Today Commission President Ursula von der Leyen and President Biden have announced an “agreement in principle” on a new EU-US data sharing system.
Some facts upfront:
- There is only a political announcement, not a text that can be analyzed. As far as noyb is informed, such a text does not exist yet and will take a couple of months to be drafted.
- This is probably meant by an “agreement in principle”: lawyers still have to find solutions to the problems raised by the Court of Justice (CJEU). So far no fully functioning solutions were delivered despite two years of discussions.
- What noyb hears is that the US is not planning to change its surveillance laws, but only foreseen executive reassurances (using EU language like “proportionality”). It is unclear how this would remotely pass the test by the CJEU, as US surveillance was already held not to be “proportionate” by the CJEU. Previous agreements failed twice in this respect.
- There seems to be no update to the “Privacy Shield” principled for commercial data usage, despite the coming into force of the GDPR since the passing of Privacy Shield.
- Any new deal would not be a bilateral agreement, but an executive decision by the European Commission, that would have to be reviewed by the European Data Protection Board (EDPB) first. This process can only be initiated once there is a legal text. An actual “adequacy decision” would therefore need a couple more months.
- Companies cannot use a deal until it is formally passed, which will take months.
- A decision can quickly be challenged with the European Court of Justice. noyb expects to be able to get any new agreement that does not meet the requirements of EU law back to the CJEU within a matter of months e.g. via civil litigation and preliminary injunctions. The CJEU may even take preliminary action, if a deal is clearly violating previous judgements.
- Overall a political announcement without a solid text, seems to generate even more legal uncertainty for the time being.
Statement:..
Read The Full Article at NOYB
New Trans-Atlantic Data Privacy Framework largely a copy of “Privacy Shield”. noyb will challenge the decision.
Third attempt of the European Commission to get a stable agreement on EU-US data transfers…
Schrems II Judgment Day
The Court of Justice of the European Union (“CJEU“) issued its judgment today in …
