EU agrees Privacy Shield but UK must still toe line

Just days after the UK voted to leave the EU, Brussels and Washington have finally agreed changes to Privacy Shield, the controversial transatlantic data transfer agreement which will replace the safe harbour pact.
Criticism of the Privacy Shield deal has been building ever since it was first revealed in February, despite EU justice commissioner Věra Jourová’s insistence that it was a “major achievement”.
Industry experts, MEPs, UK Information Commissioner Christopher Graham, and the EU Article 29 Working Party – which is made up of the data chiefs of all EU states – have all slammed the levels of protection offered.
But the new agreement follows a White House commitment not to continue its bulk collection of data sent from the EU to the US. There will also be more explicit data retention rules; companies now have to delete data that no longer serves the purpose for which it was collected, meanwhile the ombudsman will be independent from national security services.
A spokesman for the European Commission said: “This new framework for transatlantic data flows protects the fundamental rights of Europeans and ensures legal certainty for businesses.”
The irony of the timing will not be lost on some, but just like the EU General Data Protection Regulation, it seems there is no get-out clause for UK firms, despite last week’s Brexit vote.
While the Privacy Shield will only apply to the UK while it remains a member of the EU, the UK Information Commissioner has reaffirmed its view that Britain would need to adopt similar terms.
Nearly 4,400 companies transfer data between the continents, including some of the world’s biggest technology groups such as Facebook and Amazon and most UK personal data held in the cloud is based in the States.