Today, the European Commission published a draft adequacy decision on the new EU-U.S. Data Privacy Framework (EU-U.S. DPF), setting the stage for a likely challenge at the Court of Justice of the European Union (CJEU). The Commission found that the EU-U.S. DPF, along with the Biden administration’s implementing Executive Order and DOJ regulations, guarantees “essentially equivalent” protections to those in the EU, paving the way for its adoption by EU member states. In particular, the Commission found: (1) that the Executive Order’s new limitations on U.S. surveillance programs meet the EU’s “necessary and proportionate” standards; and (2) that the new redress mechanism for EU residents provides an independent and impartial means of adjudicating data rights and binding U.S. intelligence agencies.
EPIC has supported calls for enhanced privacy protections prior to establishing a new data transfer framework. EPIC recently commented on the Biden executive order, highlighting several areas of concern ahead of a likely challenge at the Court of Justice of the European Union (CJEU). “The Administration’s new Executive Order is a meaningful improvement over the prior privacy framework which has operated to the exclusion of non-U.S. persons, but these new safeguards and redress mechanism are unlikely to persuade the CJEU that U.S. law adequately protects privacy.” EPIC Executive Director Alan Butler said in October. “The new Data Protection Review Court is a step in the right direction, but the Administration must ensure that existing barriers to redress—such as notice, excessive secrecy, and undue deference to national security authorities—do not continue to stymie independent, meaningful efforts to vindicate privacy rights.”