European Commission begins the process of adopting an adequacy decision for transferring personal data from the EU to the U.S.

European Commission begins the process of adopting an adequacy decision for transferring personal data from the EU to the U.S.

This is a milestone that has taken a long time to reach.  Several years of negotiation and wrangling between the US and the EU have led to this point.  It is not over the line yet, but it is very positive news that the European Commission has announced the following:

Today [13 December 2022], the European Commission launched the process towards the adoption of an adequacy decision for the EU-U.S. Data Privacy Framework, which will foster safe trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union (CJEU) in its Schrems II decision of July 2020”.  www.ec.europa.eu

What is the history of the Adequacy Decision or lack of one?

Since July 2020 when the Schrems II decision by the CJEU that the data protection practices in the U.S. were not as robust as those in Europe, personal data has not been able to flow lawfully from the EU to the U.S without having to put cumbersome paperwork in place. (Standard Contractual Clauses which must continue to be used until this Adequacy Decision has been adopted).

Prior to that time, the EU had an agreement (which is basically what an Adequacy Decision is – an agreement that the receiving country has data protection practices in line with those in Europe), called Privacy Shield which allowed for data to flow freely from the EU to companies who had signed up to the scheme.  It is this agreement that was challenged by Max Schrems, the Privacy Campaigner, who won his case two and half years ago.

Did we know that this news was likely?

We saw the green-shoots of a new adequacy decision back in March 2022 when President Biden of the U.S. and President von der Leyen of the European Commission signed an ‘Agreement in Principle’ in which the US pledged to comply with a detailed set of privacy regulations.

What changes are the U.S. making?

One of Schrems’ biggest concerns and perhaps the biggest gap between US Privacy laws and those in Europe is around the access the US intelligence agencies have to personal data, and this is one of the key components that is being addressed.

• U.S. Intelligence Agencies will only be allowed to access the personal data of Europeans where it is ‘necessary and proportionate’ to protect national security.
• Additionally, there will be the opportunity for EU citizens to ‘obtain redress’ from the U.S Intelligence Agencies regarding the use of their personal data through the creation of the new ‘Data Protection Review Court’. The EU Commission believe this mechanism to be more robust than the one previously available through the now-defunct Privacy Shield.
• U.S. companies must also agree to delete personal data ‘when it is no longer necessary for the purpose for which it was collected’.

Will these changes be enough to get the Adequacy Decision?

We don’t know yet.  We now await the decision from the European Data Protection Board.  Their opinion is very significant in terms of whether the individual states of the EU then go on to approve the draft.

Assuming we get past both of those hurdles, the final stage is for the European Parliament to give their approval.

Once all of those three things have happened, the new EU-U.S. Data Privacy Framework can be formally adopted.

How long will this take?

Still a way to go.  Probably a minimum of six months. However, there is still a major fly in the ointment.  Max Schrems is still not happy.  He issued a statement in response to the announcement on 13^th December.  He reminded us that the original issues were about the U.S. surveillance (by their Intelligence Services) not being proportionate and that there should be judicial redress.  Schrems, in his usual bullish style, said of the draft agreement:

“. . .there is continuous ‘bulk surveillance” and a court that is not an actual court . . . [the Executive Order] sounds promising but on closer examination, it oversells and underperforms.” Max Schrems.

It seems like he will be making another visit to the European Court of Justice.

The UK is no longer in the EU, how does this affect us?

Whilst the UK is no longer bound by the decisions taken or made in Europe, we are heavily influenced by them, and if the EU-U.S. deal is successful this will provide a sound template for a UK-U.S. deal to follow.

However, there is another risk.  If, as has been muted more than once, the UK tries to strike a deal with the U.S. unilaterally, the EU may consider that their citizen’s data would not be protected due to the onward transfer to the U.S, therefore we could risk losing our adequacy decision with the EU.

What happens now?

Once again, we must watch this space.

Our view is that unless the USA fundamentally change their core legislation, no bi-lateral agreement will ever get through a Schrems challenge in the CJEU, and so we are not holding our breath.

We will, as always, keep you informed as we learn more.

In the meantime, if you have any questions about how to lawfully send personal data to the U.S. please get in touch with us here at The Griffin House Consultancy.

As we have said before, please check all of your cloud storage, marketing, CRM and accounting platforms – check that your data is being stored in the UK, EU or another country with an Adequacy Decision already in place.

If you would like to book a 30-minute complimentary consultation to discuss this or any other data protection issues, you are very welcome to do so.  Just click here.