EC Praises US Work on Privacy Shield, Pans Missing Permanent Ombudsman

U.S. authorities "are living up to their commitments" and Privacy Shield works, but the European Commission may be forced to act if no permanent ombudsman is appointed by Feb. 28, European Justice, Consumers and Gender Equality Commissioner Vera Jourova told reporters Wednesday. Such actions could include limiting access by U.S. government bodies to Europeans' personal information or even suspending PS, she said. Despite the warning, the EC's second review of the trans-Atlantic personal data transfer system showed the U.S. has implemented most recommendations from last year's report, she said. Asked why it has taken so long to put an ombudsman in place, Jourova said that in March 2017, the U.S. administration asked her to be patient because so many posts needed Senate confirmation. Now, she said, "my patience is coming to an end." The report noted that as of now, "the Ombudsman mechanism had not yet received any requests," but a complaint to the acting ombudsman "had been submitted to the Croatian data protection authority and the relevant checks were ongoing." If the EC is "forced to take steps" over the appointment, it could amend PS in ways that could make compliance by U.S. companies more cumbersome or suspend the system altogether, Jourova said. The review found the Department of Commerce boosted its certification process and introduced new oversight procedures, including requiring first-time applicants to refrain from advertising their membership until their certification is complete. DOC also is "actively" using tools to catch companies that falsely claim membership and has referred more than 50 cases to the FTC, which took enforcement actions when needed, the EC said. The FTC has started issuing administrative subpoenas to seek information from some shield participants, it said. The review noted growing discussion in DOC and FTC on a federal approach to data privacy, and cheered the naming of a full quorum of Privacy and Civil Liberties Oversight Board members. The FTC "welcomes the European Commission’s conclusion that Privacy Shield continues to provide an adequate level of protection," a spokesperson emailed. The DOC and its NTIA and International Trade Administration had no comment. The Computer & Communications Industry Association commended the "thorough review."