EU-US data privacy framework

the commonly used EU Standard Contractual Clauses (“SCCs”).

background

The EU prohibits the transfer of EU personal data to jurisdictions whose data protection regime is not deemed to be “adequate” in protecting the rights and privacy of individuals (including the US). Such transfers may only take place under an appropriate transfer mechanism deemed by the EU to adequately safeguard the personal data concerned.

The EU-US Privacy Shield was previously one of the transfer mechanisms deemed sufficient in providing adequate data protection for transatlantic data transfers. In 2020, the European Court of Justice ruled, in the case of Schrems II, that the EU-US Privacy Shield was an inadequate transfer mechanism due to concerns surrounding the ability of US intelligence agencies to intercept personal data and the lack of redress for EU data subjects.

the new framework

The steps taken under the Executive Order aim to address the issues identified in the Schrems II decision to ensure the new Framework is deemed adequate by:

• limiting access to EU personal data by US intelligence agencies to what is “necessary” and “proportionate” to protect US national security;
• enhancing the requirements for the handling of personal data collected by US intelligence agencies; and
• establishing a redress system for non-US persons to obtain an independent and binding review and redress of claims that personal data collected by US intelligence agencies is processed in violation of US privacy law.

important considerations

Although the Executive Order authorises the implementation measures required under the new Framework, the EC must finalise the issuance of the formal adequacy decision to approve the Framework for use by organisations. The draft adequacy decision was transmitted to the European Data Protection Board (EDPB) for its opinion. The EC will need approval from a committee with representatives of the EU Member States, and the European Parliament has a right of scrutiny over the adequacy decision until its final adoption.

If the Framework is approved for use, organisations will not be required to put in place additional transfer mechanisms to safeguard the transfer of EU personal data to the US (such as, SCCs or Binding Corporate Rules), significantly reducing the burden on such organisations.