European-American personal data protection relations

Harmonized Rules For Data Protection

What this decision means is that the implementation process of the EU-US Data Privacy Framework - initiated in March 2022 - comes to a successful end. The process was necessary after the Court of Justice of the European Union (CJEU) invalidated the European Commission’s adequacy decision for the EU-US Privacy Shield Framework in July 2020. The new EU-US Data Privacy Framework enters into force with immediate effect.

New Safeguarding Rules

The EU-US Data Privacy Framework is set to provide confirmation of an adequate level of personal data protection in the US. The Framework provides a new set of rules and binding safeguards to limit access to data by US intelligence authorities to what is necessary and proportionate to protect national security.

Resolving European Complaints

It also enforces procedures to ensure effective oversight of new privacy and civil liberties standards and introduces a new two-tier redress system to investigate and resolve complaints of Europeans on access of data by US intelligence authorities, including a new Data Protection Review Court.

Adhering to Standards

Furthermore, the Framework requires companies processing data transferred from the EU to self-certify (and re-certify annually) that they adhere to the standards set in the Framework through the US Department of Commerce.

Criticisms On Horizon

Although the new Framework does take several new steps in the direction of answering the concerns of the CJEU and privacy activists, some critics point out, that the measures implemented under the EU-US Data Privacy Framework do not go far enough in securing the EU citizens privacy rights. One main criticism is the unsatisfactory level of changes in US Federal Law, as well as a lack of independence of the newly introduced Data Protection Review Court. As a result, new complaints to the CJEU may be on the horizon.

---

Published: July 2023