MEPs raise concerns over draft EU-US data transfer deal:
A shiny new data transfers deal between the European Union and the United States aimed at fixing costly legal uncertainty over exports of personal data isn't in place yet but the European Parliament's civil liberties committee is predicting the incoming EU-U.S. Data Privacy Framework (DPF) won't survive a legal challenge — just as its two predecessors, Safe Harbor (RIP: October 2015); and Privacy Shield (RIP: July 2020), failed to impress EU judges.
In a resolution passed by the LIBE committee yesterday, with 37 votes in favor, none against and 21 abstentions, the MEPs dubbed the DPF an improvement that nonetheless does not go far enough. They also predicted it's likely to be invalidated by the Court of Justice of the EU (CJEU) in the future.
The development follows a draft opinion by the LIBE, back in February, also giving the proposal a thumbs down and urging the Commission to press for meaningful reforms.
In the resolution, the committee takes the view that the proposed arrangement does not provide sufficient safeguards for EU citizens since the framework still allows for bulk collection of personal data in certain cases; does not make bulk data collection subject to independent prior authorisation; and does not provide for clear rules on data retention.
The MEPs are also worried that a proposed redress mechanism — a so-called "Data Protection Review Court" — would violate EU citizens' rights to access and rectify data about them, since decisions would be kept secret. They also question its independence since judges could be dismissed by the U.S. president, who could also overrule its decisions.
"In the resolution, MEPs argue that the framework for data transfers needs to be future-proof, and the assessment of adequacy needs to be based on the practical implementation of rules," per a parliament press release, which said the committee went on to urge the Commission not to grant adequacy based on the current regime, and instead negotiate a data transfer framework that is likely to be held up in court.
Commenting in statement after the vote, the LIBE committee rapporteur Juan Fernando López Aguilar said:
The new framework is certainly an improvement compared to previous mechanisms. However, we are not there yet. We are not convinced that this new framework sufficiently protects personal data of our citizens, and therefore we doubt it will survive the test of the CJEU. The Commission must continue working to address the concerns raised by the European Data Protection Board [EDPB] and the Civil Liberties Committee even if that means reopening the negotiations with the US.
(Score: 2) by Rosco P. Coltrane on Monday April 17, @05:25PM
has been bad news since Oct 26. 2001 - both for Americans and for the rest of the world. And nothing has changed in 22 years.