Author’s article
Thyme Van Horn
published
July 11, 2023
Last update
July 11, 2023
In July 2020, the Court of Justice of the European Union delivered a landmark ruling: Schrems II. The Court ruled that the transfer of data from the European Union to the United States was not sufficiently secure under the arrangement in force between the parties. the so-called Privacy Shield in force at that time did not provide adequate data protection guarantees. It wasn’t the first time the court had to decide this: in 2015 the court ruled on the ruling Shrems I although Safe haven arrangement It wasn’t good enough.
enough resolution
Since the Schrems II ruling, there has been no privacy arrangement between the United States and the European Union. This means that the data flow between the two has become very cumbersome. This changed on July 10, 2023: the European Commission issued a so-called enough resolution (enough resolution). An adequacy determination means that the Commission considers that a country or territory has sufficient safeguards to share data with it. The United States now joins a relatively small group of countries and territories for which such a decision has been made; Otherwise, only fit determinations were made for Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Man, Japan, Jersey, New Zealand, United Kingdom, Uruguay, South Korea, and Switzerland.
Why is the United States safe now?
In Schrems II, the court concluded that European personal data could not be stored sufficiently securely in the United States. For example, US security agencies such as the CIA, NSA, and FBI actually have no restrictions and guarantees, data is coarsely requested (in large quantities) by the government, and European citizens cannot go to US courts with a complaint about This data processing. The court also found it wrong that EU judges could not go to a US court at all. Under the Privacy Shield, the Ombudsman could be contacted, but the court did not think this was sufficient: he could not interfere with the security services and was directly reporting to the Secretary of State (Secretary of State). Read more about this ruling in this blog.
These objections have now been resolved, according to the European Commission, and so a suitability decision can be issued. The European Union and the United States have the extension EU-US data privacy framework prove. Companies can abide by this framework, and then they must comply with privacy safeguards. For example, companies must delete personal data when it is no longer necessary for the purpose for which it was collected, and they must ensure continued protection when personal data is shared with third parties.
The framework also imposes limits on what government agencies such as the NSA can see. Access to European data is now limited to what is necessary and proportionate to protect US national security.
To solve the problem of going to court, the Data Protection Review Tribunal was set up. This court will independently investigate and resolve complaints and may take binding corrective action.
Will there be a Schrems III?
Does this white smoke mean that the flow of data between the EU and the US is allowed once and for all? In the long term, this is questionable. Max Schrems, the plaintiff in the high-profile cases above, has announced that he is taking a critical look at the data privacy framework. So A Schrems III is not excluded. After all, US security services have (very) broad powers that limit privacy. It remains to be seen whether the framework adequately controls these powers. There is a good chance that the court will soon issue a ruling on this matter.Does your company transfer data to the United States? Or are you curious to know if your company adheres to the latest privacy rules? Please do not hesitate to contact us, or members of our multidisciplinary privacy team. We are happy to assist you with all your questions.
