Search
Contact
28.03.2022 | KPMG Law Insights

Trans-Atlantic Data Privacy Frame-work: Old wine in new bottles?

On March 25, EU Commission President Ursula von der Leyen and U.S. President Joe Biden officially announced that the EU and the U.S. want to facilitate transatlantic data exchange and are working on drafting a successor agreement to the “EU-US Privacy Shield.” The Commission has now published an information paper with the first details of the content of the “Trans-Atlantic Data Privacy Framework”.

 

  • The U.S. holds out the prospect of creating a new set of rules and binding safeguards to limit U.S. intelligence agencies’ access to data to what is necessary and proportionate to protect national security. Specifically, U.S. intelligence agencies are to implement procedures to ensure effective oversight of the new privacy and liberty standards.

 

  • A new, two-tiered redress system to investigate and remedy complaints by EU citizens regarding data access by U.S. authorities is to be introduced. An independent “Data Protection Review Court” is to be established for this purpose.

 

  • The Trans-Atlantic Data Privacy Framework will – again – be based on a system of self-certification by U.S. companies under the supervision of the U.S. Department of Commerce.

 

Next steps

Concrete legal obligations must now be formulated from the agreed principles. These are then to be issued within the framework of an “Executive Order”, which obliges the US authorities to implement them. The Executive Order is intended to form the basis for the Commission’s draft adequacy decision. With each of these steps potentially taking months, it is still entirely unclear when (if ever) an adequacy decision can be expected. However, a short-term solution to the problem of transatlantic data traffic seems impossible. Last but not least, Max Schrems – lawyer and data protection activist – has already announced that, as in the “Safe Harbour” and “Privacy Shield” cases, he will also take timely action against future adequacy decisions if they do not comply with European Union law.

 

Doubts about compliance with European data protection standards

The news about a planned successor agreement to the “Privacy Shield” is encouraging due to the increasing relevance of transatlantic data exchange. However, not too many hopes should be placed in the “Trans-Atlantic Data Privacy Framework” just yet. Under no circumstances should processes already initiated to secure U.S. transfers be stopped.

The principles proposed by the EU and the U.S. do take up specific points of the ECJ’s Schrems II decision, in that legal protection options are to be improved and complaints by those affected are to be decided by an independent body.

However, crucial questions remain unanswered. For example, whether there will be any obligation at all on the part of U.S. authorities to inform EU citizens about data access. Furthermore, it remains to be seen whether the powers of the Data Protection Review Court vis-à-vis U.S. authorities will also be sufficient to enforce compliance vis-à-vis U.S. authorities.

Another major criticism of the ECJ with respect to the predecessors of the proposed Trans-Atlantic Data Privacy Framework was that Section 702 of the Foreign Intelligence Surveillance Act (FISA) did not impose restrictions on surveillance activities or provide other safeguards for non-U.S. citizens. In response to this, surveillance measures are to be carried out in the future only if this is necessary to protect national security and appropriate with regard to the intrusion into privacy. However, past experience has shown that there are sometimes different understandings in the EU and the U.S. regarding the value of privacy rights and national security, and balancing the positions involves some challenges. The introduction of an adequacy test on the U.S. side is an essential and important step, although the actual implementation will only show whether sufficient account is taken of the restriction on the access rights of the U.S. authorities previously demanded by the EU.

 

Keep calm and stay on course

Efforts to officially regulate transatlantic data sharing on the basis of an adequacy decision could mean major benefits for all stakeholders, as this would allow data to be transferred without the need to enter into standard contractual clauses, which have since become complex, and to conduct time-consuming and costly transfer impact assessments. However, a “Privacy Shield 2.0” and the associated uncertainties must be prevented, because what companies need above all else is legal certainty; and they need it in the long term. In this regard, it remains to be seen how the U.S. will implement the announced measures and how the EU courts will assess this. It therefore remains essential for European companies to take individual measures to comply with data protection requirements when using U.S. providers and to work overall on maintaining their compliance with regard to data transfers to the United States.

 

Explore #more

21.02.2025 | In the media

Guest article in Betriebs Berater: Overview of regulation for securities institutions

Since the Securities Institutions Act (WpIG) came into force on June 26, 2021, securities institutions have had their own supervisory regime. In addition to the…

21.02.2025 | KPMG Law Insights

Money laundering prevention: BaFin calls on financial sector to act

The German Federal Financial Supervisory Authority (BaFin) is calling on the financial sector to pay greater attention to money laundering prevention. In its report “Risks…

18.02.2025 | KPMG Law Insights

AI compliance: important legal aspects at a glance

Human intelligence draws on experience, emotion and intuition. Artificial intelligence (AI), on the other hand, processes vast amounts of data in fractions of a second.…

17.02.2025 | In the media

WirtschaftsWoche honors KPMG Law and Konstantin von Busekist

KPMG Law and Konstantin von Busekist were recognized as TOP Law Firm 2025 and Konstantin von Busekist as TOP Lawyer 2025 in the current WirtschaftsWoche…

17.02.2025 | In the media

Guest article in InfrastrukturRecht: Inability to charge the water concession levy

On 09.10.2024 (9 B 5.24), the BVerwG dismissed the appeal of the City of Kassel against the non-admission of the appeal in the judgment of…

13.02.2025 | Deal Notifications

KPMG Law and KPMG advise Windmöller & Hölscher on the sale of the textile machinery division to Starlinger

KPMG Law and KPMG are advising Windmöller & Hölscher KG (Windmöller & Hölscher) on the sale of its textile machinery division to Starlinger & Co…

13.02.2025 | Deal Notifications

KPMG Law advised LDA Legal Data Analytics GmbH on its cooperation with the publishing house C.H.Beck on the development of the chat book “Frag den Grüneberg”

Digitalization is changing the way legal knowledge is accessed and used. LDA Legal Data Analytics GmbH (LDA) develops AI solutions for the legal sector to…

11.02.2025 | KPMG Law Insights

Receipt of the notice of termination at the usual postal delivery times

In the opinion of the Federal Labor Court (BAG, judgment of June 20, 2024 – 2 AZR 213/23), a letter of termination sent by…

11.02.2025 | KPMG Law Insights

Cooperation between administration and start-ups – legal aspects

The advantages of cooperation between the public sector and start-ups are obvious. The administration is faced with the task of digitizing its own authorities and

10.02.2025 | Press releases

New strategic direction in Legal Operations Advisory at KPMG Law: Legal Operations, Legal Technology and Legal Managed Services to be merged

By further integrating Legal Operations, Legal Technology and Legal Managed Services, KPMG Law is deepening its expertise in this area in order to support clients…

Contact

Francois Heynike, LL.M. (Stellenbosch)

Partner
Head of Technology Law

THE SQUAIRE Am Flughafen
60549 Frankfurt am Main

Tel.: +49-69-951195770
fheynike@kpmg-law.com

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit https://home.kpmg/governance.

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.

Scroll