EDPB says concerns remain about the EU-US Data Privacy Framework

The European Data Protection Board (EDPB) says, in its Opinion of 28 February, that it welcomes the substantial improvement made to the EU-US Data Privacy Framework (DPF), but that further clarifications are needed on several points. These include certain rights of data subjects, onward transfers, the scope of exemptions, temporary bulk collection of data and the redress mechanism.

The DPAs stress that the level of protection of individuals whose data is transferred must not be undermined by onward transfers from the initial recipient of the transferred data. The EDPB invites the Commission to clarify once more that the safeguards imposed by the initial recipient on the importer in the third country must be effective in light of third country legislation, prior to an onward transfer in the context of the DPF.

The EDPB maintains that specific rules concerning automated decision-making are needed. It calls on the Commission to closely monitor the practical functioning of the redress mechanism, and highlights that close monitoring is also needed concerning the practical application of the newly introduced principles of necessity and proportionality. Further clarity is also necessary regarding temporary bulk collection and the further retention and dissemination of the data collected in bulk.

The EDPB says it will monitor the effectiveness of oversight and enforcement of the DPF and considers that compliance checks are crucial.

EDPB Chair Andrea Jelinek said that after the first review of the adequacy decision, subsequent reviews should take place at least every three years. The EDPB is committed to contributing to them.

The Board’s Opinion is not legally binding.

See EDPB - Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework

PL&B will publish a full analysis of this opinion in the next issue of PL&B International Report.