The European Parliament Committee on Civil Liberties, Justice and Home Affairs does not want the European Commission to extend an adequacy decision to the U.S. based on the proposed EU-U.S. Data Privacy Framework. The committee made as much clear in its draft opinion on the EU-U.S. adequacy published Feb. 14.
In their opinion, committee members concluded the proposed DPF "fails to create actual equivalence in the level of protection" offered under the EU General Data Protection Regulation and urged the European Commission to only adopt a decision when "meaningful reforms were introduced, in particular for national security and intelligence purposes" on the part of the U.S. The urging comes after the LIBE committee hosted European Commissioner for Justice Didier Reynders Jan. 31 for questioning related to the proposed DPF and potential adequacy.
Parliament and the European Data Protection Board each have the opportunity to present nonbinding opinions for the European Commission to consider toward its
"The current impasse on transfers of personal data from the EU to the U.S. is one of the top concerns of many economic operators, on both sides of the Atlantic Ocean. This situation simply must be resolved," IAPP Senior Westin Fellow Jetty Tielemans said, adding involved parties and stakeholders "should let the process run its due course."
Others view the LIBE committee's opinion as a noteworthy step toward accountability and warrants serious consideration before granting the U.S. adequacy.
"With the EDPB's opinion on the framework weeks away, I think the Parliament's resolution is very timely, and might also influence the (data protection authorities') debate on whether or not the framework is indeed essentially equivalent." Maastricht University European Centre on Privacy and Cybersecurity Senior Visiting Fellow Paul Breitbarth said. "I have no doubt it is a big step in the right direction, but I'm not convinced it is enough."
The committee described its key discrepancies with the proposed framework, specifically with the subjects of equivalent protections and the proposed redress system the U.S. plans to establish for EU consumers.
"It is important to thereby keep in mind that adequacy does not require that the laws in both countries are identical." Tielemans said. "Protection of EU data sent overseas can be achieved in different manners and it is ultimately up to the competent courts in the EU to decide whether the recipient country offers sufficient protection."
MEPs said "differing definitions of key data protection concepts such as
