EDPB puts draft adequacy decision on EU-U.S. Data Privacy Framework to the test

In this regard, the Federal Commissioner for Data Protection and Freedom of Information (BfDI), Professor Ulrich Kelber, said: "We see the willingness to create an adequate level of protection for data subjects whose personal data is transferred to companies in the USA. There has been clear progress, especially in the area of government access for national security purposes. We have concerns as to whether the new regulations ensure in all respects a level of protection equivalent in substance to EU data protection standards."

The progress achieved in comparison to the previous agreement, the so-called Privacy Shield, recognisably addresses the points of criticism of the ECJ from the Schrems II ruling. This progress includes the establishment of a new redress mechanism intended to create effective legal protection for data subjects in the EU.

The EDPB sees particular cause for concern in the mass collection of data, the "bulk collection", for which neither an independent prior check nor a systematic independent review ex post by a court or an independent body is provided for.

The European Commission had published the draft adequacy decision on the EU-U.S. DPF on 13 December 2022 and requested the EDPB to provide an opinion, which is a required element in the adoption process of the decision. The BfDI participated intensively as main and secondary rapporteur in the preparation of the EDPB opinion.

From the BfDI's point of view, the EU-U.S. DPF also constitutes an important contribution to secure and trustworthy data transfers in the international context: "The progress achieved in the transatlantic context is an important prerequisite that we can build on at this year's meeting of the G7 data protection supervisory authorities in Japan in June."

The EDPB opinion can be found on the Board's website.