Further to our last update on the proposed EU-US Data Privacy Framework (“DPF”), the Members of European Parliament (“MEPs”) have recently voted to reject the DPF and urged the European Commission not to endorse it until fundamental rights concerns are fully addressed.
Given this is the third attempt at a mechanism to regulate data processing between the EU and the US, it makes sense for the European Parliament to want to make sure the DPF is robust enough so it can guarantee an adequate level of data protection.
What is the latest news?
On 11 May 2023, the Parliament voted 306 in favour and 27 against (with 231 abstentions) for a resolution opposing the adoption of an US adequacy decision under the DPF. The outcome of the vote was widely expected and came months after the European Data Protection Board similarly criticised the framework.
Echoing the views of the Committee on Civil Liberties, Justice and Home Affairs (the “LIBE committee”), MEPs said EU citizens need legal certainty along with rights of access and redress. Committee member Juan Fernando López Aguilar pointed out, "This new proposal contains significant improvements, but unfortunately, we are not there yet. There are still missing elements on judicial independence, transparency, access to justice, and remedies. So, we call on the Commission to continue negotiations and properly address these concerns. The mechanism must genuinely protect the data of EU citizens and businesses."
MEPs took issue with the ongoing bulk collection of data by the US government, noting that although the DPF still allows for bulk collection of personal data in certain cases, it does not make bulk data collection subject to independent prior authorisation, and does not provide for clear rules on data retention.
The MEPs also stressed that the proposed creation of the Data Protection Review Court (“DPRC”) is not adequate because its decisions would be secret and EU citizens would not have the right to access and rectify personal data about them. Therefore, the DPRC would not be a truly independent judicial body since the judges on the court would serve at the pleasure of the US President and could be dismissed at any time, not to mention, the President could overrule their decisions.
What’s next for the DPF?
The European Commission is expected to vote soon on whether to adopt the adequacy decision for data transfers based on the EU-US DPF.
How can Burges Salmon help?
If you would like any further information, please contact David Varney or another member of our Data Protection team.
This article was written by Noel Hung