Tuesday, November 29, 2016
Challenges to Privacy Shield Mount
There were a number of developments around challenges to the EU-U.S. Privacy Shield framework in November. Details were released of the formal complaint filed by Digital Rights Ireland with the Court of Justice of the European Union (CJEU) back in September, advancing ten grounds to justify its call for an annulment of the European Commission’s adequacy decision for the framework. Violations of the EU Data Protection Directive, the Charter of Fundamental Rights and the CJEU’s Schrems decision were claimed in nine of the ten grounds. In France, three organizations – the privacy advocacy group La Quadrature du Net, the non-profit ISP French Data Network and the Federation FDN industry association – were reported to have filed a legal challenge to Privacy Shield at the Luxembourg-based General Court. On November 11, it was announced that the European Commission had asked the U.S. government about a secret court order Yahoo used to scan thousands of customer emails for possible terrorism links, following concerns that this may have violated understandings reached during Privacy Shield negotiations. In the final agreement that was reached, the U.S. pledged not to engage in mass, indiscriminate surveillance of the data of Europeans. Meanwhile, the Irish DPA was said to have stepped up its investigation of Yahoo’s breach of the personal data of 500 million individuals, while still being in the early stages of looking into the issue of how the company’s e-mail scanning on behalf of U.S. authorities might impact Privacy Shield.