European Parliament Urges Commission to Reevaluate EU-U.S. Data Privacy Framework in Resolution Vote

228

In a significant development with far-reaching implications for transatlantic data transfers, the European Parliament voted on May 11, 2023, to adopt a resolution addressing the adequacy of the EU-U.S. Data Privacy Framework. The resolution calls on the European Commission to continue negotiations with U.S. counterparts, aiming to establish a mechanism that ensures equivalence and meets the required level of protection mandated by EU data protection law. While the resolution is not legally binding, it sends a strong message urging the Commission to prioritize the concerns raised by Parliament.

The resolution, adopted with 306 votes in favor, 27 against, and 231 abstentions, highlights several key takeaways that underline the Parliament’s apprehensions regarding the current state of the Framework. One of the primary concerns expressed is the potential invalidation of the Framework by the Court of Justice of the European Union (CJEU), similar to its predecessors. Parliament fears that such an outcome would lead to ongoing legal uncertainty, incurring additional costs and causing disruptions for European citizens and businesses alike.

Parliament acknowledges the efforts made in Executive Order 14086 (EO 14086) but emphasizes that the principles outlined in the order, particularly with regard to proportionality and necessity, do not align with EU law definitions or interpretations by the CJEU. While recognizing the improvements introduced by EO 14086, Parliament believes that the lack of sufficient safeguards for bulk data collection remains a cause for concern. It highlights specific worries, including the potential access of law enforcement authorities to data that would otherwise be off-limits and the need to protect data subjects’ rights while ensuring clarity regarding the application of principles to processors and preventing onward transfers that undermine the level of protection.

Furthermore, Parliament insists that EU citizens should have the same rights and privileges as their U.S. counterparts concerning surveillance and effective judicial redress. To this end, the resolution discusses the proposed Data Protection Review Court (DPRC) as a new redress mechanism. However, Parliament raises concerns about the lack of transparency and accessibility of decisions made by the DPRC, as well as certain aspects of its independence. These concerns must be addressed in the negotiations with the U.S., according to Parliament’s resolution.

In its conclusion, the European Parliament asserts that the current Framework fails to establish the necessary equivalence and protection. It calls on the Commission to continue negotiations with the U.S., refrain from adopting an adequacy finding until all recommendations outlined in the resolution and the European Data Protection Board (EDPB) opinion are fully implemented, and ensure that the proposed framework provides a solid, sufficient, and future-oriented legal basis for EU-U.S. data transfers. Parliament emphasizes that any future invalidation of an adequacy decision by the CJEU would be the responsibility of the Commission, as it would reflect a failure to safeguard the rights of EU citizens.

Although the European Parliament’s resolution is not binding, the Commission will take it into account when evaluating the EU-U.S. Data Privacy Framework, alongside the opinion of the EDPB. The concerns raised by Parliament highlight the urgent need for a comprehensive and robust solution that addresses the fears of legal uncertainty and ensures an adequate level of protection for EU data transfers. As negotiations between the EU and the U.S. progress, the outcome will shape the future of transatlantic data flows and impact businesses and citizens on both sides of the Atlantic.