EU US data flow agreement at risk as committee finds protections not equivalent

A committee of the European Parliament finds that the proposed Data Privacy Framework (DPF) for the flow of personal data between the EU and U.S. has not solved potential issues at the U.S. side of the deal on the level of protection and citizen redress, and advises the European Commission not to approve the framework, reports Law360.

Members of the Committee on Civil Liberties, Justice and Home Affairs (LIBE) concluded that the proposed DPF “fails to create actual equivalence in the level of protection” currently offered under the EU General Data Protection Regulation, reports IAPP, quoting the Committee’s draft opinion.

LIBE advised the European Commission to only adopt the data adequacy decision when “meaningful reforms were introduced, in particular for national security and intelligence purposes” on the part of the U.S., according to IAPP.

Despite changes made by the U.S. side to improve data protection in the deal to replace the Privacy Shield arrangement which had been used by multinational firms for trans-Atlantic transfers, LIBE still finds the DPF offer lacking. This had also been the problem with the predecessor Safe Harbor mechanism.

The deal covers biometric data sharing, in addition to various other, less sensitive types of data.

The European Data Protection Board (EDPB) is also due to deliver an opinion on the DPF. As with that of the LIBE, it will not be binding: the Commission still has the final say.

Law360 reports that the White House claims it is introducing further safeguards around signals intelligence around personal data and “only in pursuit of defined national security objectives.”

MEPs are concerned about differing definitions of concepts such as the principles of necessity and proportionality and a lack of adherence to a U.S. executive order, reports IAPP. The committee members worried that there is the potential for the order to be changed by a U.S. president at any moment.

LIBE has yet to formally file its opinion, expected towards the end of March. There would then be a vote on it in Parliament while the Commission is expecting to finalize the decision by July at the earliest.

Article Topics

biometric data  |  biometrics  |  border security  |  data protection  |  data sharing  |  Europe  |  industry  |  national security  |  United States