The European Data Protection Board (EDPB) has issued its opinion on the new EU-US Data Privacy Framework (DPF) for transfers of personal data to the United States (US). According to the EDPB, the DPF is much better than its predecessor, but there are also caveats.
The EDPB consists of all European privacy regulators, including the Personal Data Authority.
On March 25, 2022, the European Commission (EC) and the US reached an agreement on the DPF to replace the Privacy Shield. Indeed, the latter had been declared declared invalid.
The DPF regulates the protection of personal data in data flows between the European Union (EU) and the US. And should eliminate the shortcomings the European Court found in the Privacy Shield.
To that end, the US has also made legislative changes. For example, US intelligence agencies are still allowed to access personal data of EU residents only when strictly necessary.
The EDPB writes in the opinion that the DPF is a significant improvement over the former Privacy Shield. But there are also caveats:
It is not clear enough what happens to personal data shared with companies in the U.S. and then transferred to companies in countries outside the EU.
People whose data has been transferred to the U.S. may have more options to exercise their rights, but it is still unclear how this works in practice.
There are questions about what safeguards are in place for the bulk collection of EU residents' data (such as by a "dragnet"). Moreover, oversight of this seems to be only after the fact.
The EC has prepared a draft adequacy decision on the DPF. With such a decision, the EC establishes that a country outside the EU provides an adequate level of protection for the transfer of personal data from the EU.
This adequacy decision is not yet fixed. Following the opinion of the EDPB, there still needs to be an agreement from the representatives of all EU member states and there may still be input from the European Parliament. In addition, there are some other conditions, including certain guarantees from the US.
Until the EC has actually made the adequacy decision, organizations that want to transfer personal data to the U.S. still need to implement additional safeguards.
