TOTAL: {[ getCartTotalCost() | currencyFilter ]} Update cart for total shopping_basket Checkout

The Privacy Advisor | MEPs urge European Commission to reject EU-US adequacy Related reading: EU-US draft adequacy decision arrives, EU process begins in earnest




The European Parliament Committee on Civil Liberties, Justice and Home Affairs does not want the European Commission to extend an adequacy decision to the U.S. based on the proposed EU-U.S. Data Privacy Framework. The committee made as much clear in its draft opinion on the EU-U.S. adequacy published Feb. 14.

In their opinion, committee members concluded the proposed DPF "fails to create actual equivalence in the level of protection" offered under the EU General Data Protection Regulation and urged the European Commission to only adopt a decision when "meaningful reforms were introduced, in particular for national security and intelligence purposes" on the part of the U.S. The urging comes after the LIBE committee hosted European Commissioner for Justice Didier Reynders Jan. 31 for questioning related to the proposed DPF and potential adequacy.

Parliament and the European Data Protection Board each have the opportunity to present nonbinding opinions for the European Commission to consider toward its adequacy decision.

"The current impasse on transfers of personal data from the EU to the U.S. is one of the top concerns of many economic operators, on both sides of the Atlantic Ocean. This situation simply must be resolved," IAPP Senior Westin Fellow Jetty Tielemans said, adding involved parties and stakeholders "should let the process run its due course."

Others view the LIBE committee's opinion as a noteworthy step toward accountability and warrants serious consideration before granting the U.S. adequacy.

"With the EDPB's opinion on the framework weeks away, I think the Parliament's resolution is very timely, and might also influence the (data protection authorities') debate on whether or not the framework is indeed essentially equivalent." Maastricht University European Centre on Privacy and Cybersecurity Senior Visiting Fellow Paul Breitbarth said. "I have no doubt it is a big step in the right direction, but I'm not convinced it is enough."

The committee described its key discrepancies with the proposed framework, specifically with the subjects of equivalent protections and the proposed redress system the U.S. plans to establish for EU consumers.

"It is important to thereby keep in mind that adequacy does not require that the laws in both countries are identical." Tielemans said. "Protection of EU data sent overseas can be achieved in different manners and it is ultimately up to the competent courts in the EU to decide whether the recipient country offers sufficient protection."

MEPs said "differing definitions of key data protection concepts such as principles of necessity and proportionality" are worrisome, as is the lack of comprehensive federal privacy legislation and adherence to a U.S. executive order. Specific pause with the executive order stems from a lack of "clear, precise or foreseeable" application and the potential for the order to "be amended at anytime by the U.S. president."

"I think Parliament has a point when it comes to proportionality. Despite the (executive order) being much more clear on what is considered to be proportionate and not, it is still hard to understand for the average citizen," Breitbarth said. "Yet, in my view, it would be a big gain if all European member states were as transparent about their bulk collection of intelligence data, which they certainly are not."

With consumer redress, MEPs said the proposed Data Protection Review Court raises issues with a perceived lack of independence and general transparency. In the committee's view, the DPRC's process is "based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed" and it does not allow for appeals to federal courts or the opportunity to claim damages where appropriate.

According to Politico, European Parliament officials indicated the draft opinion will be formally presented in the LIBE committee at the beginning of March with hope of filing the final resolution by month's end. The opinion would then go to a full parliament vote in April. The European Commission has maintained its hope to finalize the adequacy decision by July at the earliest.

EU-US Data Privacy Framework – Guidance and Resources

This page will stay updated with the latest announcements, analysis and additional resources covering the long-awaited EU-U.S. Data Privacy Framework.

View Here

Credits: 1

Submit for CPEs


If you want to comment on this post, you need to login.

  • comment Robert Baugh • Feb 15, 2023
    Hmm. I agree with the comment that Member States aren't always as transparent. I doubt any Law Enforcement or Intelligence Service in the EEA sends "Art 14 notices" to anybody. And as to an EO being possibly overturned by a future President- yes, just as EU laws or Japanese laws etc can be changed. The process may be different but the logic is the same. If the EO is revoked, the adequacy decision goes unless there are then other safeguards in place.
  • comment Cameron Kerry • Feb 15, 2023
    Quite right, Robert.  The draft adequacy decision says “Where the Commission has indications that an adequate level of protection is no longer ensured, the Commission shall inform the competent U.S. authorities. If necessary, it will decide to suspend, amend or repeal this Decision, or limit its scope,  ….”  It is certainly possible for a US President to revise or revise or revoke an EO, but they have enduring history.  EO 12,333 on foreign surveillance has been revised once since 1983, to reflect changes to law law and agencies after 9/11, and the Trump administration left President Obama’s PPD-28 on protection of non-US persons intact.  The Emancipation Proclamation was an executive order.
  • comment Oliver Kindzorra • Mar 14, 2023
    DPF isn't, and never will be, a proper base for an US-EU adequacy. Only ADDPA can be! And I don't know why no one is seeing it as an additional point to drive ADDPA forward. Neither the US Law Maker nor the EU Commission seems to realize that it could be a win-win for both of them. Instead they both aim for a quick win instead of "get it right". Guess who is waiting and rubbing his hands in glee, if DPF goes live? And who is the next one rubbing his hands in glee if it fails in EUCJ the third time? Therefore ADDPA is the only base that a US-EU adequacy can be based on that can, if everything done right, will end this nightmare for everyone on both sides of the pond.