EU privacy body raises concerns about possible US data transfer pact

The European Data Protection Board’s (EDPB) non-binding opinion comes after the Commission issued a draft decision in December saying U.S. safeguards against American intelligence activities were strong enough to address EU data privacy concerns.

The EDPB said its worries centre on certain rights of data subjects, onward transfers, the scope of exemptions, temporary bulk collection of data and the practical functioning of the redress mechanism.

“We recommend to address the concerns expressed and to provide clarifications requested to ensure the adequacy decision will endure,” EDPB Chair Andrea Jelinek said in a statement.

“We think that after the first review of the adequacy decision, subsequent reviews should take place at least every three years and we are committed to contributing to them,” she added.

The EDPB also called on the commission to put in more safeguards to ensure the independence of a proposed Data Protection Review Court and provide more clarity on temporary bulk collection, the retention and dissemination of such data.

Discover the stories of your interest

It voiced concerns about the lack of a requirement of prior authorisation by an independent authority for the collection of data in bulk and the lack of systematic independent review ex post by a court or an equivalently independent body. Both the European Union and the United States have struggled to come up with a new data transfer pact after Europe’s top court threw out the two previous accords because of concerns about U.S. intelligence agencies accessing Europeans’ private data.

The two previous similar agreements set out the legal framework for thousands of companies to transfer data across the Atlantic for services ranging from cloud infrastructure, data hosting, payroll and finance to marketing.

Both sides reached a preliminary deal in March last year to the relief of thousands of companies stuck in a legal quagmire.

The Commission subsequently published a draft adequacy decision to which the EDPB, EU countries and EU lawmakers will have to review and offer non-binding opinions. A final adequacy decision is expected by the summer.

Set up under landmark privacy rules known as the General Data Protection Regulation (GDPR), the EDPB is made up of representatives of national data protection authorities in the 27 EU countries and the European Data Protection Supervisor (EDPS) to ensure the consistent application of GDPR rules.

(Reporting by Foo Yun Chee; Editing by Aurora Ellis)