The European Data Protection Board (EDPB) is satisfied with the agreement in principle that the EU and US reached at the end of March on data exchange between the two continents. The European privacy watchdog calls the agreement “a first positive step in the right direction”. At the same time, the agency tempers the expectations of companies and organizations: it is not yet a legal agreement from which European and American parties can derive rights.
The EDPB writes this in a press release (PDF).
US protection level not equal to EU
It has been almost two years since the European Court of Justice ended the Privacy Shield. For many years this document served as the basis for the transfer of personal data between Europe and the US. Austrian privacy activist Max Schrems disagreed and presented the matter with his foundation Noyb to the Court.
The judge ruled that the US did not offer the same level of protection as in Europe. According to the law, American security and investigation services have access to data stored on American servers. This means that the personal data of European citizens is also accessible to the authorities. Filing an objection to this with an independent regulator or judge is an impossible task for Europeans, the Court ruled. That is why the judge canceled the Privacy Shield.
Since then, European and American companies and organizations have had to work with model contracts. In practice, this was hardly done, if at all, much to the frustration of Schrems. To enforce compliance, he sent 101 complaints to various national regulators in Europe.
EDPB calls agreement in principle ‘a step in the right direction’
The European Commission and negotiators of the US government have been negotiating for over a year and a half about a successor to the Privacy Shield. At the end of March, both parties reached a breakthrough: an agreement in principle was on the table. Ursula von der Leyen, president of the European Commission, said he was “very pleased” with the deal. “This will enable predictable and reliable data flows between the EU and the US while safeguarding the privacy and civil liberties,” said von der Leyen.
The European Data Protection Board (EDPB) is also delighted with the agreement in principle. In a joint statement from all national regulators, the European privacy watchdog calls the agreement “a first positive step in the right direction”.
The EDPB will consider how this political agreement translates into concrete legislative proposals to address the concerns of the European Court of Justice to provide legal certainty to citizens in the European Economic Area (EEA) and data exporters. umbrella organization.
EDPB pledges to play ‘constructive role’ in data sharing
The European supervisor emphasizes that the agreement in principle is not a legal framework. There is currently only an agreement in outline, the negotiators will dot the i’s and crosses in the coming months. There is also no adequacy decision from the European Commission. This is a decision stating that a country outside the EU protects the personal data of European citizens just as well as in the EU. It is therefore important that European and American companies must continue to work with model contracts for the time being.
The EDPB says it will play “a constructive role” in the exchange of personal data between the EU and the US. “The EDPB stands ready to assist the European Commission and the US in setting up a new framework that is fully compliant with EU data protection law,” the European regulator concluded in its press statement.
Catch up on more articles here
Follow us on Twitter here