Pressure points remain with EU-US Data Privacy Framework

While a final resolution is near, there’s been more wait-and-see periods than action during negotiations for the EU-U.S. Data Privacy Framework.

First it was months of waiting in between the provisional EU-U.S. agreement on data transfers and the executive order securing U.S. national security commitments. Now concerned parties are set to stand by another six months at least while the European Commission works through a potential adequacy decision.

Privacy professionals stood mostly idle through the extensive dialogues and deliberations as a majority of their previous EU-U.S. Privacy Shield obligations went unchanged in the proposed replacement framework. The lulls in talks led to more reflection and consideration of whether the new agreement would check the boxes that past transatlantic data flow deals could not.

A range of conversations at the IAPP European Data Protection Congress 2022 with relevant officials and stakeholders shed light on much-discussed aspects of the proposed DPF and whether the potential framework may eventually fall back under the Court of Justice of the European Union’s microscope.

Draft adequacy decision top of mind

The European Commission’s adequacy determination is underway and remains on schedule to be completed by spring 2023, according to video remarks at DPC 2022 from European Commissioner for Justice Didier Reynders. While noting it was “difficult to give a precise timeline,” Reynders didn’t refute the the potential for a six-month process similar to prior EU adequacy decisions.

“This involves obtaining an opinion from the European Data Protection Board and a positive vote from (EU) member states. A draft adequacy decision is also subject to the scrutiny of the European Parliament,” Reynders said. “Once this process is completed, the Commission will be able to adopt the final adequacy decision. From that moment on, companies will be able to rely on it to transfer data to the U.S. once in place.”

European Data Protection Board Chair Andrea Jelinek declined to comment on her and the board’s initial analysis of the proposed DPF, indicating the board’s position will be reflected in its submission to the adequacy process when the time comes. However, she did take time to stress the importance of adequacy decisions in the context of global harmonization and “how to come to a common point of view.”

“I’ve never negotiated adequacy decisions. But, as I know from my international work, you negotiate with people sometimes with a completely different cultural background,” Jelinek said. “You start to understand the way of thinking even more and better. … So the decisions are also an opportunity to come closer in data protection and other fields, but also with these ethical and moral backgrounds.”