New adequacy decision personal data transfers between the US and EU

On 10 July 2023, the European Commission adopted a new adequacy decision for personal data transfers between the US and EU. How does the new "EU-U.S. Data Privacy Framework" affect you?

On 10 July 2023, the European Commission adopted a new adequacy decision for the transfer of personal data to participating US companies, replacing the "EU-US Privacy Shield" adequacy decision invalidated by the Court of Justice of the EU in the Schrems II case on 16 July 2020.

The Schrems II case had major implications for the legal certainty of companies and organisations that relied on US-based tech companies for their operations. Indeed, processing activities of companies and organisations based in the EU are subject to the European General Data Protection Regulation ("GDPR"), regardless of whether a particular processing takes place within the EU.

The article below outlines the expected impact of the new adequacy decision on EU-based companies and organisations in the coming period.

Introduction

In the new adequacy decision, the US and the European Commission have introduced new safeguards in response to the specific criticism by The Court of Justice of the EU in the Schrems II judgment. Following negotiations between the Biden administration in the US and the European Commission under Ursula von der Leyen, the US and the European Commission agreed on a replacement for Privacy Shield, not called "Privacy Shield 2.0" as it was also called in a preliminary stage, but ultimately called "EU-U.S. Data Privacy Framework".

The changes include introducing a "proportionality criterion" when using the powers of US public authorities. As well as introducing new remedies for non-US citizens, such as Europeans, to invoke their rights. The "EU-U.S. Data Privacy Framework" otherwise works in much the same way as the previous two adequacy decisions with the US.

Privacy rights organisations and activists have already been highly critical of a new adequacy decision with the US to replace "EU-US Privacy Shield". Privacy activists have already announced their intention to get this adequacy decision off the table in a third round. According to critics, "EU-U.S. Data Privacy Framework" hardly differs from "EU-US Privacy Shield", which in turn hardly differs from its predecessor the "Safe Harbour" adequacy decision, also declared invalid by the EU Court of Justice. Critics also say the new safeguards in response to ECJ criticism are insufficient.

What about transferring personal data outside the EU?

Contrary to what is sometimes feared in practice, it is not always prohibited to transfer personal data outside the EU. Nor is it the case that under the GDPR, the laws and regulations in other countries must always be exactly the same as the GDPR in order to allow the transfer of personal data. However, the GDPR attaches a condition to the transfer of personal data, the following principle applies:

" Article 44 GDPR: Personal data processed or intended to be processed after transfer to a third country or an international organisation may be transferred only if, without prejudice to the other provisions of this Regulation, the controller and the processor have complied with the conditions laid down in this chapter; this also applies to further transfers of personal data from the third country or an international organisation to another third country or another international organisation. All the provisions of this Chapter shall be applied so that the level of protection guaranteed to natural persons by this Regulation is not undermined."

The adequacy decision is a decision within the meaning of Article 45(1) GDPR. The European Commission may decide that the third country, a territory or one or more specified sectors within that third country, or an international organisation ensures an adequate level of protection. It need not necessarily be the same as the GDPR, but similar enough to ensure the level of protection for the individuals to whom the personal data relates ("the data subject”). Third countries in this context means countries outside the European Economic Area (EEA), the EEA consists of all EU member states supplemented by Norway, Iceland and Liechtenstein.

Current list of adequacy decisions as of end-July 2023

The European Commission has identified the following countries as not undermining the level of protection guaranteed to individuals by the GDPR with regard to personal data protection.

• Andorra,
• Argentina,
• Canada (commercial organisations in Canada only),
• Faroe Islands,
• Guernsey,
• Israel,
• Isle of Man,
• Japan,
• Jersey,
• New Zealand,
• Republic of Korea (South Korea),
• Uruguay,
• the United Kingdom
• the United States (only commercial organisations participating in the new "EU-US Data Privacy Framework") and
• Switzerland

This list may change according to circumstances in those third countries. The European Commission reviews at least every 4 years whether the level of protection is still adequate.

Previous history

The “EU-US Privacy Shield” was an adequacy decision by the European Commission that provided for the transfer of personal data in accordance with the condition set by the GDPR. The adequacy decision applied to US listed companies, this voluntary regime was intended to give US and EU-based participants greater legal certainty in transatlantic exchanges of personal data.

The Court of Justice of the EU declared "EU-US Privacy Shield" invalid in the famous Schrems II ruling.

The Court of Justice of the EU previously handed down the Schrems I judgment of 6 October 2015. In this judgment, the direct predecessor of the “EU-US Privacy Shield” adequacy decision, the adequacy decision called “Safe Harbour”, was also previously declared invalid.

In Schrems II, the CJEU ruled, inter alia (emphasis added):

"184 Accordingly, neither section 702 FISA nor E.O. 12333, read in conjunction with PPD28 , appear to correspond to  the minimum requirements resulting from the principle of proportionality in Union law, so that surveillance programmes based on these provisions cannot be considered to be limited to what is strictly necessary."

And:

" 187 According to settled case-law, the existence of effective judicial review to ensure compliance with the provisions of Union law is inherent in the existence of a State governed by the rule of law. Legislation which does not provide for any means of redress for the individual concerned in order to obtain access to personal data concerning him, or rectification or deletion of those data, does not respect the essential content of the fundamental right to an effective remedy enshrined in Article 47 of the Charter (judgment of 6 October 2015, Schrems (ed. now 'Schrems I'), C362/14 , EU:C:2015:650, paragraph 95 and case-law cited therein).

[...]

190 In the present case, the Commission's finding in the Privacy Shield Decision that the United States ensures a level of protection broadly equivalent to that guaranteed by Article 47 of the Charter is called into question, in particular on the grounds that the appointment of the Privacy Shield Ombudsman cannot remedy the gaps identified by the Commission itself with regard to the judicial protection of individuals whose personal data are transferred to that third country."

What's in the "EU-U.S. Data Privacy Framework"?

The "EU-U.S. Data Privacy Framework" is partly a copy of "Privacy Shield". Compared to "Safe Harbour" and "Privacy Shield", the "EU-U.S. Data Privacy Framework" does have some differences in response to criticisms by the Court of Justice of the EU that had focused in particular on the "rule of law" and "remedies for EU citizens" in terms of the criteria prescribed in Article 45(2) GDPR against which the European Commission should assess adequacy, as well as the applicable human rights treaties and the EU Charter of Fundamental Rights.

"Article 45(2) GDPR: When assessing whether the level of protection is adequate, the Commission shall in particular take into account the following aspects.
    (a) the rule of law, respect for human rights and fundamental freedoms, applicable general and sectoral legislation, including on public security, defence, national security and criminal law and access by public authorities to personal data, as well as the implementation of such legislation, data protection rules, professional rules and security measures including rules for onward transfers of personal data to another third country or international organisation that are complied with in that country or international organisation, precedents in case law, as well as the existence of effective and enforceable data subjects' rights and effective administrative or judicial redress mechanisms for data subjects whose personal data are transferred;
    (b) the existence and effective functioning of an independent supervisory authority or authorities in the third country or to which an international organisation is subject, whose tasks include ensuring compliance with data protection rules and enforcing them with appropriate enforcement powers, assisting and advising data subjects in the exercise of their rights and co-operating with the supervisory authorities of the Member States; and
    (c) international commitments made by the third country or international organisation in question, or other obligations arising from legally binding agreements or instruments, as well as the participation of that third country or international organisation in multilateral or regional arrangements, in particular with regard to the protection of personal data."

Adequate level of protection for participating companies not the US as a country

It is important to realise that none of the adequacy decisions for the US ever applied to the entire country. The US and, to a lesser extent, Canada are a case apart from the other countries on the list of countries for which an adequacy decision is in force. Also, the current adequacy decision applies only to US companies that have voluntarily joined it.

Therefore, if you are dealing with a party in the US, you should always check whether they are on the list of participating companies, if not another transfer mechanism from Article 46(2) GDPR such as the Binding Corporate Rules ("BCR"), the Standard Contractual Clauses ("SCCs"), or if these are also not an option, a transfer mechanism from Article 49 GDPR, such as explicit consent of the data subject for the transfer, will still have to be used.

Response to criticism from EU Court of Justice

The European Commission stated about the new safeguards in the "EU-U.S. Data Privacy Framework" in a statement (emphasis added):

"US companies can join the EU-US data privacy framework by committing to comply with a detailed set of privacy obligations, for example the obligation to erase personal data when it is no longer needed for the purpose for which it was collected, and to ensure continuity of protection when personal data is shared with third parties.

EU citizens will have access to various remedies if their data is mishandled by US companies. This includes free independent dispute resolution mechanisms and an arbitration panel.

In addition, the US legal framework provides for a number of safeguards regarding access to data transferred under the framework by US government agencies, in particular for criminal law enforcement and national security purposes. Access to data is limited to what is necessary and proportionate to protect national security.

EU citizens will have access to an independent and impartial redress mechanism regarding the collection and use of their data by US intelligence agencies, including a newly created Data Protection Review Court (DPRC). The court will independently investigate and resolve complaints, including by adopting binding corrective measures."

Critics say "EU-U.S. Data Privacy Framework" is nothing more than a copy of "Privacy Shield". US law regarding the broad powers of public authorities such as security and intelligence agencies has not changed. While the US president mirrors European terminology regarding proportionality and uses the word "proportionate" in Executive Order 14086 of October 7, 2022 when implementing the agreements with the European Commission, the same executive order also established that the US considers the powers of its security and intelligence agencies, including explicitly the controversial "bulk collection" of data, to be proportionate and legitimate:

"(B) signals intelligence activities shall be conducted only to the extent
and in a manner that is proportionate to the validated intelligence priority
for which they have been authorised, with the aim of achieving a proper
balance between the importance of the validated intelligence priority being
advanced and the impact on the privacy and civil liberties of all persons,
regardless of their nationality or wherever they might reside."

The purposes explicitly prohibited by the executive order are limited and narrowly formulated, making the likelihood that US security and intelligence agencies will violate these limits relatively low compared to European laws and regulations in the same area:

"(ii) Prohibited purposes.
(A) Signals intelligence collection activities shall not be conducted for
the purpose of:
(1) suppressing or burdening criticism, dissent, or the free expression
of ideas or political opinions by individuals or the press;
(2) suppressing or restricting legitimate privacy interests;
(3) suppressing or restricting a right to legal counsel; or
(4) disadvantaging persons based on their ethnicity, race, gender, gender identity, sexual orientation, or religion.
(B) It is not a legitimate purpose to collect foreign private commercial information or trade secrets to afford a competitive advantage to United States companies and United States business sectors commercially. The collection of such information is authorised only to protect the national security of the United States or of its allies or partners."

Rule of law

According to critics, the European Commission and the US are trying to pull a 'trick' by using the terminology of principles developed in European human rights jurisprudence with words such as 'proportionate' and 'necessary to advance a validated intelligence priority', but by using this language, the US president is in reality not referring to the criteria of 'necessity, proportionality and proportionality', as developed in European case law in the field of assessing the justification of restriction of human rights. In other words, the US reserves the right to decide for itself what it considers "proportionate", while the recent past has already shown that these interest trade-offs between national security and the right to privacy in the European legal order and the US legal order tend to fall in the opposite direction.

Legal remedies for European citizens

Also, according to critics, "EU-U.S. Data Privacy Framework" still does not provide sufficient legal protection with regard to remedies for data subjects who are not US citizens. Indeed, according to these critics, the arbitration panels and the "Data Protection Review Court" are not real courts within the intention of the GDPR as a condition of transfer. Critics say they are the same inadequate ombudsman mechanism from "EU -US Privacy Shield", but now split into two roles and under new names.

Will this adequacy decision also be invalidated?

The "EU -US Privacy Shield" adequacy decision was implemented by the European Commission on 12 July 2016, took effect 1 August 2016 and was invalidated four years later by the EU Court of Justice on 16 July 2020. Privacy Shield's predecessor the "Safe Harbour" adequacy decision was adopted by the European Commission on 26 July 2000 and invalidated by the EU Court of Justice's 6 October 2015 ruling in the Schrems I case. The previous two adequacy decisions thus held for four to five years. Max Schrems, the Austrian lawyer and privacy activist who gave his name to the Schrems I and Schrems II cases has already announced his ambition to be back at the EU Court of Justice within months for a third round.

Legal uncertainty and risks

For companies and organisations that may transfer personal data to the US either as a controller or as a processor, the question whether the transfer of personal data to the US is permissible in their situation is of great importance. Given that the vast majority of IT originates in the US, the likelihood that eventually somewhere in the chain of sub-processors a recipient will be located in the US is quite high in most cases.

Fines

For companies and organisations to whose processing activities the GDPR applies, there are very high risks involved. On violation of the obligations regarding transfer of personal data outside the EU, the GDPR provides for a maximum fine of up to €20 000 000,- or up to 4% of a company's total annual worldwide turnover in the previous financial year, whichever is higher. The GDPR also contains a separate liability ground, under which a person to whom personal data relates who has suffered material or immaterial damage can hold a controller or processor liable for the damage.

For private individuals, by the way, there is usually no such legal risk, as the GDPR has a lower limit, also called the "household limit". The GDPR does not apply when personal data are processed by a natural person in the exercise of a purely personal or household activity.

Risks in international legal relations

In international agreements with parties based in the US or elsewhere outside the EU/EEA, there is usually a significant risk if a contracting party abroad does not act in accordance with the GDPR, but the European party is legally responsible for that party's actions, e.g. on the basis of a legal accountability obligation as a data controller within the meaning of Article 5(2) GDPR, or otherwise on the basis of statutory or contractual obligations as a processor under the GDPR or under a data processing agreement.

The clash between US and EU law

Incompatibility

Most US federal laws apply different principles than European laws and regulations with regard to the balancing of interests regarding the protection of (personal) data and the right to privacy on the one hand versus national security on the other hand. Some examples of US laws in this area include:

• National Security Act (1947)
• Federal Wiretap Act (1968)
• Stored Communications Act (1986)
• Electronic Communications Privacy Act (1986)
• FISA Act (1978) ("Foreign Intelligence Surveillance Act")
• The USA PATRIOT Act (2001)("Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act")
• Protect America Act (2007)
• FISA Amendments Act (2008)
• USA Freedom Act (2015)
• CLOUD Act ("Clarifying Lawful Overseas Use of Data Act") (2018)
• Etc.

Under such US laws, principles may include:

• National security interests outweigh privacy interests
• only US citizens have fundamental rights within the US and only US citizens can invoke the Fourth Amendment of the US Constitution which reads:
  "'The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." Which contains a rough equivalent of the right to privacy as recognised, inter alia, in Article 8 of the European Convention on Human Rights, Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and Article 10 of the Dutch Constitution.

Such principles, despite overlap on other issues between US and EU legal orders and shared history and values, are not compatible with the current state of European law.

CLOUD Act

An under-reported event within the EU in the ongoing tension was the US legislature's adoption of the US CLOUD Act (Clarifying Lawful Overseas Use of Data Act), seen by some critics as a deliberate undermining of the European General Data Protection Regulation ("GDPR"), better known in the Netherlands as the Algemene Verordening Gegevensbescherming ("AVG"). In this US law, the US legislature clarifies the powers of the US to request data from companies even when this information is located outside the US, for example on servers in the EU/EEA.

Indeed, a lawsuit was pending in the US (Microsoft Corp. v. United States of America) in connection with an order to search an e-mail account located on a server in EU member state Ireland. On 14 July 2016, the United States Court of Appeals for the Second Circuit, a high court with jurisdiction over the states of Connecticut, New York and Vermont, ruled that authority was lacking to issue a search warrant with extraterritorial effect and Microsoft did not have to comply with an order that might have violated European law, such as the GDPR. Microsoft had wanted to take this case to the US Supreme Court, which could have set a precedent that US tech companies can comply with European laws and regulations even if it means going against US law.

The US legislature intervened before it could get to that point via the CLOUD Act, by broadening the powers in the Stored Communications Act (1986) to explicitly allow extraterritorial effect, in the form of an order to retrieve data held outside the US, within US law. Overtaken by the US legislature, the Supreme Court dismissed the case, saying it no longer had any relevance now that the underlying law had already been amended.

This tension has not yet been resolved and will continue to result in a high degree of legal uncertainty for the transatlantic operations of companies and organisations on both sides.

Conclusion

The conclusion must be that the transfer of personal data to parties in the US, such as tech companies, still remains, on the one hand, sometimes unavoidable and, on the other, always risky for Europe-based controllers and processors who have to comply with the GDPR.

The new adequacy decision does not remove legal uncertainty, as the fundamentally incompatible sticking points remain. The sticking points regarding the required rule of law in view of the comparatively broad legal powers of US security and intelligence agencies, as well as the limited remedies available to Europeans, have not changed.

The new adequacy decision does address the ECJ's criticism of "Privacy Shield" from the Schrems II case. However, the real possibility still exists that the ECJ will soon rule again in a third Schrems case that the approach adopted in the new EU-US adequacy decision is not adequate by the standards of European law. These standards in European law have not changed either.

In short, while it will be reassuring for many IT companies and other organisations in the Netherlands that another adequacy decision (for participating companies) exists between the US and the EU, it is important to remain alert when transferring personal data to the US. So that you do not violate the GDPR and incur any fines or liability claims related to GDPR violation by sitting back, taking the matter too lightly and mistakenly assuming that the issues between the EU and US regarding personal data transfers have been resolved definitively.

Want to know what the new US-EU adequacy decision on personal data transfers means for you and your organisation? Contact our privacy lawyers for legal advice.

Approach us for legal advice today!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!