\n<\/p>\n
The European Union has adopted a new transatlantic data adequacy agreement with the US.<\/p>\n
The much anticipated decision means there\u2019s an immediate resolution to legal uncertainty around exports of EU users\u2019 personal data by US companies \u2014 a problem that\u2019s affected thousands of business in recent years, big and small, including the likes of Meta<\/a> and\u00a0Google<\/a>\u00a0to name a couple of the most high profile examples.<\/p>\n Speaking during a press conference announcing the adequacy decision, EU justice commissioner Didier Reynders sounded confident that this time \u2014 the third such\u00a0 arrangement the bloc\u2019s executive has granted the US \u2014 will indeed be third time lucky.<\/p>\n \u201cWith the adoption of the adequacy decision, personal data can now flow freely and safely from the European Economic Area to the United States without any further conditions or authorizations,\u201d he said. \u201cTherefore, the adequacy decision, ensure that data can be transmitted between the European Union and the US on the basis of a stable and trusted arrangement that protects individuals and provides legal certainty to companies.\u201d<\/p>\n Political agreement on the EU-U.S. Data Privacy Framework (DPF) was announced back in March 2022\u00a0<\/a>but it\u2019s taken over a year to get all the \u2018i\u2019s dotted and \u2018t\u2019s crossed. While the prior mechanism for simplifying exports of data over the pond was invalidated by EU judges almost three years ago<\/a>. So the adoption of a new adequacy deal really does pull the shutter down on years of legal uncertainty affecting major US cloud services and scores of other digital players.<\/p>\n That said, the big question for the DPF is how enduring this third EU-US data adequacy agreement will be \u2014 and that very much remains to be seen, despite the EU taking more time than it did last time to sweat the detail of the new framework.<\/p>\n At today\u2019s press conference Reynders was sounding a lot more bullish than usual on this topic, arguing the framework is not simply a copypaste of earlier (failed) transfer mechanisms but \u201ca very different system\u201d \u2014 one he suggested is \u201ca very robust solution\u201d to an entrenched legal divide.<\/p>\n He also suggesting the EU has listened closely to feedback as it worked to finalize a framework he claimed ensures \u201cfull compliance with the conditions set in the ruling of the EU\u2019s highest court\u201d.<\/p>\n \u201cThis was my mandate and my focus in these negotiations, and this is reflected in the solutions we have obtained,\u201d he suggested. \u201cThey specifically address the requirements set by the court as regards the need for limitations and safeguards for access to data by US intelligence agencies in line with the principles of necessity and proportionality and the need to ensure effective redress for EU individuals.\u201d<\/p>\n Nonetheless legal challenges to the DPF are on the way. Both predecessor arrangements (aka, Safe Harbor<\/a> and Privacy Shield<\/a>) were struck down by the bloc\u2019s top court after judges found exported personal data was not protected to the required legal standard given risks posed by sweeping US surveillance powers. And privacy campaigners are warning the new framework could be in front of the CJEU within months.<\/p>\n One key point for critics is that since Privacy Shield\u2019s demise we have still not seen reform of US surveillance powers, with no moves by lawmakers to accept the need to reform the controversial FISA 702 provision and pass protections for foreigners\u2019 information.<\/p>\n That means, at root, the DPF is still papering over the same fundamental legal conflict, between EU privacy rights and US surveillance powers, and could inexorably face the same assessment of inadequacy once EU judges get to scrutinize the detail.<\/p>\n In recent months a number of other EU institutions have raised concerns<\/a> that the Commission\u2019s planned replacement lacks clarity<\/a>, also suggesting the tweaks on the prior approach may fall short of delivering the necessary essential equivalence in protection for data when it\u2019s over the pond. Although there has also been a recognition by bodies such as the European Data Protection Board that the DPF goes further than earlier data transfer deals. The question is whether it goes far enough to meet the CJEU\u2019s bar.<\/p>\n The Commission decision itself doesn\u2019t mean much since it\u2019s solely responsible for adopting EU adequacy decisions \u2014 and Reynders conceded that today\u2019s green light is essentially a \u201cunilateral\u201d decision by the EU\u2019s executive \u2014 so the bloc\u2019s lawmakers are in the luxurious position of getting to mark their own homework once again, despite a history of getting these self-same equations wrong.<\/p>\n Privacy campaign group noyb \u2014 whose founder and chairman, Max Schrems, was behind the original complaint against Facebook\u2019s EU-US data transfers \u2014 remains critical of the framework.<\/p>\n Responding to the Commission\u2019s adequacy decision announcement today, noyb<\/a> confirmed it will lodge a legal challenge \u2014 saying it has \u201coptions for a challenge\u201d ready to be sent to regulators and expects the issue to be back with the CJEU by the beginning of next year. <\/span><\/p>\n