The European Parliament Committee on Civil Liberties, Justice and Home Affairs does not want the European Commission to extend an adequacy decision to the U.S. based on the proposed EU-U.S. Data Privacy Framework. The committee made as much clear in its draft opinion on the EU-U.S. adequacy published Feb. 14.
In their opinion, committee members concluded the proposed DPF "fails to create actual equivalence in the level of protection" offered under the EU General Data Protection Regulation and urged the European Commission to only adopt a decision when "meaningful reforms were introduced, in particular for national security and intelligence purposes" on the part of the U.S. The urging comes after the LIBE committee hosted European Commissioner for Justice Didier Reynders Jan. 31 for questioning related to the proposed DPF and potential adequacy.
Parliament and the European Data Protection Board each have the opportunity to present nonbinding opinions for the European Commission to consider toward its adequacy decision.
"The current impasse on transfers of personal data from the EU to the U.S. is one of the top concerns of many economic operators, on both sides of the Atlantic Ocean. This situation simply must be resolved," IAPP Senior Westin Fellow Jetty Tielemans said, adding involved parties and stakeholders "should let the process run its due course."
Others view the LIBE committee's opinion as a noteworthy step toward accountability and warrants serious consideration before granting the U.S. adequacy.
"With the EDPB's opinion on the framework weeks away, I think the Parliament's resolution is very timely, and might also influence the (data protection authorities') debate on whether or not the framework is indeed essentially equivalent." Maastricht University European Centre on Privacy and Cybersecurity Senior Visiting Fellow Paul Breitbarth said. "I have no doubt it is a big step in the right direction, but I'm not convinced it is enough."
The committee described its key discrepancies with the proposed framework, specifically with the subjects of equivalent protections and the proposed redress system the U.S. plans to establish for EU consumers.
"It is important to thereby keep in mind that adequacy does not require that the laws in both countries are identical." Tielemans said. "Protection of EU data sent overseas can be achieved in different manners and it is ultimately up to the competent courts in the EU to decide whether the recipient country offers sufficient protection."
MEPs said "differing definitions of key data protection concepts such as principles of necessity and proportionality" are worrisome, as is the lack of comprehensive federal privacy legislation and adherence to a U.S. executive order. Specific pause with the executive order stems from a lack of "clear, precise or foreseeable" application and the potential for the order to "be amended at anytime by the U.S. president."
"I think Parliament has a point when it comes to proportionality. Despite the (executive order) being much more clear on what is considered to be proportionate and not, it is still hard to understand for the average citizen," Breitbarth said. "Yet, in my view, it would be a big gain if all European member states were as transparent about their bulk collection of intelligence data, which they certainly are not."
With consumer redress, MEPs said the proposed Data Protection Review Court raises issues with a perceived lack of independence and general transparency. In the committee's view, the DPRC's process is "based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed" and it does not allow for appeals to federal courts or the opportunity to claim damages where appropriate.
According to Politico, European Parliament officials indicated the draft opinion will be formally presented in the LIBE committee at the beginning of March with hope of filing the final resolution by month's end. The opinion would then go to a full parliament vote in April. The European Commission has maintained its hope to finalize the adequacy decision by July at the earliest.
