Why the EU-US Data Privacy Framework isn’t a complete global transfer fix

Great news about the EU-U.S. adequacy decision! But let’s remember that many organisations want a solution for global transfers, not just for the United States.
While the EU-U.S. adequacy decision helps a lot, it is only part of the solution that organisations need. Let’s look at some of the other components.

Another part of the solution is the excellent work the European Commission has been doing in negotiating trade deals with data protection terms. The absolute number (and global reach) of countries with adequacy decisions has also increased (e.g. Japan, South Korea). Just yesterday, the Commission announced a new trade deal with New Zealand that is notably aimed at “facilitating data flows, predictable and transparent rules for digital trade and secure online environment for consumers” and “preventing unjustified data localisation requirements and maintaining high standards of personal data protection”.

Yet another part of the solution, and one that depends more on the organisations themselves and the courts, might involve challenging the current practices of several supervisory authorities.
After all, Schrems II also brought into question the use of standard contractual clauses (which will continue to be used, perhaps even as a backup for transfers to the U.S., taking into account the inevitable challenge before the courts) as well as binding corporate rules, requiring additional verifications in each case.
[hello Data Transfer Impact Assessments]
In addition, many supervisory authorities have since been adopting an ever more stringent approach. We have moved away from “if you can show that you have no reason to believe that the problematic local laws will apply, you’re OK” (still today the official EDPB position) to “if it is theoretically possible that a national intelligence agency has access, that’s enough – it doesn’t matter if you have no reason to believe that such agency would ever actually do that or would even be interested in your data”.
[only slight exaggeration]
The same applies to the “derogations” under Art. 49 GDPR, regarding which authorities (and the EDPB) have adopted a very strict interpretation that goes beyond the terms of the GDPR provisions themselves.
And the only way that the needle might go back in the direction that controllers and processors typically hope is if they challenge authorities’ positions (likely as an appeal against a negative decision). That won’t be easy.

So rejoice about the EU-U.S. adequacy decision (if you are pleased with it, of course) – but remember that it is not all that you need as controller or processor if you intend to share data with countries outside of the European Economic Area. And you might still have some work to do – as well as the European Commission.

EU-US adequacy decision announcement: https://lnkd.in/ef4M6vHJ
New Zealand trade deal announcement: https://lnkd.in/eZgyzQuC

privacy