A Collection is a selection of features, articles, comments and opinions on any given theme or topic. It allows you to stay up‑to‑date with what interests you most.
Login here to access your saved articles and followed authors.
We have sent you an email so you can reset your password.
Sorry, we had a problem.
Tags related to this article
Published 12 October 2022
On Friday, 7 October 2022, President Joe Biden signed an Executive Order (EO), which will enable the implementation of the new EU-US Data Privacy Framework (the Framework) – a development which has been long-awaited by all organisations that transfer data between the EU and US.
The Framework aims to fill the void which was left following the invalidation of the Privacy Shield, after the Court of Justice of the EU’s “Schrems II” decision of 16 July 2020, which found that the Privacy Shield offered insufficient protection to EU data subjects.
A statement released by the White House has explained that the Framework intends to “restore an important legal basis for transatlantic data flows”. Specifically, it aims to address EU concerns over the surveillance practices in the US. The EO addresses such a concern by:
In a statement released earlier in the year by the European Data Protection Board (EDPB), the Framework was described as “a positive first step in the right direction”. The EDPB also stated that they were looking forward to assessing the Framework and in particular analysing:
The introduction of the Framework will now stimulate the launch of the European Commission’s adequacy assessment of the US. This process will involve a draft adequacy determination being put forward by the Commission, the EDPB issuing a non-binding opinion, a vote by EU member states to approve the determination and finally, a formal adoption by the European Commission College of Commissioners.
This process of ratification could take as long as six months, which would mean an adequacy decision may not materialise until March 2023 – until which it would be prudent for organisations to continue to follow the EDPB’s recommendations on measures that supplement transfer tools, to ensure compliance with the EU level of protection of personal data.
Organisations within the EU will hope that the Framework is able to resolve the issues raised by “Schrems II”, given the current burden related to undertaking EEA-US transfers. However, it remains to be seen whether this new arrangement will be safe from activist Max Schrems, who has already stated that “At first sight, it seems that the core issues were not solved and it will be back to the CJEU (EU court) sooner or later”.
In addition to the EO being signed on 7 October 2022, the US and UK issued a joint statement entitled ‘New Comprehensive Dialogue on Technology and Data and Progress on Data Adequacy’ which included two main announcements:
The Department for Digital, Culture, Media & Sport also issued a press release on 7 October highlighting the positive progress made.
Businesses in the UK obviously therefore wait with baited breath for further progress on the UK-US adequacy discussions with the hope they take the same course as the Framework. However, given Mr Schrems comments it remains to be seen whether these activities will solve the issues around transatlantic data transfers. Watch this space!
London - Walbrook
+44 (0) 20 7894 6492
+44(0)20 7894 6828
Christopher Air, Stuart Hunt
Jade Kowalski, Amanda Mackenzie
Jade Kowalski, Stuart Hunt
Jade Kowalski, Mathew Rutter, Zoë Carpenter
Jade Kowalski, Alexander Dimitrov
Jade Kowalski, Astrid Hardy, Kelsey Farish
Christopher Air, Omar Kamal
Igor Pinedo Garcia, Aidan Healy, Stuart Hunt
Rowena McCormack, Aidan Healy, Charlotte Burke
Jade Kowalski, Omar Kamal
Jade Kowalski, Zoë Carpenter
Khurram Shamsee, Kate Galloway, Yassar Lodhi
Jade Kowalski, Florence Cathcart