Life Adter Safe Harbor - Will it be better with privacy shields?

Contrary to the European Union, the United States is known for its liberal approach to personal data protection. Proof thereof lies in the fact that there is no equivalent of the Inspector General for the Protection of Personal Data overseas. This may seem shocking, but the United States treats personal data protection more as a part of consumer rights rather than an important element of the right to privacy. This liberal approach has resulted in the issue of personal data transfer from the European Union to the United States. European legislation, Directive 95/46/EC in particular, requires foreign companies processing personal data to “ensure the appropriate level of personal data protection.” This regulation led to a problem – namely the question of how to standardize requirements for the American market with regards to personal data protection, if only because of fast technological development and data transfers, including personal data. On July 26, 2000, the Commission made a decision by which it decided that all organizations from the United States which were to become members of the so-called “Safe Harbor” program shall be deemed to have met the requirements related to the protection of personal data of European Union Member State citizens, thus making an unprecedented decision and a very big nod to the American market. Obtaining a “Safe Harbor” certificate did not require any extraordinary effort and the procedure was not too complicated either. The only requirement was confirmation of the use of safety according to Directive 95/46/EC. The submitted declarations were not subsequently controlled in terms of their content. This led to a dispute, which resulted in the decision of October 6, 2015 – file no. C-362/14 – in which the ECJ declared the aforementioned decision of the Committee to be invalid, thus national courts had to analyze each case in order to determine whether American companies guarantee the protection level of personal data required by European regulations. The situation described above forced the creation of a new, effective system of personal data exchange between the European Union and the United States. But was it created successfully? At the beginning of 2016 (and after the transition period following the verdict regarding Safe Harbor), Brussels and Washington informed that they had ended negotiations related to a new mechanism enabling transfers of personal data of European citizens to American companies. The new programme was given a working name of “Privacy Shields.” The proposed solution, however, is currently being criticized during ongoing discussions. The solution is not going to change too much in practice. Critics indicate that it will be based on the similar (erroneous) assumptions as Safe Harbor, with particularly striking elements such as lack of a regulator and of a mechanism enabling jurisdiction over control measures applied to personal data processing, especially given that the new mechanism will also be based on the declaration of an applicant. A solution to the issue of transnational personal data processing to the United States would definitely involve the implementation of universal regulations in this country, ensuring personal data protection under auspices of a regulator or a regulatory body. However, this is very unlikely to happen in the next few years.