ARTICLE 29 DATA PROTECTION WORKING PARTY

Privacy Shield List will also contain a record of all organisations removed from the Privacy
Shield List, including the reason why an organisation was removed. 31 The Privacy Shield
website of the DoC will further focus more on the target audiences in a way that it will
facilitate the verification of the type of information covered by an organisation's selfcertification
as well as the privacy policy that applies to the covered information and the
method the organisation uses to verify its adherence to the principles. 32 The WP29 welcomes
the fact that it is now explicit that the DoC will check if companies that have public websites
publish their privacy policy on this website or, when they do not they have a public website,
where the privacy policy is made available to the public. 33 The documents are more
informative about the content of the privacy policy, too. 34
The WP29 considers a problem could arise if an organisation which is already included in the
Privacy Shield List subsequently extends its certification to other categories of data. In such
cases, the list will not reflect the different periods of applicability of the Principles to the
different categories of data. This creates the risk that EU individuals and businesses cannot
fully assess if a specific data set is indeed subjected to the Privacy Shield Principles, and if so,
since when. To avoid this deficiency, the Working Party recommends that an organisations’
record in Privacy Shield List shall separately specify for each category of personal data the
data of entry into application of the self-certification.
The WP29 welcomes the fact that the DoC will maintain a record of organisations that have
been removed from the Privacy Shield List and that this record will include an explanation
clarifying that those organisations are no longer assured of the benefits of the Privacy Shield,
but must continue to apply the Principles to personal data received while being a Privacy
Shield certified organisation, as long as they retain such data (Annex I, p. 3). However, since
some organisations that have been removed from the Privacy Shield List may choose to return
or delete the data received under the Privacy Shield, while other organisations will retain data
that they have received under the Shield, it is important to provide more transparency on this
issue to individuals. Therefore, the record of companies maintained by the DoC should
specify whether the organisation still retains personal data received under the Privacy Shield,
or whether it has returned or deleted such data. If the organisation still retains such data, the
record should explicitly state that the organisation must continue to apply the Principles to
such data.
Furthermore, the record maintained by the DoC should, mention that these organisations are
no longer assured of the benefits of the Privacy Shield for new transfers, meaning that the
organisation is no longer permitted to receive personal data from the EU under the Principles.
31 Annex I, p. 5 and Annex II, II.1; the WP29 also refers to the fourth Commission recommendation in Communication
COM(2103)847 as well as the WP29 letter to Vice-President Reding, 10 April 2014, in particular point 5 under
‘Transparency’.
32 Annex I, p. 8; the WP29 also refers to its letter to Vice-President Reding, 10 April 2014, in particular point 2 under
‘Transparency’.
33 Annex I, p. 3 and 4; the WP29 also refers to the first Commission recommendation in Communication COM(2103)847 as
well as the WP29 letter to Vice-President Reding, 10 April 2014, in particular point 3 under ‘Transparency’.
34 Annex I, p. 5 and 6 and Annex II, III.6
29