EU Data Protection Board Finds Continuing Concerns With Privacy Shield

U.S. efforts to implement Privacy Shield are welcome but issues remain, the European Data Protection Board reported Thursday on the trans-Atlantic personal data transfer system. EDPB noted improvements in oversight and enforcement actions and the appointment of the remaining members of the U.S. Privacy and Civil Liberties Oversight Board and a permanent ombudsperson. Concerns include lack of "substantial compliance checks with the substance of" PS principles, and application of requirements to onward data transfers, human resources data and processors. Review team members "would benefit from broader access to non-public information, concerning commercial aspects and ongoing investigations." It urged PCLOB independently assess surveillance programs conducted outside U.S. territory while data is being transferred from the EU to the U.S. The EDPB isn't convinced the ombudsperson has strong enough powers to access information and remedy noncompliance. The FTC remains committed to "robust Privacy Shield enforcement," a spokesperson emailed. The agency's committed "to working with the Department of Commerce and our European colleagues to protect privacy and facilitate data flows," she added. The department didn't comment.