A (data) bridge over troubled waters – The EU-US Data Privacy Framework

Background

The Court of Justice of the European Union (“CJEU”) heard “Schrems I” in 2015. Max Schrems argued that Facebook’s transfer of personal data from the EU to the US violated European data protection laws because the US did not provide an adequate level of protection for personal data. The case primarily focused on the Safe Harbor framework in place at the time, which was an agreement between the EU and the US allowing the transfer of personal data. In October 2015, the CJEU invalidated the Safe Harbor Framework for not adequately protecting the privacy rights of EU citizens.

In June 2016, the US and EU agreed a replacement framework – the “EU-US Privacy Shield” which was a data protection agreement between the EU and the US, which similarly aimed to facilitate the transfer of personal data between the two regions by ensuring an adequate level of protection.

The Schrems II case followed its predecessor and was heard by the CJEU in July 2020. This case considered the EU-US Privacy Shield, The court ruled that the Privacy Shield did not offer adequate safeguards for EU citizens’ personal data due to concerns regarding US surveillance practices and the lack of effective remedies for EU individuals. This decision meant that the Privacy Shield could no longer be relied upon as a legal basis for transferring personal data from the EU to the US.

Following the invalidation of the Privacy Shield, EU personal data could only be transferred to the US if additional safeguards were in place. One of the most common mechanisms is the use of Standard Contractual Clauses (SCCs), which are detailed contractual clauses approved by the European Commission that provide data protection safeguards. The organisation exporting the data would also need to undertake a transfer risk assessment prior to the transfer of data. The process is time consuming and costly which would deter organisations from beginning the process and organisations in the EU have faced frustration in implementing transfers to the US.

Does this apply to the UK?

No. This agreement is between the EU and the US and the UK are not a party. Currently, UK organisations wishing to transfer personal data to the US would need to agree alternative transfer mechanisms, such as the SCCs.

However, the UK and the US have reached a commitment in principle to establish a UK extension to the DPF, which will create a ‘data bridge’ between the UK and the US. The data bridge is not currently in force, but once finalised the US companies which are certified under the DPF will be able to receive UK personal data under the new data bridge.

Finalising the data bridge was noted as a key deliverable for 2023 in the US-UK Comprehensive Dialogue on Technology and Data. The UK-US data bridge, when finalised, would constitute a UK-issued adequacy decision.

It should be noted that notwithstanding the establishment of any such data bridge, organisations will still need to have a lawful basis to transfer the personal data as well document the arrangements that they have in place with the entities in the US with whom they share their personal data (such as a data processing or data sharing agreement).

We will be closely monitoring any developments and shall provide any updates on our website in due course.

Should you have any queries regarding data protection, please contact our specialist data protection team here.