After pointing out that the Privacy Shield Draft Adequacy Decision constitutes a step forward compared to the Safe Harbor Decision, in his Opinion from May 30th 2016, Giovanni Buttarelli, European Data Protection Supervisor, noted that such progress is not, in itself, sufficient.
Mr. Buttarelli reached this conclusion based on the fact that, according with the CJEU judgement in the Schrems case, the threshold for an adequacy assessment must be “essential equivalence”, meaning that an overall assessment of the European legal order and an examination of the most important elements of the data protection framework should be performed in global terms, thus respecting the essence of these elements.
Although noting that several organizations on both sides of the Atlantic are waiting for an outcome on the adequacy decision, the Supervisor recommended a future-oriented decision, thus predicting that the current draft adequacy decision would be invalidated by the CJEU and would have to be negotiated under the General Data Protection Regulation (GDPR). Mr. Buttarelli stressed also on the fact that the adequacy decision should, in particular, consider new elements of the GDPR which are not present in the Directive, such as the principles of privacy by design, privacy by default and data portability. The GDPR also provides clearer and more detailed criteria for adequacy decisions, including the existence and effective functioning of independent supervisory authorities in the third country in question. Even more interestingly for the case at hand, the GDPR extends the scope of application of the EU data protection framework. In fact, controllers or processors not established in the EU will be subject to EU rules as long as their processing activities relate to the offering of goods and services to individuals in the EU or the monitoring of their behavior ...Zum vollständigen Artikel