The third time's a charm. After the EU-U.S. Safe Harbor and EU-U.S. Privacy Shield, the EU-U.S. Data Privacy Framework may finally provide the durable transfer tool stakeholders have been waiting for. The European Commission issued its first review of the DPF this week.
It concluded that U.S. authorities "have put in place the necessary structures and procedures to ensure that the Data Privacy Framework functions effectively." It also announces that the next review will take place in three years, sending a strong signal of the level of confidence from Commission officials about the framework's implementation.
The Commission does not sign a blank check though as it alerts to upcoming developments it will monitor closely: "(1) the upcoming reports of the PCLOB on the implementation of (Executive Order) 14086 and the functioning of the signals' intelligence redress mechanism, in particular the (Data Protection Review Court); (2) possible further amendments of Section 702 (Foreign Intelligence Surveillance Act); and (3) the nomination and appointment of members to the (Privacy and Civil Liberties Oversight Board) to fill upcoming vacancies."
A challenge to the DPF is currently pending before the EU General Court, following a complaint lodged by French MP Philippe Latombe. In October 2023, the court ruled against interim measures to pause the implementation of the DPF. The court has yet to statute on the admissibility of the plaintiff, as my colleague and IAPP Director of Research and Insights Joe Jones partial renewal and entry into office of new Members of the General Court. Among familiar names, one will note the renewal of Thomas von Danwitz's term. The German judge has been sitting on the court since 2006 and contributed to decisions that have shaped today's data transfers landscape, in particular as the judge-rapporteur in both "Schrems" cases to date, which saw the invalidation of both the Safe Harbor and the Privacy Shield.
Dutch appointee Ben Smulders, longtime European Commission legal services official, replaces Herke Kranenborg who argued for the Commission in "Schrems I and II." Another notable departure from the court is Vice-President Lars Bay Larsen, as he retires after serving as a judge for 19 years with a keen eye for law enforcement and national security equities.
Even if the European Commission admits the model clause is the most widely used tool for transfers and a truly global instrument, it remains committed to adequacy as a way to strengthen relationships with strategic partners.
The trans-Atlantic deal may have been the one crystallizing the most angst and anticipation, yet several other jurisdictions have seen their adequacy decisions reinforced, typically Canada, New Zealand, Switzerland and soon South Korea. The mutual arrangement with Japan will be extended to new sectors such as research.
The Commission has also been working diligently with Brazil and should formalize its adequacy arrangement in the coming months. It is also exploring potential with other countries in Latin America and the Association of Southeast Asian Nations.
Overall, the EU aims to continue to leverage the network effect of adequacy, whereby triangulations could help amplify the benefits of the system.
Isabelle Roccia, CIPP/E, is the managing director, Europe, for the IAPP.
