The European Data Protection Board Weighs in on the Trans-Atlantic Data Privacy Framework

On March 25, 2022, the European Commission and the White House jointly announced that they had reached an agreement on a new transatlantic data privacy framework, known as the Trans-Atlantic Data Privacy Framework.

The Framework was intended to normalize data transfers between the US and Europe.  The legality of many data transfers had been in question and some had been clearly illegal according to the General Data Protection Regulation and other European data privacy laws.  Previous frameworks to allow for data transfers had fallen through, the EU-US Privacy Shield and the Safe Harbor Framework.

Now, a little older, a little wiser, European, and American authorities are trying to thread the needle so they can maintain legal data transfers across the Atlantic Ocean.

But the big question is: Is the Trans-Atlantic Data Privacy Framework good enough to stand up to scrutiny?

The first comments are in from the European Data Protection Board (EDPB).

They note that the agreement in principle is just the first step in the process of making an adequacy decision about the United States.

They also note that the agreement in principle doesn’t effectuate any changes in how companies should operate today.  Not until the United States has been deemed adequate, should there be any meaningful difference in the treatment of data transfers between the US and the European Union.

The EDPB asserts that adequacy will only be grated to the USA if as the details are fleshed out, the new framework in fact contains sufficient guarantees that data subjects in the European Union and European Economic Area will be able to exercise their data privacy rights and that they are afforded at least a similar level of protection in the United States as they have in Europe.

It is of the utmost importance that the new Framework fully addresses the issues that the European Court of Justice found in the Privacy Shield Agreement in their Schrems II judgment.  Where there is a will, there is a way. Hopefully, the Trans-Atlantic Data Privacy Framework can satisfy the powers-that-be on both sides of the Atlantic.

Once data flows across the Atlantic become more regular, it will be absolutely necessary to be able to comply with the GDPR.  Thankfully, Clarip can help.  We offer automated data subject request fulfillment, automated data mapping, consent management, vendor management, data risk intelligence scans, and much, much more.  To learn more, visit us at www.clarip.com or call us at 1-888-252-5653.

Email Now:

Mike Mango, VP of Sales
mmango@clarip.com

Other Articles on this Topic:

The Trans-Atlantic Data Privacy Framework
Data Transfers and Adequacy between Non-EU Countries
Cookies & Data Transfers: The Google Analytics decision
The Schrems Decisions: Cross-border Data Transfers