On December 13, 2022, the European Commission published its preliminary version of the adequacy decision regarding the new framework for international data transfers between the European Union and the USA, with the aim of regulating such information flow.
Mentioned decision represents a new advance, after the publication of Executive Order by President Biden, in October 2022, consolidating the proposed parameters for the implementation of the Transatlantic Data Privacy Framework (TADPF).
It is important to note that the new framework was designed to replace the Privacy Shield, a previous legal framework invalidated by the Court of Justice of the European Union, after being contested by data protection activist Maximilian Schrems.
The purpose of the new document is to regulate and limit the access of US government agencies to personal data from the European Union, defining requirements, such as necessity and proportionality to meet national security interests.
The framework also establishes new legal mechanisms for European Union citizens to point out and challenge possible surveillance activities carried out excessively and illegitimately by US agencies, which would characterize violations of the parameters expressed in the Executive Order.
In addition, such agencies will need to follow the principles imposed by TADPF, adapting their privacy policies and publicly assuming commitments to the new legislation, in addition to presenting internal compliance procedures to certify compliance with the rules and incorporate mechanisms for redress in the event of reports of gaps or violations.
The publication of the preliminary version of the adequacy decision starts its ratification process, which can take up to 6 months, an estimate based on the periods incurred for the Privacy Shield analysis.
The European Data Protection Board (EDPB), despite not having the power to reject the text of the decision, will issue an opinion report in which it may propose amendments. EU member countries will also be able to issue opinion opinions.
The EU Justice Commissioner is optimistic and believes that the TADPF will be approved after review by the European Court and that the final decision will be adopted before July 2023. However, there are strong indications that activist Maximilian Schrems will challenge the text before the court, as happened with other previous data transfer agreements between the USA and the EU.
Max Schrems’ intention is to challenge the new framework on the grounds that the Executive Order still fails to establish an adequate limit to US surveillance of the personal data of European citizens and to provide an effective legal guarantee in cases of violation.
After the preliminary analysis by the EDPB, the text will proceed for approval by a committee of representatives of the member states of the European Union. The European Parliament also has prerogatives to analyze the document. Thus, a final decision is expected by mid-2023 and, once issued, will move on to practical implementation by US government agencies.
We will remain closely monitoring the unfolding of said approval procedure and, in case you are interested in the subject and want to know more about it, feel free to contact us. Our professionals will be at your disposal.
Written by Fernando Borges and Luane Nascimento
