Explore our collection of PDF documents and enrich your knowledge now!
back
Pitfalls along the way to Privacy Shield 2.0
Article European Law | 26/04/23 | 2 min. |
The European Commission’s draft adequacy decision under Article 45 of the GDPR on transfers of personal data to the United States is continuing to cause concern.
In effect, the European Parliament’s Committee on Civil Liberties and Home Affairs adopted a resolution sharing some of the concerns expressed by the EDPB in its Opinion 5/2023 of February 28th, 2023 [AD Europe], and asking the Commission to continue talks with the U.S. authorities to achieve a legal framework that ensures actual equivalence in terms of the level of protection of the data of European citizens transferred to the United States.
While the draft resolution observes positive developments, it stresses that in some cases bulk data collection remains possible, and the absence of any independent prior authorization in such cases. It also criticizes the absence of clear rules on data retention. Another point made in the resolution, in respect of which it would be an understatement to say it will be difficult to get the United States to change its position, concerns the creation of the “Data Protection Review Court – DPRC”, providing European citizens with a redress mechanism under which they can bring complaints about data access by a U.S. public authority. The authors of the resolution, in the same way as the EDPB, admittedly see an improvement here, but consider that the DPRC is not sufficiently independent, and deplore the fact that the decisions by this special jurisdiction would be kept secret and that its members could be dismissed by the President of the United States, who could also overrule its decisions.
The resolution notes that European citizens and businesses need legal certainty and that successive data transfer mechanisms have been struck down by the CJUE, creating additional costs for European businesses. The resolution is concerned about the risk of the future adequacy decision, if adopted as is, being invalidated in turn by the Court of Justice of the European Union.
This resolution, which is not legally binding, still needs to be adopted by the European Parliament in plenary sitting. For its part, the Commission also needs to obtain formal approval by a committee of experts designated by Member States. There is a long way yet to go…