The proposed Artificial Intelligence Act and a potential advertising technology shakeup courtesy of Meta has taken the EU by storm in recent months. It's a notable shift in the spotlight from the EU-U.S. Data Privacy Framework, which is quietly coming online in the face of ongoing legal questions.
Representatives involved in the operationalization of the DPF since its adoption in July spoke glowingly at the IAPP European Data Protection Congress in Brussels about the strides being made to help make the framework's balance of consumer and business interests a reality. Among the recent achievements discussed was the U.S. Department of Justice's 14 Nov. announcement of the eight appointees to the independent Data Protection Review Court, part of the two-pronged redress system under the DPF.
The court is responsible for independently reviewing findings by the Office of the Director of National Intelligence's Civil Liberties Protection Officer on qualifying complaints filed by non-U.S. persons over potential privacy violations associated with U.S. signals intelligence activities.
The DPRC appointees include James Baker, Rajesh De, James Dempsey, Mary DeRosa, Thomas Griffith, Eric Holder Jr., David Levi and Virginia Seitz. Notably, the executive order for the DPF provides protections against removal of judges.
"The DOJ consulted with the ODNI and the (Privacy and Civil Liberties Oversight Board). You can see from the stature of the individuals appointed that this is something that's being taken very seriously and also speaks to the credibility of the institution being built," ODNI Civil Liberties Protection Officer Rebecca Richards, CIPP/G, CIPP/US, said in exclusive comments to the IAPP in Brussels. "The importance here was privacy and national security experience, and that's what you see all across the selections."
Richards acknowledged that while the appointments were only just announced, the DPRC has been up and running despite not yet receiving a determination. She said her team received a direct complaint from a non-U.S. individual that couldn't be taken up due to improper process. Claims must initially go through a relevant EU member state's data protection authority and then makes its way to the European Data Protection Board before arriving with Richards' team.
While awaiting legitimate claims to send to the DPRC for judgment, Richards indicated the primary objective is to simply raise awareness to the existence of the redress process.
"We've been working with the EDPB about the process to bring a valid complaint. We're trying to get authorities that information, and in their language, in a way that is user friendly," Richards said. "Most importantly for us is they have to give us a selector. That's like an email address or telephone number. … We're just trying to have the barriers low to allow people to exercise their rights."
DPF uptake strong
U.S. Department of Commerce Neema Singh Guliani revealed during a DPC panel discussion with European Commission Head for International Affairs and Data Flows Bruno Gencarelli that 2,500 businesses are certified under the DPF at this point. Guliani said the certification statistics do not include companies in the process of certifying or the third-party affiliates that fall in line with certified companies.
"If you take a step back and think globally, this is an achievement. We’ve gotten countries with different legal systems to show it’s possible to create a system that works," Giuliani told the IAPP in comments after her panel. "And in the meantime, we’re collaborating and working through the G7 and the OECD to build out common international principles. … And this holds importance across the board, from small businesses to human rights."
During the panel, Guliani said a majority of DPF certifications thus far are small and medium-sized businesses and it's a sign that "you can't understate the value economically" of the free flow of data. The percentage of SME uptake compares closely to that of the DPF predecessor, the EU-U.S. Privacy Shield, which Gencarelli said garnered adoption by approximately 6,000 companies overall while it was in effect.
Looming review, litigation
Despite perceptions of seamlessness with standing up the DPF, there are uphill challenges on the horizon for the EU and the U.S. alike to maintain commerce under the framework. There's the immediate considerations toward an annual review and subsequent report by both parties on DPF function and efficiency due July 2024. Legitimate EU legal challenges to the framework are expected in short order as well.
With the review, Gencarelli explained the two sides will go through "an exchange of documents, questions and answers" over the maintenance and oversight of the redress and certification processes. Stakeholders, ranging from businesses to civil society, will also be consulted for impressions regarding interactions with DPF implementation.
"We'll have participation across the interagency to talk through the process and engage with the EU." Giuliani told the IAPP. "We have had ongoing and continuous communication already to ensure smooth implementation. Our goal is to address any issues as they arise."
The elephant in the room remains whether the DPF can pass the legal test NOYB Honorary Chairman Max Schrems is expected to raise to the Court of Justice of the European Union. On the keynote stage at DPC 2022, Schrems vowed to go after the validity of the latest EU-U.S. agreement after two successful challenges at the CJEU.
The Schrems challenge has yet to materialize while Member of French Parliament Philippe Latombe's attempts to have the DPF annulled have been pushed off to this point.
Regardless of the who brings a given challenge or the issues it may raise, both Gencarelli and Giuliani share optimism the CJEU will have their eyes open to a different EU-U.S. data flow landscape than the ones that led two prior invalidated mechanisms. This belief is due in large to negotiators following the CJEU's own views.
"Litigation is not a problem. Litigation is healthy," Gencarelli said, noting the issue is a "valid instrument in the case of litigation" that has now been "negotiated in light of clear criteria set forth in the 'Schrems II' judgement." He added the commission is in a position to "defend (the DPF) strongly" with direct remedies for the CJEU's prior issues with U.S. law enforcement access to data as well as necessity and proportionality now in place.
