|
On 13 April, LIBE Committee adopted Rapporteur Juan Fernando López Aguilar’s (S&D, Spain) draft Motion for Resolution on the EU-U.S. Data Privacy Framework, as well as the amendments tabled to it. The consolidated text is expected to be made available in the coming weeks. (Draft version available)
According to the European Parliament’s press release, the Report acknowledges that the proposed EU-US Data Privacy Framework is an improvement from previous frameworks, but stresses that it does not provide for sufficient safeguards.
The text urges the Commission not to adopt the draft Adequacy Decision that it presented in December 2022, as the Committee considers that the United States’ level of personal data protection is not essentially equivalent to that of the EU.
No prior authorisation for bulk data collection
The Report points to the fact that the framework still allows for bulk collection of personal data in certain cases, does not make bulk data collection subject to independent prior authorisation, and does not provide for clear rules on data retention.
Accountability issue for the Data Protection Review Court (DPRC)
Additionally, MEPs criticised the proposed Data Protection Review Court (DPRC), which is aimed at providing redress to EU data subjects, as its decisions would be secret, violating citizens’ right to access and rectify their data. Moreover, DPRC judges could be dismissed by the U.S. President, who could also overrule its decisions, so the Review Court is not truly independent, say MEPs.
Lawsuit-proof regime needed for legal certainty
Moreover, given that previous data transfer frameworks between the EU and the US were invalidated by rulings of the Court of Justice of the European Union (CJEU) - (most recently in the “Schrems II” case), the Report calls upon the Commission to ensure that the future framework will withstand legal challenges and provide legal certainty to EU citizens and businesses.
Additionally, as the U.S. Intelligence Community is still updating its practises based on the Data Privacy Framework, an assessment of its impact is not yet possible, according to the report.
Next steps
The Report is now expected to be sent to plenary for adoption as an own-Initiative Resolution. While a date for the vote in plenary has yet to be determined, it may possibly take place during the week of 8-11 May 2023.
Background
The European Union and the United States conducted negotiations for a renewed transatlantic data transfer framework (also known as the Privacy Shield) and reached a political agreement ‘in principle’ on 25 March 2022.
The U.S. Government and the European Commission then had to translate the arrangement into legal documents. On the US side, these commitments were outlined in an Executive Order, which was signed by the President of the United States on 7 October 2022.
Following the publication of the Executive Order, the Commission presented a draft Implementing Decision (Adequacy Decision) on the adequacy of the protection provided by the new transatlantic data privacy framework on 12 December 2022,
The draft Implementing Decision follows the “examination procedure” for “implementing acts" under the Lisbon Treaty.
In parallel, the European Parliament has a right of scrutiny over Adequacy Decisions. In mid-February 2023, the European Parliament’s Committee on Civil Liberties, Justice, and Home Affairs (LIBE) published a draft Motion for Resolution on the EU-US Data Privacy Framework, urging the Commission not to adopt its draft Adequacy Decision, as it considered that the Framework fails to create actual equivalence in the level of protection.
If endorsed in European Parliament’s plenary, the Resolution may result in the Commission having to reconsider its draft Adequacy Decision in part or in full.
|
