On February 2nd, 2016, the European Commission announced that it had reached a political agreement with the United States on the protection of personal data. According to the statement, the new agreement “UE-US Privacy Shield” respects the level of protection required by the CJEU by imposing increased obligations on US companies wishing to use personal data from the European Union. The United States is also committed to ensuring that access to public authorities for transferred data is limited and framed.
On February 29th, 2016, the European Commission published its draft adequacy decision on the “Privacy Shield” and its annexes.
On April 13th, 2016, the WP 29 published its opinion on the “Privacy Shield”. It highlighted the significant improvements made by the “Privacy Shield” compared to the 2001 Safe Harbour decision. Nevertheless, it noted that important concerns remain regarding the commercial aspect of the “Privacy Shield” and access by the authorities to data transferred under the Privacy Shield Agreement.
On July 8th, 2016, the final version of the Privacy Shield was approved by most EU Member States, with the exceptions of Austria, Croatia, Slovenia and Bulgaria, paving the way for adoption by the European Commission.
On July 12th, 2016, the Commission adopted the decision, stating that “the guarantees for the transfer of data on the basis of the new EU-US data protection agreement protect according to data protection standards in the European Union “.
On October 25th, 2016, several French associations, including Quadrature du Net, filed an appeal with the European Union Court to annul this agreement. They consider that it allows massive and systematic collection of personal data by the American authorities beyond what is strictly necessary, and that it will not be possible for a European citizen to have access to an effective judicial remedy.