Joe Biden, the 46th and current President of the United States, has signed an Executive Order to implement the EU – US Trans-Atlantic Data Privacy Framework announced in March 2022, and the US Department of Justice supplemented it with a new regulation to establish the review mechanisms envisaged by the order. The European Commission will now prepare a draft adequacy decision and launch its adoption procedure.

The Executive Order is to provide the European Commission with the basis to adopt a new adequacy determination to provide greater legal certainty for companies using the Standard Contractual Clauses and Binding Corporate Rules under the GDPR for EU – US data transfers.

By way of background, the new Framework aims to restore United States' adequacy status, foster smooth trans-Atlantic data flows, and address the concerns raised by the Court of Justice of the European Union (CJEU) in the Schrems I and Schrems II decisions.

Schrems I

Austrian activist, lawyer, and author Maximillian Schrems, lodged a complaint with the Irish Data Protection Commissioner requesting an investigation into data transfers from Facebook's European headquarters in Ireland to its servers in the US over concerns related to the NSA's data collection practices following the 'Edward Snowden revelations'. The data transfer relied on the Safe Harbour arrangement between the EU and the US at the time. Schrems' case was brought to the High Court of Ireland, which referred the case to CJEU. As a result, the CJEU invalidated the Safe Harbour arrangement due to its lack of adequate safeguards.

Following Schrems I, the EU and the US entered into a new agreement in 2016, known as the Privacy Shield, to constitute a new legal basis for smooth data flows between the European Economic Area and the US.

Schrems II

After the invalidation of Safe Harbour, Schrems reformulated his complaint, arguing that Facebook continued transferring personal data to the US, but this time relying on the standard contractual clauses. The complaint once again found itself before the Irish High Court, which referred the case to the CJEU, requesting the European Court to address 11 questions, one of which questioned the reliability of the Privacy Shield. In its Schrems II decision, the CJEU declared the Privacy Shield agreement invalid, once again finding that the EU – US arrangement gave undue priority to US law and the requirements of national security and public interest without proportionate limits to intrusions or appropriate legal remedies for the data subjects.

Privacy Shield 2.0

The invalidation of the Privacy Shield with the Schrems II decision forced organisations to revisit the way they approach international data transfers and required heavy reliance on the European Commission's updated standard contractual clauses and a "Transfer Impact Assessment" (TIA), which proved to be a complex challenge in practice. Hence, the desire for a new edition of the Privacy Shield.

On 25 March 2022, the EU and the US announced an 'agreement in principle' on the new Framework, which is said to include "unprecedented commitments" from the US to:

• Strengthen the privacy and civil liberties safeguards governing the US signals intelligence activities;
• establish a new redress mechanism with independent and binding authority; and
• enhance its existing rigorous and layered oversight of signals intelligence activities.

The US and the EU, in their joint press release, stated that the new Framework ensures that:

• Signals intelligence collection may be undertaken only where necessary to advance legitimate national security objectives and must not disproportionately impact the protection of individual privacy and civil liberties;
• EU individuals may seek redress from a new multi-layer redress mechanism that includes an independent Data Protection Review Court that would consist of individuals chosen from outside the US Government who would have full authority to adjudicate claims and direct remedial measures as needed; and
• US intelligence agencies will adopt procedures to ensure effective oversight of new privacy and civil liberties standards.

More than six months after the US Government and the European Commission reached an agreement in principle, on 7 October 2022, Joe Biden signed an Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities directing the steps that the US will take to implement its commitments under the Framework.

In its press release, the White House stated that the Executive Order would provide the European Commission with a basis to adopt a new adequacy determination through the following steps it establishes concerning US surveillance activities:

• Further safeguards: The Executive Order requires that signals intelligence activities can be conducted only in pursuit of defined national security objectives; taking into consideration the privacy and civil liberties of all persons, regardless of nationality or country of residence; and only when necessary to advance a validated intelligence priority and only to the extent and in a manner proportionate to that priority;
• Handling requirements: The Executive Order mandates handling requirements for personal information collected through signals intelligence activities and extends the responsibilities of legal, oversight, and compliance officials to ensure that appropriate actions are taken to remediate incidents of non-compliance;
• Updated US Intelligence Policies and Procedures: The Executive Order requires US Intelligence Community elements to update their policies and procedures to reflect these new privacy and civil liberties safeguards;
• Redress: The Executive Order creates a multi-layer mechanism for individuals from qualifying states and regional economic integration organisations, as designated according to the Executive Order, to obtain an independent and binding review and redress of claims that their personal information collected through US signals intelligence was collected or handled by the US in violation of applicable US law, including the enhanced safeguards in the Executive Order.
  • In the first layer, individuals will be able to complain to the Civil Liberties Protection Officer (CLPO) of the US intelligence community, and in the second layer, individuals will have the right to appeal that decision to the newly created Data Protection Review Court (DRPC); and
• Review: The Executive Order calls on the Privacy and Civil Liberties Oversight Board to review US Intelligence Community policies and procedures to ensure that they are consistent with the Executive Order and to conduct an annual review of the redress process, including to review whether the Intelligence Community has fully complied with determinations made by the CLPO and the DPRC.

Now the ball is in the European Commission's court. The commission will draft an adequacy decision under Article 45 of the GDPR to translate this arrangement into law.

Schrems III in the making?

Max Schrems doesn't seem too impressed with these developments. He was disappointed in the EU and the US for missing the opportunity to come to a 'no spy' agreement, calling the Framework seemingly yet another purely political deal without a legal basis. Schrems hinted that he would challenge the Framework if it is not in line with the EU law, a position Schrems maintains considering President Biden's Executive Order.

What now?

The European Data Protection Board adopted the statement on the Framework. Still, it noted that this announcement does not constitute a legal basis that data exporters in the European Economic Area can use to transfer data to the US.

US President Joe Biden has signed the Executive Order, and the Department of Justice issued a regulation to establish the DPRC. Consequently, the European Commission will draft an 'adequacy decision' under Article 45 of the GDPR, which will be put through the adoption procedure.

The adoption procedure for an adequacy decision consists of different steps: obtaining an opinion from the European Data Protection Board and the green light from a committee composed of representatives of the EU Member States. In addition, the European Parliament has a right to scrutiny over adequacy decisions. Only after that, the European Commission can adopt the final adequacy decision concerning the US.

Therefore, until the European Commission adopts the adequacy decision, data exporters must continue their compliance practices prescribed by the Schrems II decision. From that moment on, the EU and US companies certified by the Department of Commerce under the new Framework can rely on the adequacy decision when sending data to the US by committing to comply with a detailed set of privacy obligations, and individuals can challenge it in their national and European courts.

It is also very likely that Max Schrems will take both the Framework and the adequacy decision to the CJEU. The new US regime will need to satisfy the CJEU that it meets EU legal requirements.

Get in touch

If you'd like to know more about your privacy obligations when doing business with the European Economic Area, then get in touch with Hayden Wilson, Hayley Miller, Campbell Featherstone or Gunes Haksever.

This article was written by Gunes Haksever, a senior associate in our commercial, technology and privacy team.