EU formally grants data adequacy to US

Reactions

The tech sector has responded positively to the adequacy decision on the basis that is has ended three years of legal uncertainty.

Julian David, CEO of tech sector lobby group TechUK, for example, said the framework marks “an important and long-awaited milestone” that offers clarity and legal certainty to businesses.

“We now look forward to working with our members, the UK and US governments to finalise the UK-US data bridge, which will allow UK businesses to transfer data freely to certified US organisations, facilitating exchanges that are worth billions of dollars in digital trade,” said David. 

The Computer & Communications Industry Association’s (CCIA Europe) public policy director, Alexandre Roure, also welcomed the decision, which he described as a “major breakthrough” for businesses. He added that, after waiting for years, companies and organisations of all sizes on both sides of the Atlantic finally have the certainty of a durable legal framework.

“First and foremost, we applaud member states’ decision to end this gridlock, but CCIA would also like to thank the Commission and the US government for their hard work to create a new mechanism that facilitates data flows while also protecting the rights of individuals,” he said.

David Dumont, a partner at law firm Hunton Andrews Kurth, added that the US legal framework around government surveillance activities has “significantly changed” since Schrems II invalidated Privacy Shield.

“The US has put in place legal safeguards that limit access to personal data and has introduced more robust oversight mechanisms, such as the Data Protection Review Court,” he said.

“The European Commission seems to be convinced that the new transatlantic data transfer framework will adequately address Schrems II issues and that the new adequacy decision will likely survive a challenge in the Court of Justice of the European Union, which will be asked to assess whether the new safeguards laid down in the framework are sufficient to be considered essentially equivalent to the safeguards in the EU.”

He added that, in light of the changes, it is unlikely that a further legal challenge would be successful: “People have somewhat lost patience with the issue, and organisations are looking for legal certainty and reassurance that they can rely on the decision once confirmed.

“If the new adequacy decision would, once again, be struck down by the CJEU, organisations may lose faith in the feasibility of a successful EU–US data transfer framework and turn to EU Standard Contractual Clauses as their sole and permanent solution to legitimise data transfers to the States.”

‘No substantial change in law’, says Schrems

However, Max Schrems, chair of digital rights organisation noyb, and who is the lawyer who challenged Privacy Shield, has already committed to challenging the decision, which he said is “largely a copy of the failed Privacy Shield” agreement.

“They say the definition of insanity is doing the same thing over and over again and expecting a different result. Just like Privacy Shield, the latest deal is not based on material changes, but by political interests. Once again, the current Commission seems to think that the mess will be the next Commission’s problem,” he said.

“We now had Harbors, Umbrellas, Shields and Frameworks – but no substantial change in US surveillance law. The press statements of today are almost a literal copy of the ones from the past 23 years. Just announcing that something is ‘new’, ‘robust’ or ‘effective’ does not cut it before the Court of Justice. We would need changes in US surveillance law to make this work – and we simply don’t have it.”

A major part of the issue, according to noyb, is that the US has refused to reform section 702 of the Foreign Intelligence Surveillance Act (FISA), which allows for the targeted surveillance of people outside the US as long as they are not a US citizen.

Any court order issued under FISA laws also comes with a gag order – a legal instrument that prevents the recipients from letting anybody else know they have received the order.

Noyb added that FISA 702 needs to be prolonged by the US by the end of 2023 due to ‘sunset clauses’ in the law: “This would have been the perfect opportunity to improve US law, but given the new deal with the EU, there will be little reason for the US to reform FISA 702.”