On 28 February 2023, the European Data Protection Board (“EDPB”) published its opinion on the draft adequacy decision regarding the EU-U.S. Data Privacy Framework.
The draft adequacy decision was published by the European Commission on 13 December 2022. More information on the draft adequacy decision is available here.
The EDPB positively noted that overall, there are “substantial improvements” compared to the previous framework. Such improvements relate particularly to the introduction of requirements incorporating the principles of necessity and proportionality for US intelligence services collecting personal data and the new redress mechanism for EU data subjects.
However, the EDPB expressed concerns and requested from the European Commission clarification on several issues.
In its press release, the EDPB explained these concerns relate, in particular, to certain rights of data subjects, onward transfers, the scope of exemptions, the temporary bulk collection of personal data and the practical functioning of the redress mechanism. For instance, the EDPB noted that:
- data subjects’ rights to access, rectification and erasure are addressed by the Access principle that remained unchanged compared to the Privacy Shield. In this context, some old points of concern are still applicable. For example, in respect of the data subjects’ right of access, the EDPB stressed that it should be clear that this right applies when processing personal data in any form, not only by storing the personal data
- it still does not understand the rationale for the exemption from the obligation to enter into a contract with a third-party controller in case of onward transfers for ’occasional employment-related operational needs
- bulk collection of personal data is not subject to independent prior authorization.
The press release is available here, and the EDPB’s opinion here.
