Written by Haim Ravia and Dotan Hammer
The European Commission published a draft decision to recognize the United States as an adequate country whose laws are essentially equivalent to the level of data protection required in the EU. The draft decision comes about two months after the President of the United States issued a new executive order to promote the legal mechanism that would facilitate the transfer of personal data from the EU to the U.S. As the immediate next step, the draft decision was submitted to the European Data Protection Board (EDPB) for its opinion.
The new legal mechanism for transferring personal data to the U.S. is very similar to the Privacy Shield mechanism that was struck down in July 2020 by the Court of Justice of the European Union. American companies interested in certifying to the new framework will commit to elevated standards of data protection and privacy beyond the requirements of the existing legislation in the United States.
The key development in the new framework is the restrictions that President Biden’s executive order imposes on U.S. intelligence agencies, which are allowed to collect personal data only when the collection is necessary for national security purposes and is proportionate to the purposes. Data subjects from the EU who believe that their data protection rights were violated will have several recourse mechanisms. Complaints about violations of these rules will be adjudicated by a special court established by the U.S. Department of Justice.
While the EDPB examines the draft decision, the political institutions of the European Union will advance the formal approval of the decision by the Council of the European Union.
As soon as the European Commission published the draft decision, NOYB, the non-profit organization established by Max Schrems, issued a statement opposing the decision. NOYB expressed doubt that the Commission’s draft decision meets the standards for data protection that the Court of Justice of the European Union outlined.
Click here to read the draft adequacy decision for the EU-US Data Privacy Framework.
Click here to read the EU Commission’s press release about the process to adopt the adequacy decision for safe data flows with the US.
Click here to read NOYB’s announcement opposing the draft decision.
