On 28 February 2023, the European Data Protection Board (EDPB) adopted Article 70(1)(s) GDPR Opinion No. 8/2023 on the EU-U.S. Data Privacy Framework ("DPF"), meant to replace the previous U.S. Privacy Shield invalidated by the Court of Justice of the European Union ("ECJ") in the Schrems II case, as published in the European Commission's adequacy decision on 13 December 2022. In assessing the DPF, the EDPB recalled that Article 45 GDPR and ECJ case-law require the third country's legislation to provide data subjects with a level of protection essentially equivalent to that guaranteed in the EU. In this regard, the EDPB welcomed the introduction by Executive Order 14086 of the principles of necessity and proportionality for the gathering of data and the new redress mechanism for EU data subjects in the context of signals intelligence. At the same time, the EDPB encouraged the adoption of more safeguarding policies and procedures to guide U.S. intelligence agencies' access to data and flagged the opportunity to institute an independent authority to oversee the collection of data in bulk under Section 702 Foreign Intelligence Surveillance Act (FISA) and Executive Order 12333. Overall, the EDPB noted substantial improvements to the previous legal framework and asked the Commission to require the necessary political clarifications and to closely monitor the actual functioning of the new mechanisms.
Originally published by March, 2023
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
