ARTICLE 29 DATA PROTECTION WORKING PARTY

TABLE OF CONTENT
EXECUTIVE SUMMARY 2
ON THE COMMERCIAL ASPECTS OF THE PRIVACY SHIELD 3
DEROGATIONS FOR NATIONAL SECURITY PURPOSES 4
JOINT REVIEW 4
CONCLUSION 5
TABLE OF CONTENT 6
1. INTRODUCTION 9
1.1 GENERAL COMMENTS 10
1.1.1 SCOPE OF THE WP29’S ASSESSMENT 10
1.1.2 THE ASSESSMENT OF THE COMMERCIAL PART OF THE DRAFT ADEQUACY DECISION 10
1.1.3 THE ASSESSMENT OF DEROGATIONS FOR ACCESS BY PUBLIC AUTHORITIES AND THEIR
SAFEGUARDS 11
1.2 THE DRAFT ADEQUACY DECISION 12
1.2.1 SCOPE OF APPLICATION OF THE EU DATA PROTECTION FRAMEWORK AND, IN PARTICULAR,
OF THE DIRECTIVE 95/46/EC PRINCIPLES 12
1.2.2 LACK OF CLARITY OF THE PRIVACY SHIELD DOCUMENTS 12
1.2.3 JOINT REVIEW AND SUSPENSION 14
1.2.4 EU LEGAL FRAMEWORK UNDER REVISION 15
2. ASSESSMENT OF THE COMMERCIAL PART OF THE DRAFT ADEQUACY
DECISION 15
2.1 GENERAL COMMENTS 15
2.1.1 IMPROVEMENTS 15
2.1.2 APPLICATION OF THE PRIVACY SHIELD TO ORGANISATIONS ACTING AS PROCESSOR
(AGENT) 16
2.1.3 LIMITATIONS TO THE DUTY TO ADHERE TO THE PRINCIPLES 17
2.1.4 LACK OF A DATA RETENTION LIMITATION PRINCIPLE 17
2.1.5 LACK OF GUARANTEES FOR AUTOMATED DECISIONS WHICH PRODUCES LEGAL EFFECTS OR
SIGNIFICANTLY AFFECTS THE INDIVIDUAL 17
2.1.6 INTERIM PERIOD FOR EXISTING COMMERCIAL RELATIONSHIPS 18
2.2 SPECIFIC COMMENTS 18
2.2.1 TRANSPARENCY 18
2.2.2 CHOICE 19
2.2.3 ONWARD TRANSFERS 20
2.2.4 DATA INTEGRITY AND PURPOSE LIMITATION 23
2.2.5 RIGHT OF ACCESS, CORRECTION AND ERASURE FOR DATA SUBJECTS 25
2.2.6 RECOURSE, ENFORCEMENT AND LIABILITY (REDRESS MECHANISMS) 26
2.2.7 PROCESSING OF HR DATA 30
2.2.8 PHARMACEUTICAL AND MEDICAL PRODUCTS 31
2.2.9 PUBLICLY AVAILABLE INFORMATION 32
2.3 CONCLUSIONS 33
3. ASSESSMENT OF THE NATIONAL SECURITY GUARANTEES OF THE DRAFT
ADEQUACY DECISION 33
3.1 SAFEGUARDS AND LIMITATIONS APPLICABLE TO U.S. NATIONAL SECURITY AUTHORITIES 33
6