Choice” 23 .
The Privacy Shield (Annex II, II.5.a) states that the information must be limited to what is
relevant for the processing. The WP29 would prefer if this wording is amended in the final
adequacy decision, since the mere fact that the data shall be relevant to the processing is not
sufficient to make the processing proportionate. In order to meet the proportionality principle,
the processing should be limited to the data that are necessary for the processing at stake.
22 See WP29 letter to Vice-President Reding, 10 April 2014, point 4 under Onward Transfer
23 See WP29 letter to Vice-President Reding, 10 April 2014, p.8
23