12.1.2022
EN
Official Journal of the European Union
C 15/183 Thursday 20 May 2021
29.
Recalls that the Commission is currently reviewing all the adequacy decisions adopted under Directive EC 95/46/EC; stresses that the Commission should apply the stricter standards set by the GDPR and by the CJEU’s Schrems I and II judgments to assess whether an essentially equivalent level of protection to that provided by the GDPR, including in terms of access to an effective remedy and protection against undue access to personal data by the third country’s authorities is afforded; urges the Commission to finalise these reviews as a matter of urgency and to revoke or suspend any of pre-GDPR decisions if it finds that the third country in question does not provide an essentially equivalent level of protection and if the situation cannot be remedied; 30.
Considers that the Biden administration, through the appointment of an experienced privacy expert as chief negotiator on the successor to the Privacy Shield, showed commitment to finding a solution for commercial data transfers between the EU and the US as a matter of priority; expects the dialogue between the Commission and its US counterparts which began right after the CJEU ruling to be stepped up over the coming months; 31.
Calls on the Commission not to adopt any new adequacy decision in relation to the US, unless meaningful reforms are introduced, in particular for national security and intelligence purposes, which can be achieved through clear, legally sustainable, enforceable and non-discriminatory reform of US laws and practices; reiterates, in this regard, the importance of robust safeguards in the area of access to personal data by public authorities; calls on the Commission to put into practice its ‘geopolitical ambitions’ to enforce essentially equivalent data protection in the US and other third countries as in the EU; 32.
Recommends national data protection authorities suspend the transfer of personal data which may be subject to access by public authorities in the US if the Commission were to adopt any new adequacy decision in relation to the US in the absence of such meaningful reforms; 33.
Welcomes the fact that the Commission follows the criteria set out in the Article 29 Working Party Adequacy Referential under the GDPR (18) (as endorsed by the EDPB) and in EDPB Recommendation 01/2021 on the Adequacy Referential under the Law Enforcement Directive (19); considers that the Commission should not go below these criteria when evaluating whether a third country qualifies for an adequacy decision; takes note that the EDPB has recently updated its Recommendations on the European Essential Guarantees for surveillance measures in light of CJEU case law (20); o o
o
34.
Instructs its President to forward this resolution to the Commission, the European Council, the Council of the European Union, the European Data Protection Board, the national parliaments of the Member States, the Congress and Government of the United States of America and the Parliament and Government of the United Kingdom.
(18) (19) (20)
https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=614108 https://edpb.europa.eu/our-work-tools/our-documents/recommendations/recommendations-012021-adequacy-referential-underlaw_en https://edpb.europa.eu/our-work-tools/our-documents/preporki/recommendations-022020-european-essential-guarantees_en