The Senate Commerce Committee plans to hold a hearing next week on privacy and data.

Committee chairman Roger Wicker (R-Miss.) announced the hearing, “The Invalidation of the EU-US Privacy Shield and the Future of Transatlantic Data Flows,” for 10 a.m. Wednesday (Dec. 9).

Related: EU, U.S., Working on New Privacy Shield

The hearing will look at the policy issues that led to the invalidation of the shield framework, as well as that decision's impact on U.S. businesses, and where the U.S. is in the process of coming up with a successor shield.

The U.S. started huddling with the EU back in August about fixing the EU-U.S. Privacy Shield after the EU's Court of Justice ruled that the U.S. can't live up to its part of the bargain, promising to strengthen privacy protections.

Concluding that it does not sufficiently protect data transferred from the EU to the U.S., the Court of Justice invalidated the shield.

The privacy shield replaced the safe harbor agreement that a European Union court invalidated in October 2015 over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks. The voluntary framework requires companies to provide notice of what personal data is being collected and stored, the purposes it is used for, and an "opt out" mechanism.

The shield was a way for U.S. companies to be considered in compliance with the EU's General Data Protection Regulation (GDPR) simply by signing on to the shield's data protection guarantees rather than having to come up with individual policies and agreements to comply with the GDPR protections of cross-border data flows. 

Legislators from both parties are rooting for the Trump Administration, specifically the Commerce Department and Federal Trade Commission, to come up with a successor to the invalidated Privacy Shield that allows cross-border data flows with the EU.

The Trump Administration has been huddling with the European Commission to talk about that successor to the EU-U.S. Privacy Shield after the EU's Court of Justice ruled in July that the U.S. can't live up to its part of the bargain.

The Privacy Shield had itself replaced a safe harbor agreement that a European Union court invalidated in October 2015, also over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks. The voluntary framework required companies to provide notice of what personal information is being collected and stored, the purposes it is used for, and an "opt out" mechanism.

In a bipartisan letter to Secretary of Commerce Wilbur Ross and FTC chairman Joseph Simons, almost two dozen legislators led by Reps. Peter Welch (D-Vt.), Darin LaHood (R-Ill.) and Suzan DelBene (D-Wash.) the legislators wrote to express their support for the work they were doing, buoyed by the news that they were working with the EU.

They said it was crucial to establish a "stable and reliable mechanism" protecting data flows between the U.S. and EU countries, adding: "We commend your efforts and support your continued work to develop a successor to the Privacy Shield. Thank you for your leadership on this important issue."

They were preaching to the choir, but pointed out that the shield protected over 5,000 U.S. companies, most of them small businesses. They said they were encouraged by a joint statement made by Ross and European commissioner for Justice Didier Reynders about a potential new enhanced shield. 

The Federal Trade Commission has settled with five more companies for failing to meet their obligations under the European Union-U.S. Privacy Shield, which is meant to provide companies a road map to compliance with the EU’s General Data Protection Regulation, applicable to the data handling of any company doing business in EU countries.

The FTC also suggested three takeaways that companies should glean from the dozens of Privacy Shield cases the agency has brought:

1. While the shield is voluntary, the FTC will aggressively go after any participant who makes false statements or fails to live up to its requirements.

2. “Finish what you start,” the FTC said. Likening it to a golf swing, the agency said it’s all in the follow-through, meaning a company should not claim to be under the shield until it has completed its application and been certified by the Department of Commerce, which administers the shield.

3. Certification is not an end point, but the start of an ongoing obligation, including annual recertification. “To keep your company on the right side of the law, put a recertification reminder on your calendar now,” the FTC said. “(Yes, now.) Furthermore, if you decide at a later date not to participate, immediately change what you say on your website.”

There are also ongoing responsibilities about data collection, the agency added.

It is definitely in a company’s interest to be in compliance with the GDPR. The maximum fine for violations is 20 million euros or 4% of sales, whichever is greater.

The European Union has given a thumbs up to the EU-U.S. Privacy Shield in its first annual review of the framework for protecting cross-border data flows.

The first annual report concluded the shield works, but could use some bolstering, including by the U.S. Department of Commerce.

"Overall the report shows that the Privacy Shield continues to ensure an adequate level of protection for the personal data transferred from the EU to participating companies in the U.S. The U.S. authorities have put in place the necessary structures and procedures to ensure the correct functioning of the Privacy Shield, such as new redress possibilities for EU individuals," the report concluded. "Complaint-handling and enforcement procedures have been set up, and cooperation with the European Data protection authorities has been stepped up," it said. "The certification process is functioning well - over 2,400 companies have now been certified by the U.S. Department of Commerce. As regards access to personal data by U.S. public authorities for national security purposes, relevant safeguards on the U.S. side remain in place."

LeBlanc Tapped As Privacy Shield Arbitrator

Among the recommendations for bolstering the shield include "more proactive and regular monitoring of companies' compliance with their Privacy Shield obligations by the U.S. Department of Commerce," appointing an ombudsperson and filling vacancies on the Privacy and Civil Liberties Oversight Board.

The report will be distributed to the European Parliament and U.S. authorities for follow-up on the recommendations.

The White House had predicted the positive review. Last month, press secretary Sarah Sanders said: "We firmly believe that the upcoming review will demonstrate the strength of the American promise to protect the personal data of citizens on both sides of the Atlantic."

The privacy shield replaces the safe harbor agreement that a European Union court invalidated in October 2015 over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks. The voluntary framework requires companies to provide notice of what personal information is being collected and stored, the purposes it is used for, and an "opt out" mechanism.

“We welcome the positive outcome of the first EU-U.S. Privacy Shield Annual Review," said Federal Trade Commission Chairman Maureen Ohlhausen. "Enforcing international privacy frameworks such as Privacy Shield is an integral part of our Privacy and Data Security program, as highlighted in three recently announced Privacy Shield enforcement actions. We look forward to continuing to work with our European counterparts to ensure that the Privacy Shield remains a robust mechanism for protecting privacy and enabling transatlantic data flows.”

"We applaud, and are relieved by, the positive review of the EU-U.S. Privacy Shield," said ACT | The App Association President Morgan Reed. "We support the EU-U.S. Privacy Shield as a model framework to foster cross-border data flows and secure privacy protections. Our small business members are among the 2,400 businesses that depend on Privacy Shield certification to engage with and access customers throughout the EU. Their growth and success hinges on the ability to protect consumer privacy, and maintain consumer trust. We will continue to work with U.S. government entities to ensure the Privacy Shield and its commitments are upheld."

The Center for Digital Democracy has told the European Union it should pull the plug on its Privacy Shield agreement with the U.S. because the U.S. is unable to shield that privacy.

That came in a letter to the EU, which had asked for CDD's input for its first-year review of the shield agreement, which was struck last year.

CDD cited a lack of privacy enforcement or oversight by the FCC and Federal Trade Commission.

It laid out a stark picture: "There is no effective legal framework to protect consumer privacy in the U.S., with inadequate enforcement of the weak policies in place and an overall failure to address the dramatic growth of data practices," CDD said.

The group cited the March 2017 Congressional Review Act nullification of FCC broadband privacy rules as one of the reasons the U.S. can't protect data privacy.

As for the FTC, CDD said that even before the Trump Administration, that commission has been "incapable of effectively addressing how to empower and protect consumer digital privacy."

CDD also says the "notice and choice" framework of the Privacy Shield is ineffective. It said it had studied some of the U.S. companies enrolled in the shield, comparing their statements to their actual data collection and concluded that the self-certification process is "inadequate and dangerous."

The Privacy Shield replaced the safe harbor agreement that a European Union court invalidated in October 2015 over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks.

The framework requires companies to provide notice of what personal information is being collected and stored, the purposes it is used for, and an "opt out" mechanism for not sharing it.

(Photo via Rock Cohen’s Flickr. Image taken on March 18, 2016 and used per Creative Commons 2.0 license. The photo was cropped to fit the 4x3 aspect ratio.)

An advisory group to the European Union has said it can't endorse the "privacy shield" proposal agreed to by the EU and U.S. to succeed a data protection agreement invalidated last year, according to the Information Technology and Innovation Foundation.

The ITIF said it was disappointed that the group -- the Article 29 Working Party,  made up of EU's data protection regulators --  could not support the negotiated framework.

"The new agreement offers a host of new protections, obligations and opportunities for redress that affirm the commitment of the U.S. government to safeguard European data and respect the rights of European citizens," the ITIF, a technology policy think tank, said. "Moreover, the agreement has achieved widespread support on both sides of the Atlantic from many policymakers, businesses and advocacy groups for offering an opportunity to move forward after the European Court of Justice invalidated the Safe Harbor agreement in the Schrems decision."

If the privacy shield proposal is approved, it would replace the Safe Harbor agreement that an EU court invalidated over concerns about the U.S. being able to hold up its end of the agreement given the government surveillance revealed by the Edward Snowden leaks. The framework requires companies to provide notice of what personal information is being collected and stored, the purposes it is used for and an "opt out" mechanism.

The ITIF said the fact that the advisory group thinks the agreement needs work isn't a reason not to approve it.

"While members of the Article 29 Working Party should continue to offer suggestions on how to strengthen this agreement — and there are opportunities for improvement — the opportunity for improvement should not preclude official approval of the agreement," the ITIF said.

The Trans Atlantic Consumer Dialogue, civil society groups that also had issues with the shield, said the signal from the advisory committee was clear and should be heeded.

"We hope that the European Commission will take the opinion of the Data Protection Authorities very seriously. It is clear that the Privacy Shield does not adequately protect EU consumers’ fundamental rights," said Jeff Chester, U.S> co-chair of TACD's Information Society Committee. "The Commission must reconsider its adoption. The EU cannot afford to set a precedent like this and allow fundamental rights and values to be high jacked by political and commercial interests.”