In a decision of 12 July 2016The European Commission has adopted the Privacy Shield adequacy decision, which is intended to replace the Safe Harbour agreement invalidated by the Court of Justice of the European Union on 6 October 2015.

This decision authorises the transfer of personal data from the European Union to companies established in the United States using this system, and recognises that the EU-U.S. Privacy Shield mechanism provides a level of protection that is essentially equivalent to European requirements.

The decision will enter into force upon notification in each EU Member State. Applicability to the companies concerned will be subject to their registration with the US authorities in charge of the scheme.

For the record, the G29 reacted to the publication of the draft of this decision with an opinion dated April 2016 in which it expressed its concerns, in particular about:

• the absence of a time limit on storage
• no ban on automated decisions
• the lack of precision on how to rule out the possibility of massive and indiscriminate surveillance of European citizens' data
• the true independence of the Ombudsperson and his powers, which he felt were not sufficient to enable him to exercise his role effectively and obtain a satisfactory remedy in the event of a disagreement with the administration.

The G29 is currently carrying out an analysis of the Privacy Shield decision.