Deconstructing the 2023 EU-US Data Transfer Framework: Hope or Hype?

Featured mage: The “Silicon Docks” in Dublin, home of the EMEA HQ of tech companies like Google.

Imagine you’re a software engineer in Dublin working for a U.S.-based tech firm. Every day, you send dozens of reports and data logs across the Atlantic. The safety of your personal data and that of the customers you serve is at the mercy of international data protection agreements, the latest being the 2023 EU-US Data Transfer Framework. Is your data really protected? Let’s dissect this new framework.

What are the main elements of the new EU-US framework?

The EU has agreed that the U.S. offers enough data protection, allowing safe data transfer from EU to U.S. companies under a new framework.
U.S. intelligence services’ access to EU data is now limited, addressing previous privacy concerns.
EU citizens can raise concerns at a new Data Protection Review Court (DPRC).
U.S. companies must commit to certain privacy rules, such as deleting unnecessary data and protecting data when shared with others.
If U.S. companies mishandle EU citizens’ data, they have access to free dispute resolution mechanisms.
Regular checks will ensure the data transfer rules are working as intended.
This new agreement comes after the previous EU-U.S. Privacy Shield was invalidated due to privacy concerns.
The U.S. is legally obligated to uphold its commitments, enforced by U.S. law and regulatory bodies.

🔗 Source: Data Protection: European Commission adopts new adequacy decision for safe and trusted EU-US data flows (EU Commission Press Corner)

The EU-US Framework Limitations

Just like the former Privacy Shield, this new framework is already criticized and many a data privacy expert will pinpoint its limitations when it comes to genuinely serving EU citizens’ data privacy.

The EU-U.S. data agreement is criticized as a rehash of the failed Privacy Shield. Despite minor adjustments, U.S. law and the EU’s approach remain largely the same, with no significant changes in data protection measures. Critics argue that the primary issues with FISA 702 have not been addressed.
The limitation of U.S. intelligence access to EU data might not be meaningful. The U.S. still maintains that only U.S. citizens are entitled to constitutional rights, indicating a possible persistence of mass surveillance on non-U.S. data.
The Data Protection Review Court (DPRC) may not provide the level of redress expected. Critics say this body doesn’t really constitute a court, as individuals won’t have direct interaction with it, and its decisions are predetermined and limited.
Commitment to privacy rules by U.S. companies may not ensure significant protection. Critics argue that without reform of U.S. surveillance laws, like FISA 702, personal data of EU citizens can still be mishandled.
The free dispute resolution mechanism may not lead to significant redress, as the same response is given to all complaints regardless of their nature. Critics argue this doesn’t meet the standard for judicial redress under Article 47 of the EU’s Charter of Fundamental Rights (CFR).
Regular checking of the data transfer rules may not lead to substantial improvements. Critics fear this could lead to a repeated cycle of invalidation and reinstitution without substantive changes in the laws.
Even though the U.S. is legally obligated to uphold its commitments, it still doesn’t grant non-U.S. persons constitutional rights. This means that U.S. law doesn’t fully recognize the privacy rights of EU citizens.
Lastly, critics argue that this agreement seems to be politically motivated rather than a substantive effort to improve data protection. They warn that the EU’s approach to data protection agreements with the U.S. has not changed over the years despite previous rulings against such agreements by the Court of Justice of the European Union (CJEU).

In conclusion, critics argue that this new framework does not adequately address the privacy concerns of EU citizens or organizations and does not significantly change the status quo in data protection. They predict that it will be challenged and likely invalidated by the CJEU, leading to continued legal uncertainty for data transfers between the EU and U.S.

🔗 Source: European Commission gives EU-US data transfer third round at CJEU (noyb)

What should I do now?

Stay informed. The situation around international data transfers is fluid and can change rapidly. Staying informed can help you understand and react to these changes. Noyb is a great resource (stands for “none of your business” and covers all things data privacy & protection).

Seek legal advice. If you’re working in a company that deals with EU-US data transfers, and you don’t have internal knowledge to navigate the rapidly changing world of data privacy regulations, getting legal advice to understand your obligations under the new framework is your best next step.

Review data transfers. Regularly review your data transfer processes to ensure your organization complies with the latest regulations. This could include auditing the types of data being transferred, and ensuring appropriate safeguards are in place.

Advocate for data privacy. You can do this within your own organization, pushing for clear policies, and promoting a culture of data protection awareness.

Understand the implications of non-compliance. Make sure you understand the potential consequences of not complying with data privacy regulations, including potential legal and financial repercussions (you do not want to face billions in fines like Meta), as well as damage to your company’s reputation.