On Monday 10 July, the European Commission adopted the adequacy decision establishing a new framework for the transfer of personal data between the EU and the United States.
This decision confirms that the framework negotiated with the United States offers an adequate level of protection for personal data transferred from the EU. European data will therefore be able to circulate freely to US companies participating in the framework.
The Commissioner for Justice, Didier Reynders, hailed this as a “significant step forward”. And with good reason: the two previous frameworks, Safe Harbour (see EUROPE 11404/1) and Privacy Shield (see EUROPE 12529/2), have both been invalidated by the Court of Justice of the EU (CJEU). In Mr Reynders’ view, the current framework meets the requirements of the CJEU, namely to limit the use of European data by US intelligence services and to introduce effective redress mechanisms for EU citizens.
Intelligence services
One of the conclusions of the CJEU’s rulings on the previous legal frameworks is that the use of the data was not sufficiently regulated to meet the requirements of proportionality, insofar as non-US citizens did not benefit from any limitations or guarantees.
For Mr Reynders, the executive order issued by US President Joe Biden on 3 July, which updates the internal procedures of intelligence agencies, means that “the necessity and proportionality requirements are now clearly spelled out through binding and enforceable safeguards”. Before accessing personal data transferred from the EU to US companies, intelligence agencies will now have to weigh up factors such as the nature of the data, the seriousness of the threat, and the likely impact on the rights of the individuals concerned.
Recourse mechanism
Furthermore, in its rulings, the CJEU found that the previous frameworks did not provide an effective and sufficiently independent appeal mechanism for European citizens. The current framework thus introduces a two-stage mechanism.
On the one hand, complainants will not have to demonstrate that the American intelligence services had access to their data for their complaint to be admissible. They will be able to lodge complaints free of charge and in their own language, through their national data protection authority, which will forward them to the “Civil Liberties Protection Officer” in the United States through the European Data Protection Board (EPDB).
Individuals will also be able to appeal the US officer’s verdict to the new Court of Data Protection Review, which is empowered to make binding corrective decisions. For example, it will be able to “order the deletion of data that would have been collected in violation of the requirements of necessity or proportionality”, explained the Commissioner. The plaintiffs’ interests will be represented free of charge by a special advocate with the necessary security clearance, who will have to be heard before the Court can pass judgment.
Towards new proceedings before the CJEU?
While the Commissioner defended a framework based on “solid” principles and presenting “considerable progress”, Max Schrems, the campaigner behind the two actions before the CJEU, does not share his analysis. Through his association, Nyob, he announced that a new appeal “is ready to be filed” (https://aeur.eu/f/7zu ).
In particular, he considers that there is no guarantee that the term “proportional” will be interpreted in accordance with the Charter of Fundamental Rights and that European users will therefore be protected from mass surveillance. Like the European Parliament, he also questions the independence and effectiveness of the appeal mechanism (see EUROPE 13161/2).
While declaring that he was “without any illusion”, Mr Reynders called for the new framework to be given time to prove itself before lodging a complaint with the CJEU. He also assured that “the Commission will be particularly vigilant regarding the implementation of this new legal framework and will not hesitate to react if any problems arise”.
The adopted adequacy decision: https://aeur.eu/f/7zt (Original version in French by Hélène Seynaeve)