The European Data Protection Board (EDPB) gave, on 28 February, its opinion on the European Commission’s draft adequacy decision about the transfer of data to the United States. Following the invalidation of the Privacy Shield agreement in violation of the General Data Protection Regulation (GDPR), in 2020, Joe Biden, President of the United States, adoptedlast October, a new legal framework to allow a new agreement. It must strengthen control over the collection and use of personal data by US intelligence services. Today, the body responsible for ensuring the application of the GDPR within the European Union gives a favorable opinion et « welcomes substantial improvements ” all in ” expressing concerns and requesting clarifications on several points ».
Where is the new agreement and what does the EDPS think?
Among the many redesigned points, the EDPS commends ” the introduction of requirements reflecting the principles of necessity and proportionality for the collection of data by US intelligence services “. He also salutes the new redress mechanism for EU data subjects ».
Nevertheless, it asks for additional information on ” certain data subject rights, onward transfers, the scope of exemptions, temporary bulk data collection and the practical operation of the redress mechanism “. Moreover, the EDPS “ would appreciate that the entry into force and adoption of the decision are subject to up-to-date policies and procedures to implement the legal framework by all US intelligence agencies ».
For him, from a commercial point of view, a number of the principles and concerns of the agreement remains the same as those of the Privacy Shield. In this regard, Andrea Jelinek, Chair of the EDPS, stated that ” a high level of data protection is essential to safeguard the rights and freedoms of individuals in the European Union “. She specifies that ” while acknowledging that the improvements to the US legal framework are significant, we recommend addressing the concerns expressed and providing the requested clarifications to ensure the sustainability of the adequacy decision “. Finally, she concludes that for the same reason, we believe that after the first review of the adequacy decision, subsequent reviews should take place at least every three years and we are committed to contributing ».
