European Parliament issues negative opinion on the EU-US data transfer arrangement

European Parliament issues negative opinion on the EU-US data transfer arrangement

The European Parliament LIBE Committee has urged the European Commission not to issue an adequacy decision for the EU-US Data Privacy Framework (the “Framework”) – which would allow the free flow of personal data between the EU and US. An adequacy decision means that the EU has assessed and recognises that a country provides an equivalent level of protection for personal data as the EU does.

 

MEPs state that the Framework does not provide sufficient protections and have called for continued negotiations. The Parliament’s concerns include:

 

  • The lack of prohibition on the bulk collection of data;
  • The list of legitimate security objectives, which can override an individual’s privacy rights by allowing for signal intelligence, can be expanded without any additions being subject to public scrutiny and at the President’s discretion;
  • Unlike other third countries, the US does not have a federal data protection regime offering a consistent level of protection for data across the country;
  • Lack of transparency requirements on what personal data is processed which undermines an individual’s right to access or rectification; and
  • The US Data Protection Review Court is part of the executive branch, not the judiciary which raises concerns over the impartiality of such proceedings.

 

The latest development from the European Parliament will come as a blow to many European and American businesses. Many had been hoping that the updates made to the U.S. security regime last year would mean an adequacy decision was forthcoming, allowing for an easing of administrative requirements to satisfy when transferring data between the two jurisdictions.

 

Companies in the UK should keep a close eye on whether the Framework receives an adequacy decision from the European Commission later this year, especially if they have group companies based in the EU. Whilst UK based companies would not be able to rely on an adequacy decision to transfer data to the US a favourable decision for the US would encourage the same approach being taken in the UK who is separately negotiating a US-UK data transfer agreement. If the Framework is not agreed then the UK will likely be more cautious in depending on the US’s apparent protections when looking at whether to make an adequacy decision of its own.

 

See the full draft opinion here.

Recent posts

Previous
Next
AI Report
Read more
Baby Reindeer, internet sleuths and the perils of jigsaw identification
Read more
What businesses should consider before implementing monitoring
Read more
'Consent or pay’: the EDPB’s two cents on the right model
Read more
Take note: new guidance on the ICO’s penalties and fines
Read more
Labour’s proposed secondary ticketing reforms
Read more
The abolition of non-domicile in the Spring Budget
Read more
Content moderation: the ICO's guide
Read more
The Government moves to address unlawful immigration exemption under the Data Protection Act 2018
Read more
How can I get probate to sell my property?
Read more

More from this author

Previous
Next
What businesses should consider before implementing monitoring
Read more
Take note: new guidance on the ICO’s penalties and fines
Read more
Content moderation: the ICO's guide
Read more
ICO focusses on child protection in latest guidance to the games industry
Read more
Government to replace the UK GDPR
Read more

Share this page