EU Commission President Ursula von der Leyen, together with President Biden, recently announced an “agreement in principle” on a new data exchange framework between the EU and the United States.
Breakthrough or rather just “agreement in principle”?
Although some news outlets announced a “breakthrough”, there is no concrete draft at this point. So far, there appears to be more of an “agreement in principle”. It could take months until an actual agreement is drafted, and only then can this text then be legally examined before a corresponding adequacy decision in the sense of article 46 GDPR could be issued. The extent to which this will ultimately solve the situation created by the European Court of Justice’s “Schrems II” judgment, or whether it is only a matter of time until we will see “Schrems III”, is still unclear at this point. In any case, it is important to highlight that the United States are unlikely to change its material security laws, rather only giving additional assurances to EU data subjects. Therefore, the new framework will probably not be an actual bilateral agreement, but rather an executive decision of the European Commission.
NOYB has already released an initial statement by Max Schrems:
noyb.eu/en/privacy-shield-20-first-reaction-max-schrems
In our March newsletter, we reported in detail on how to set up a TIA (Transfer Impact Assessment) under the current rules. For the time being, these requirements will not change, since it will be less a question of weeks than of months until the new “Transatlantic Data Protection Framework” will possibly provide more legal certainty for EU-US data transfers. And in the end, the European Court of Justice will almost certainly have the last word.