.jpg)
The United States is taking action on the very sensitive subject of the transatlantic transfer of personal data. The President Joe Biden unveiled a new executive order, which could serve as a basis for the future adequacy decision taken by the EU. It will have to guarantee a level of protection of personal data at least equivalent to that of the 27 and will allow their free circulation between the two continents, in accordance with the GDPR.
More than six months after announcing that they had reached an agreement in principle with Brussels, the United States is taking up the cause again on the very sensitive subject of transatlantic personal data transfers.
The announcement was highly expected, since the two previous frameworks, the "Safe Harbor" and the "Privacy Shield", had been invalidated by the European Court of Justice (CJEU) .
In July 2020, the court indeed found that there was a risk that U.S. intelligence services could access personal data hosted on the servers of domestic companies, due to the extraterritoriality of some of its laws.
This court decision, named as "Schrems II", had led the CNIL, as well as some of its European counterparts, to deem the use of Google Analytics illegal.
The invalidation of the previous regime even led Meta to threaten to withdraw its services in the EU.
Faced with the risk of a "Schrems III", the US administration has put forward several safeguards. First of all, it is introducing a new Data Protection Review Court, under the supervision of the US Department of Justice, which European citizens will be able to refer to in the event of a dispute. The United States also undertakes to limit access to European data by its authorities to what is "necessary" and in a "proportionate" manner, using the semantics of the European legislation in this area.
Things come in threes
These guarantees provided by Washington do not seem to reassure Max Schrems, who was responsible for the previous appeals against the US-EU adequacy decisions. "The EU and the US now agree on the use of the word 'proportionate' but seem to disagree on its meaning. At first sight, it seems that the key issues have not been resolved and that the case will sooner or later come back to the CJEU," he said, accusing the European Commission of once again turning a blind eye to US law.
Schrems is not alone in questioning the viability of the upcoming adequacy decision.
"Even if the US authorities try to close the loopholes of the original Privacy Shield, the fact is that the EU and the US still have a different approach to data protection that cannot be erased by a decree," said Ursula Pachl, deputy director general of the European Consumers' Organisation (BEUC: Bureau européen des unions de consommateurs).
No guaranty to date, but a step in the right direction.
The same is true on the other side of the Atlantic. While it is a "step in the right direction", President Biden's executive order will continue to "jeopardise" EU-US data transfers, in the absence of in-depth reform of the US system, according to the American Civil Liberties Union (ACLU).
It now remains for the European Commission to study this new legislative framework, to draft an adequacy decision and then to submit it to the Member States for approval. Brussels seems to be confident that this time it will be the right one, highlighting the "safeguards included in the decree, both with regard to the substantial limitation of access to data by US national security authorities (i.e necessity and proportionality) and the implementation of the new appeal mechanism".