Editor's note: The IAPP is policy neutral. We publish contributed opinion and analysis pieces to enable our members to hear a broad spectrum of views in our domains.
The never-ending story of data transfers.
The EU-U.S. Data Privacy Framework is facing multiple and very diverse threats across judicial, political, geopolitical and trade avenues.
This week's development came from Luxembourg as the EU General Court held a hearing in the Latombe v. European Commission case, lodged in October 2023.
Philippe Latombe, a French Member of Parliament, challenged the DPF shortly after the Commission adopted its adequacy determination in July. After several procedural hoops, this week's hearing was highly anticipated, not least because it was likely to extend beyond mere debates about Latombe's standing and into substantive discussion on the functioning of the DPF — and by extension its validity.
Importantly, there is no evidence that the second Trump administration wants to do away with trans-Atlantic data flows per se, but recent actions show the DPF's underlining building blocks could be at risk.
The IAPP Privacy Governance Report 2024 shows international transfers dropped as a strategic priority in 2024 relative to other privacy governance issues.
Right now, the political timeline is equally as important as the judicial one. The question is: in the face of multifaceted turbulences, what is the European Commission's risk management strategy vis-à-vis its primary trading partner?
The EDPS race is still on
Two months ago, I wrote in this column about the selection process for the next European Data Protection Supervisor, a position that has gained massive influence within European privacy circles for its policymaking contributions.
The EDPS race has been on for several months as incumbent Wojciech Wiewiórowski bids for a second term. It was expected that the appointment would be informed by political considerations, but it is fair to say it triggered an unexpected level of politicization.
Frontrunners Bruno Gencarelli and Wiewiórowski, respectively favored by Parliament and member states, are still both in contention months after the new term should have started.
Deliberations have been going on behind the closed doors of European Parliament and the Council of the European Union for at least two months in an effort to agree on a common name, and we may finally see white smoke as both institutions are called to another vote 2 and 8 April. Hopefully, negotiations will have led to a consensus so that voting will lead to the same outcome.
So why the deadlock? Only parties to the closed-door negotiations will have a comprehensive view, but a number of factors could be at play.
As with any high-level European position, institutions carefully look at the balance of nationalities and political affiliations where relevant. Typically, a commissioner and their director-general heading the services will have different nationalities.
In this instance, the European Parliament's public hearing also showed factors such as independence will continue to be paramount. Undoubtedly, so will political savviness in light of current geopolitics within and outside Europe's borders.
Isabelle Roccia, CIPP/E, is the managing director, Europe for the IAPP.
This article originally appeared in the Europe Data Protection Digest, a free weekly IAPP newsletter. Subscriptions to this and other IAPP newsletters can be found here.