ARTICLE 29 DATA PROTECTION WORKING PARTY

when exercising his/her right of access, is interested to know whether a particular controller
processes data about himself/herself, and also to know what data is being processed, in order
to be able to control the processing of his/her data. The WP29 has repeatedly stated that
according to EU law data subjects always have the right to access their data, and, where
necessary, to require rectification or erasure of the data if the data have not been processed
lawfully or if they are incomplete or inaccurate, regardless of whether or not the personal data
have been published. 37 If the individual's request for access is rejected on the grounds that the
data were obtained from publicly available sources or public records, the individual would
lose the ability to control the accuracy of the data and to control whether the data were
lawfully made public in the first place.
The Privacy Shield however exempts public records and publicly available information from
the principles of Notice, Choice, Access, and Accountability for Onward Transfers (Annex II,
II.15.b). These exemptions seem too broad in comparison with the Directive and raise
concerns, as they impair, among others, the individuals’ possibilities to control the accuracy
of their data and to restrict dissemination of their data.
2.3 Conclusions
The WP29 recognises that the U.S. authorities and the European Commission have brought
significant improvements to the commercial aspects for data transfer between the two
continents. Taking into account the above analysis, the WP29 however finds that the
commercial part of the Privacy Shield requires further clarification on many points. For
example, the lack of an explicit data retention principle, is cause for concern. Therefore, the
WP29 has serious concerns that the Privacy Shield can ensure a level of protection that is
essentially equivalent to that in the EU.
The adequacy decision needs to further clarify the Purpose Limitation and Choice principles.
There remains the risk of loopholes regarding several principles, notably the onward transfers,
the complaint handling mechanism and the processing of HR or Pharmaceutical data.
Additionally, how the Privacy Shield Principles are to be applied to data processors (Agents)
requires further elaboration and special attention is needed to ensure a clear and unambiguous
application of terminology.
3. ASSESSMENT OF THE NATIONAL SECURITY GUARANTEES OF THE DRAFT
ADEQUACY DECISION
3.1 Safeguards and limitations applicable to U.S. national security authorities
Interferences with the fundamental rights to private life and data protection may be allowable,
provided that such an interference is justifiable in a democratic society. This means that the
Privacy Principles are not absolute and that derogations may be possible, but only if the
applicable (essential) guarantees are met. Consistent with the goal of enhancing privacy
protection, organisations should moreover strive to implement the Principles fully and
37 See WP20, p. 4
33