EDPB welcomes improvements under the EU-U.S. Data Privacy Framework, but concerns remain
The European Data Protection Board (EDPB) issued its opinion on the draft adequacy decision concerning the EU-U.S. Data Privacy Framework. While recognizing positive developments such as the introduction of necessity and proportionality for U.S. intelligence gathering and a new redress mechanism for EU data subjects, the EDPB raised concerns and requested clarity on several matters, including rights of data subjects, onward transfers, scope of exemptions, temporary bulk collection of data and practical operation of the redress system.
The EDPB also encourages that the enactment and adoption of the decision should be contingent on updated policies and procedures being adopted by all U.S. intelligence agencies in line with Executive Order 14086. They further suggest that the Commission assess these alterations and share their evaluation with the EDPB.
On December 13, 2022, the European Commission published the Draft Adequacy Decision. Established to replace the Privacy Shield invalidated by the CJEU in the Schrems II judgment, the EU-U.S. Data Privacy Framework (DPF) serves as the foundation for this decision. This framework includes EU-US Data Privacy Framework Principles issued by the U.S. Department of Commerce which are applicable to only those U.S. organisations that have self-certified. In response, the EDPB has adopted its Opinion on the Draft Decision, assessing commercial aspects and U.S. public authorities’ access and usage of data.
