ARTICLE 29 DATA PROTECTION WORKING PARTY

Verification procedures
To verify that the self-certification is effective in practice, organisations can make selfassessment
or outside compliance reviews. The WP29 regrets that employees’ training is only
required when an organisation opts for verification through self-assessments (Annex II,
III.7.c). It also seems that the need to check that policies are accurate, comprehensive,
prominently displayed, implemented and accessible is only required if the organisation opts
for internal review (self-assessments) and that review by an outside mechanism is only
limited to compliance with the privacy policy of the organisation.
A posteriori
The WP29 welcomes that the FTC and the DoC are invested with investigatory powers in
cases of complaints. Moreover, the WP29 notes that DoC will have the possibility to make ex
officio verifications, in particular through sending questionnaires. However, the WP29 would
like to make sure that such an approach is sufficient to meet the CJEU’s requirement of
effective detection and supervision mechanisms of infringement. In fact, the WP29 still has
questions remaining the exact power of U.S. enforcement authorities to conduct on-site
inspections on the premises of self-certified organisations to investigate Privacy Shield
violations, on how exequatur of an EU authority decision could be obtained on the U.S.
territory and on whether the sanctions under the Privacy Shield are deterrent in practice.
2.2.7 Processing of HR data
Scope
Supplemental Principle 9 (Annex II, III.9) applies to personal information about an employee
(past or present) collected in the context of the employment relationship. According to the
wording of Supplemental Principle 9.a.ii, the Privacy Shield Principles solely apply when
“identified records are transferred or accessed”. This term of ‘identified record’ is not in line
with the definition of ‘personal data’ under Annex II, I.8.a., which comprises “data about an
identified or identifiable individual” and therefore does not align with the definition used in
the Directive 35 .
Supplemental Principle 9.a.ii states that “Statistical reporting relying on aggregate
employment data and containing no personal data or the use of anonymised data does not
raise privacy concerns”. This statement contradicts a number of Opinions issued by the
WP29. The WP29 would like to emphasise that aggregated data can still be re-identified and
therefore should be regarded as personal data 36 .
35 As already underlined, the limitation to records that are ’transferred or accessed’ is also not in line with the term
’processing’ (Annex II, I.8.b).
36 See Opinion 4/2007 on the concept of personal data as well as Opinion 05/2014 on Anonymisation Techniques
30