Antitrust Law Daily Wrap Up, PRIVACY NEWS: U.S., EU conduct first annual review of data privacy pact, (Jul 22, 2024)

By Tom Leithauser, TR Daily

The review examined information from civil society organizations, companies relying on the DPF for data transfers, and relevant US authorities.

U.S. and European Union (EU) officials met last week to conduct their first annual review of a framework designed to protect the privacy of EU residents when personal data is transferred from EU organizations to the U.S., according to a joint statement from U.S. Commerce Secretary Gina Raimondo and European Commissioner for Justice Didier Reynders.

The EU-U.S. Data Privacy Framework (DPF) went into effect last summer after the European Commission (EC) determined that the framework would treat EU residents’ personal data with the same level of care required by the EU’s General Data Protection Regulation.

The DPF is the third iteration of a framework designed to protect the privacy of EU residents when their data is sent to the U.S. The previous two were struck down by the Court of Justice of the EU (CJEU), which found they were incompatible with EU privacy law. The DPF might face a similar fate.

In the meantime, the DPF is subject to annual reviews to ensure it functions as intended.

The Biden administration made several concessions to the EU to win approval for the pact, including issuing an executive order directing U.S. intelligence agencies to adopt new safeguards for their treatment of the personal data of “non-U.S. persons” and to give those individuals the same privacy rights as U.S. persons under U.S. law. In its decisions striking down earlier cross-border data pacts, the CJEU ruled that U.S. surveillance programs endangered the privacy rights of EU residents.

The White House also established a Data Protection Review Court at the Department of Justice to adjudicate complaints from EU residents who suspect their data was mishandled.

Under the DPF, U.S. companies self-certify that they are in compliance with its provisions, entitling them to reap the benefits of free flows of data between Europe and the U.S.

“Since the DPF’s implementation in July 2023, more than 2,800 enterprises have joined the framework, 70 percent of which are small and medium-sized businesses,” according to Ms. Raimondo and Mr. Reynders.

“The DPF first review provides an opportunity to verify that the different elements of the framework are in place and function effectively,” they said. “The review covers all aspects of the framework, from compliance by companies with its privacy requirements and the enforcement of those protections, to the functioning of the Data Protection Review Court before which individuals in the EU/European Economic Area can obtain redress with respect to U.S. signals intelligence activities.”

The DPF review will conclude with a report from the EC evaluating whether the DPF is working as intended, they added.

News: Privacy