Cybersecurity Policy Report, EU Privacy Board Largely Satisfied With Rollout of EU-U.S. Privacy Pact, (Nov 5, 2024)

By Tom Leithauser

The U.S. government’s enactment and management of a U.S.-European Union agreement that ensures the protection of EU residents’ privacy when their data is transferred to the U.S. appears to be working fine for now, the European Data Protection Board (EDPB) said today.

EDPB members were involved in a recent review of the EU-U.S. Data Privacy Framework (DPF), which went into effect in 2023 after the European Commission (EC) determined that the framework would treat EU residents’ personal data with the same level of care required by the EU’s General Data Protection Regulation.

The review, conducted over the summer about a year after the DPF went into effect, led to the EC issuing a favorable report last month (CPR, Oct. 10).

Like the EC, the EDPB assessed that the DPF was generally working as intended, although it identified some concerns, including the continued use of data brokers by the U.S. intelligence community (IC).

“We are pleased that progress has been made since the adoption of the adequacy decision thanks to the fruitful cooperation between U.S. authorities, the EU Commission and the EDPB. At the same time, there is still space for improvement and we should continue working together to maintain a high level of data protection and safeguard the rights and freedoms of EU individuals,” EDPB Deputy Chair Zdravko Vukić said in a news release.

A report issued by the EDPB, however, expressed reservations about the IC’s continued reliance on data brokers to conduct intelligence activities.

“It is clear that the volume and sensitivity of commercially available data have expanded over the past years due to the advancement of digital technology, including location tracking of smartphones and other devices as well as data collection for advertising purposes when using online services. It is also clear that such information can provide critical intelligence value. The EDPB believes this form of government access to personal data raises a number of privacy concerns,” the report said.

It noted that information collected from data brokers was not protected by a 2022 executive order, EO 14086, issued by President Biden that explicitly gave EU residents the same protections from U.S. signals intelligence collection as U.S. persons. That EO was one of several steps the U.S. took to win EU approval of the DPF (CPR, Oct. 7, 2022).

“The acquisition by intelligence agencies of commercially available data could have the effect of EO 14086 and its safeguards being circumvented and thus practically watered down or undermined,” the report said.

“From this perspective, the commercial acquisition of personal data by the IC and its practical use cases should be further assessed and monitored by the Commission. The EDPB emphasizes that an adequate level of protection must be ensured comprehensively, i.e. including with regard to the possibility of this particular form of government access,” it said.

Another concern of the EDPB is the language in section 702 of the Foreign Intelligence Surveillance Act, which was reauthorized in April by Congress when it passed the Reforming Intelligence and Securing America Act (RISAA) (CPR, April 22).

While RISAA reflected congressional intent to add new privacy protections to section 702, it also broadened the definition of “electronic communication service providers” that would be subject to government requests for user data.

“The EDPB is concerned that the amendment to the definition of Electronic Communication Service Provider does not meet the requirement of clear, precise and accessible law—both for individuals whose personal data may be accessed and for companies now subject to Section 702 FISA,” according to the EDPB report.

“The EDPB considers that it is important for the Commission to follow up on future developments concerning Section 702 FISA, including in particular the application of the broadened definition of Electronic Communication Service Provider in practice,” it said.

The DPF is important to the functioning of U.S. companies that handle EU residents’ personal data. It enables those companies to obtain certification from the U.S. Department of Commerce—or the Department of Transportation for airlines and other businesses in the travel sector—if they meet the program’s requirements.

The Federal Trade Commission is empowered to penalize certified companies that fail to meet their obligations under the program or falsely claim to be DPF-certified. But the EDPB report observed that the FTC had not filed any complaints against companies for DPF false claims or non-compliance and urged the commission to engage in “proactive enforcement action.”

Like the EC, the EDPB recommended that the next review of the DPF be conducted in three years.

MainStory: TopStory FederalLegislation InternationalLegislation DataPrivacy GDPR