Debate: Adequacy of the protection afforded by the EU-U.S. Data Privacy Framework
Date: WEDNESDAY, 10 MAY 2023
Speaker: Didier Reynders
Language: EN

First of all, I would like to draw your attention to the fact that this new framework is very different compared to the previous one, the EU-US Privacy Shield. In the meantime, the European Court of Justice has clarified the requirements to be fulfilled in order for the European Union to adopt an adequacy decision. As you know, the Court of Justice invalidated the privacy shield on 16 July 2020, concluding in its  Let me recall that the privacy shield was invalidated by the Court for two reasons: first, insufficient safeguards in terms of necessity and proportionality as regards access to personal data by US intelligence agencies and, second, insufficient safeguards in terms of individual redress in this area. It is on these two key points that on behalf of the Commission I have negotiated with the US and I consider that we have obtained very significant changes to the US legal framework to address these two issues. The US have indeed changed the rules governing the operations of their intelligence agencies, which had not been the case under previous frameworks. This should not be underestimated in an area as sensitive for any country as national security. Our draft adequacy decision is built on these new US rules and I am pleased that the European Data Protection Board has also recognised and welcomed significant improvements.  Another important element is that the solutions found are similar to those accepted by our highest court in Europe, when striking the delicate balance between, on the one hand, privacy and, on the other hand, important public policy objectives, such as the protection of national security. Indeed, these solutions are based on the legal standards applied to EU Member States by the European Court of Human Rights, the EU Court of Justice and national constitutional courts. This is notably true for the necessity and proportionality requirements which are for the first time clearly spelled out in details in the US legal order. The US authorities will be obliged to balance different factors, the same as those required by the case-law of the EU Court of Justice, such as the nature of the data, the seriousness of the threat or the likely impact on the rights of individuals.  Let me now say a few words on the new redress mechanism. The data protection review code is an essential element of the new framework. It will be composed of independent judges. Let me underline straight away that contrary to some allegations, these judges could not be dismissed by the executive. The European Data Protection Board has notably highlighted that the new framework puts in place an independent and impartial court that will take binding and enforceable decisions on complaints lodged by Europeans. This board will adopt fully resonant decisions after having heard a special advocate. The special advocate will have as exclusive mission to represent the interests of the individual and will need to be a member of the bar. Therefore, it will be subject to exactly the same ethical and professional obligations as any lawyer in the US, notably in terms of independence. It is true that the information contained in the initial response given to the individual at the end of the process will be limited. But it will still clearly state that if a violation was found, it has been remedied. And the concerned individual will have access to the full resonate decision when this will no longer pose a risk to national security. These limitations are part of the balance to be found between the adversarial process and the protection of information relating to national security. This has been fully accepted by the European Court of Human Rights when accompanied by safeguards similar to the ones negotiated with the US.  Finally, the functioning of this redress mechanism, including due process aspects and compliance with the decisions of the new court, will be overseen by an independent body specifically responsible for data protection, the Privacy and Civil Liberties Oversight Board.  Monsieur le Président, Mesdames et Messieurs les députés, nous travaillons actuellement pour répondre aux observations formulées dans l’avis du Comité européen de la protection des données, et nous examinerons aussi attentivement la résolution qui sera adoptée par votre Parlement. Je peux déjà vous dire qu’en réponse à l’avis du Comité européen de la protection des données, nous sommes prêts à fournir des explications supplémentaires, à clarifier davantage certains aspects du nouveau cadre, et à renforcer le suivi concernant plusieurs éléments. Parallèlement, nous travaillons en étroite collaboration avec les États-Unis à la mise en œuvre du nouveau cadre. Il va de soi que les éléments de mise en œuvre doivent être pleinement en place pour que notre décision d’adéquation puisse entrer en vigueur. Pour conclure, je souhaiterais souligner que ce nouveau cadre a pour but d’assurer la continuité de la protection pour les citoyens, et la sécurité juridique pour les entreprises. Je me suis engagé personnellement dans ces négociations avec les États-Unis, et j’estime que nous avons obtenu des avancées significatives qui répondent aux exigences de la jurisprudence de la Cour européenne de justice, et permettent dès lors de conclure en faveur d’une équivalence entre la protection offerte aux États-Unis et le cadre juridique de l’Union. J’espère pouvoir compter sur votre soutien pour reconnaître ces améliorations importantes que nous avons obtenues par le biais de nouvelles règles juridiques contraignantes aux États-Unis. Des progrès importants qui ont notamment déjà été reconnus par le Comité européen de la protection des données. Bien entendu, soyez assurés que la Commission sera particulièrement vigilante pour assurer la mise en œuvre de ce nouveau cadre juridique, et n’hésitera pas à réagir en cas de problème éventuel. Je vous remercie pour votre attention et je vais évidemment être à l’écoute de vos observations.