ARTICLE 29 DATA PROTECTION WORKING PARTY

5. CONCLUSIONS AND RECOMMENDATIONS
The WP29 first of all welcomes the fact that within five months after the invalidation of the
Safe Harbour a new draft adequacy decision was presented, containing many improvements
compared to the previous mechanism. It is particularly pleased with the increased
transparency that is offered through the introduction of two Privacy Shield Lists on the
website of the DoC: one list containing the records of those organisations adhering to the
Privacy Shield, and one list containing the records of those organisations that have adhered to
the Shield in the past, but no longer do so. The increased transparency in relation to public
access to data transferred under the Privacy Shield, either for national security or law
enforcement purposes, is also welcomed. Finally, the WP29 is very pleased to learn that all
data transfers to the U.S. will henceforth be given the same protection: there are no specific
legal provisions in place to give advantage to one tool or another.
5.1 Three points of concern
However, three major points of concern do remain, that in the view of the WP29 will need to
be addressed.
The first concern is that the language used in the draft adequacy decision does not oblige
organisations to delete data if they are no longer necessary. This is an essential element of EU
data protection law to ensure that data is kept for no longer than necessary to achieve the
purpose for which the data were collected. Secondly, the WP29 understands from Annex VI
that the U.S. administration does not fully exclude the continued collection of massive and
indiscriminate data. The WP29 has consistently held that such data collection, is an
unjustified interference with the fundamental rights of individuals. The third point of concern
regards the introduction of the Ombudsperson mechanism. Even though the WP29 welcomes
this unprecedented step creating an additional redress and oversight mechanism for
individuals, concerns remain as to whether the Ombudsperson has sufficient powers to
function effectively. As a minimum, both the powers and the position of the Ombudsperson
need to be clarified in order to demonstrate that the role is truly independent and can offer an
effective remedy to non-compliant data processing.
5.2 Recommended clarifications
In addition to the points mentioned above, the WP29 has indicated various points throughout
this Opinion where further clarification of the adequacy decision is in order. Most
importantly, this regards the need to ensure that the key data protection notions used in the
Privacy Shield are defined and applied in a consistent way. This is currently not the case. The
introduction of a glossary of terms in the Privacy Shield F.A.Q., with definitions ideally
agreed between the EU and the U.S., would be welcomed. The WP29 also concludes that
onward transfers of EU personal data are insufficiently framed, especially regarding their
scope, the limitation of their purpose and the guarantees applying to transfers to Agents. As
regards the access to Privacy Shield data by law enforcement, especially to foreseeability of
the legislation is a concern, due to the extensive and complex nature of the U.S. law
57