On Monday (July 10), the European Commission officially published its new decision on the adequacy of the EU-US data protection framework, which provides a new legal framework for the transfer of personal data and reports. uractive.
“Personal data can now flow freely and securely from the European Economic Area to the United States,” European Commission Justice Commissioner Didier Reynders stated in his recent press conference.
The misery of data transfer between the EU and the US has been going on for years: The EU Court of Justice struck down the agreement that previously provided a framework for data transfer between the EU and the US, the so-called Privacy Shield, on July 16, 2020. They concluded that Privacy Shield It does not adequately protect the personal data of European users, because in the United States there is insufficient guarantee that US intelligence agencies cannot access the data of foreign citizens. We have written more about the legal situation regarding data flows between the EU and the US in this article.
In October, Joe Biden signed an executive order designed to address these concerns, notably by offering safeguards for EU citizens’ personal data, restricting access to US intelligence agencies and introducing an independent compensation mechanism. And last week, US Commerce Secretary Gina Raimondo announced that all commitments needed to implement the data protection framework have been met.
Also last week, representatives of EU member states overwhelmingly adopted the so-called “data sufficiency” resolution. According to Reynders, the commission has made “significant progress” and struck the right balance between the safety of the community and the rights of the individual.
The decision clarified the conditions for issuing administrative subpoenas and search warrants to access data stored with US companies. It also requires intelligence services to determine the specific data retention period and justify the need for it. The committee regularly reviews the decision on the adequacy of the data.
The intelligence services will be under the oversight of the Privacy and Civil Liberties Oversight Board, which will have access to all relevant documents, including classified information.
Not everyone is happy with the decision, however: in February, the European Data Protection Council, which groups all of the EU’s data protection authorities, highlighted several points of improvement in the decision on data sufficiency.
In addition, Austrian activist Max Schrems, who has twice challenged similar agreements in the courts, hinted that he might also challenge the new decision on the adequacy of the existing framework.
