On April 7, 2022, the European Data Protection Board (the “EDPB”) issued a statement on the announcement of a new Transatlantic Data Privacy Framework (the “Statement”).
A new framework for personal data transfers between the EU and the US is needed since the previous EU-US Privacy Shield framework was overturned by the Court of Justice of the Union European Union (“CJEU”) in the Schrem II judgment in July 2020. Discussions on a possible enhanced framework for the EU-US Privacy Shield have recently intensified.
In the statement, the EDPS welcomes the announcement of a political agreement in principle between the European Commission and the United States and indicates that he considers the commitment of the United States authorities to implement measures aimed at protecting the privacy and personal data of EU citizens as a positive first step in the right direction. The EDPS recalls, however, that the joint announcement by the European Commission and the United States does not yet constitute a legal framework on which one can rely to legitimize transfers between the EU and the United States. For now, businesses should continue to take the necessary steps to comply with the transfer requirements of the EU General Data Protection Regulation and the Schrem II judgement.
Once available, the EDPS will review the European Commission’s draft adequacy decision for the US in light of EU law, CJEU case law and its previous recommendations on this subject. In particular, the EDPS will verify how the reforms suggested by the US authorities ensure that the collection of personal data for national security purposes is limited to what is strictly necessary and proportionate, and that an independent redress mechanism is put in place. available to provide EU citizens with a remedy and fair trial.
Read the EDPB statement and press release.
Copyright © 2022, Hunter Andrews Kurth LLP. All rights reserved.National Law Review, Volume XII, Number 97