The draft adequacy decision of the European Commission, which aims to strengthen and replace the 2016 certification for the EU-US Privacy Shield Framework (“Privacy Shield”), was submitted in December in response to the Schrems II decisions made by the Court of Justice of the European Union (“CJEU”). The Commission has forwarded the draft decision to the European Data Protection Board (“EDPB”) for review and comment. A panel of representatives from EU Member States is currently assessing it, and we anticipate its approval by the third anniversary of the Schrems II judgment in July 2023. The European Parliament has the right to examine and provide feedback on the draft decision, but it does not have the authority to modify or reject it.
Once these procedures are completed, the Commission will be able to officially adopt a final adequacy decision.
If the new adequacy decision is adopted, the most significant outcome will be the enforcement of US data protection laws on entities that certify to the EU-US Data Privacy Framework (“DPF”), which is the successor to the Privacy Shield. This decision will ensure that an “essentially equivalent level of protection” is guaranteed in the EU.
US entities that process personal data under the DPF will no longer need to undergo Schrems II scrutiny, as they will have signed Standard Contractual Clauses (SCCs) or conducted Transfer Impact Assessments (“TIAs”) on a case-by-case basis for transfers of personal data from the EU to the US. For eligible businesses seeking DPF certification, the adequacy determination will significantly lessen the compliance burden.
For companies without DPF certification, SCC may continue to be the default transfer mechanism. Although these transfers will still require a TIA, the draft adequacy determination recognizes that appropriate legal safeguards regarding government intelligence-gathering activities now exist in the United States, which reduces the need to scrutinize this aspect of the test.
Both the EU Commissioner and US officials believe that the new adequacy decision addresses the concerns raised in the Schrems II case. However, relying solely on the DPF remains a legal risk, as privacy advocates are already planning legal challenges, and the decision will likely be subject to review by the CJEU.
Clarification of the draft adequacy decision regarding the operation of EU-US personal data transfers under the DPF would be beneficial. Once in effect, this decision is expected to significantly ease one of the more challenging administrative hurdles associated with the transfer of personal data.
While DPF certification and potential enforcement by the U.S. Federal Trade Commission must be taken into account when transferring data from the EU to the United States, many organizations seeking a streamlined transition model are not interested in DPF. Authentication is expected to generate considerable interest instead.
The duration of the DPF is uncertain, particularly given the long history of legal challenges to prior EU-US adequacy decisions. However, officials involved in the process are optimistic that the substantive concerns have been addressed this time around and that they will not be subject to further scrutiny.
If you have any questions about this topic, please contact us: info@delta-compliance.com
