European Commission: US offers enough protection for data transfers from EU – IT Pros – News

The European Commission is positive on the resumption of data transfers from the EU to the US in due course. The Commission is now starting the process to take it back due to a framework that will replace the previously abandoned Privacy Shield.

The European Commission is started with the process of a adequate adopt for the EU-US data privacy framework. This framework should replace the Privacy Shield agreement rejected by the European court and should form a new basis for data exchange between the US and the EU. Due to the GDPR, an adequacy decision must follow before personal data can flow freely from the European Economic Area to a third country without further requirements and permissions.

In the adequacy decision, the Commission concludes that the US offers guarantees for data protection and privacy that are “comparable” to those of the EU. In short, according to the Commission, there will be sufficient protection in the US for personal data that companies send from the EU to US companies.

Commission says US companies can join the EU-US data privacy framework if they commit to a number of detailed privacy obligations, such as requesting personal data to be deleted when it is no longer needed and ensuring continued protection of data when it is. shared with third parties. The Commission underlines that EU citizens also have means to take action, such as free and independent dispute resolution mechanisms and an arbitration option.

Privacy Shield was approved by the European Court in 2020 fired. This was due to US surveillance legislation. In the ruling, the Court indicated that the transfer of personal data to another country must be accompanied by a level of protection comparable to that of the GDPR. According to the Court of Justice, the protection was insufficient and the US surveillance programs were disproportionate because they went beyond what was necessary. Furthermore, it was concluded that EU citizens would have too few or no rights to assert anything in a lawsuit against the US government.

Austrian privacy lawyer Max Schrems was behind this lawsuit and also previous one. He is not satisfied with the new draft adequacy decision. In his opinion US rules still fail to meet the proportionality requirement and there is still no adequate access to a court. He also claims that mass surveillance still exists. D66 Sophie in ‘t Veld MEP agrees with Schrems and says that an effective remedy is not possible. You point out that a data protection review court has been set up, but that this is not a real court and just an office of the US government.

The draft of the new adequacy decision is now sent to the European Data Protection Board for opinion. Ultimately, all member states and the European Parliament must give their consent to the decision.