EDSA examines EU-US Data Privacy Framework: This still needs to be improved

EDSA examines EU-US Data Privacy Framework
Categories:

Transatlantic data exchange is of fundamental importance for trade and business, but has been the focus of legal and data protection discussions for years. The introduction of the EU-US Data Privacy Framework (DPF) in 2023 is intended to create a new basis for secure data transfer. The European Data Protection Board (EDPB) has now addressed the implementation of the Appropriateness decision for the USA, and an initial interim conclusion has been drawn.

This progress has been made in the implementation of the DPF

Following the ruling of the European Court of Justice (ECJ) in the case "Schrems II", significant shortcomings in the previous data protection agreement, the Privacy Shield, stated. The DPF was developed to address the criticism of the ECJ and to harmonize data protection standards between the EU and the USA.

The first review of the DPF by the EDSA shows progress in the following points in particular:

  • Self-certification of companies: The US Department of Commerce has taken all relevant steps to implement the certification process. This includes developing a new website, updating procedures, working with companies and conducting awareness-raising activities. To date, over 2,800 organizations have been certified.
  • Enforcement: The DPF provides for a multi-stage complaints procedure including an independent arbitration process. Comprehensive guidelines for dealing with complaints have been published on both sides of the Atlantic.

Concerns about government access to data

According to the EDSA, however, the US authorities' monitoring of compliance with the DPF principles is still inadequate. The low number of complaints received to date under the DPF shows how important it is for the US authorities to initiate monitoring measures to check whether DPF-certified companies are complying with the key DPF principles. The EDSA is therefore calling for increased controls.

A central concern of the review relates to government access to data by US authorities, in particular by intelligence agencies. Here, the principles of data protection enshrined in the DPF Necessity and proportionality are crucial. Executive Order 14086 was seen as progress, but concerns remain:

  • The USA continues to allow mass surveillance measures without prior independent authorization, which contradicts the requirements of the European Court of Justice.
  • Section 702 of the U.S. Foreign Intelligence Surveillance Act (FISA) regulates the surveillance of non-U.S. citizens outside U.S. territory, e.g. by the NSA. Here, the scope of surveillance measures has been considerably expanded, which raises questions of Transparency and predictability.


The EDPB emphasizes that these issues should be given priority in future reviews.

Reading tip: EU Commission adopts new adequacy decision for safe Data transmission between the EU and the USA

Law enforcement and legal remedies

The newly introduced Data Protection Review Court (DPRC) offers EU citizens improved opportunities to enforce their rights. Nevertheless, there are challenges:

  • Lack of TransparencyDecisions of the DPRC cannot be appealed, which limits accountability.
  • No practical test: Until the review in July 2024, not a single Complaint so that the actual functioning of the mechanisms could not be tested.


Following the audit, the EDPB made specific recommendations, including

  1. Strengthening proactive enforcement: US authorities such as the Department of Commerce and the Federal Trade Commission should increase their monitoring activities.
  2. Clarification of the legal DefinitionsUnclear terms such as "electronic communications service provider" in Section 702 FISA must be clarified in order to ensure legal certainty.
  3. Stronger control of data access: In particular, the use of commercially available data by intelligence services should be more strictly regulated and controlled.


The next review of the DPF should take place within three years to address these outstanding issues and ensure further progress.

Conclusion: The EU-US Data Privacy Framework marks an important step towards secure transatlantic data exchange, but still faces considerable challenges. It remains to be seen whether the US will also address the concerns of the EDPB under the new administration in order to guarantee a level of protection comparable to EU data protection standards in the long term.

Source: Report of the European Data Protection Board on the adequacy of the protection of personal data under the EU-US Data Privacy Framework

Tags:
Share this post :