28.03.2022 | KPMG Law Insights

Trans-Atlantic Data Privacy Frame-work: Old wine in new bottles?

On March 25, EU Commission President Ursula von der Leyen and U.S. President Joe Biden officially announced that the EU and the U.S. want to facilitate transatlantic data exchange and are working on drafting a successor agreement to the “EU-US Privacy Shield.” The Commission has now published an information paper with the first details of the content of the “Trans-Atlantic Data Privacy Framework”.


  • The U.S. holds out the prospect of creating a new set of rules and binding safeguards to limit U.S. intelligence agencies’ access to data to what is necessary and proportionate to protect national security. Specifically, U.S. intelligence agencies are to implement procedures to ensure effective oversight of the new privacy and liberty standards.


  • A new, two-tiered redress system to investigate and remedy complaints by EU citizens regarding data access by U.S. authorities is to be introduced. An independent “Data Protection Review Court” is to be established for this purpose.


  • The Trans-Atlantic Data Privacy Framework will – again – be based on a system of self-certification by U.S. companies under the supervision of the U.S. Department of Commerce.


Next steps

Concrete legal obligations must now be formulated from the agreed principles. These are then to be issued within the framework of an “Executive Order”, which obliges the US authorities to implement them. The Executive Order is intended to form the basis for the Commission’s draft adequacy decision. With each of these steps potentially taking months, it is still entirely unclear when (if ever) an adequacy decision can be expected. However, a short-term solution to the problem of transatlantic data traffic seems impossible. Last but not least, Max Schrems – lawyer and data protection activist – has already announced that, as in the “Safe Harbour” and “Privacy Shield” cases, he will also take timely action against future adequacy decisions if they do not comply with European Union law.


Doubts about compliance with European data protection standards

The news about a planned successor agreement to the “Privacy Shield” is encouraging due to the increasing relevance of transatlantic data exchange. However, not too many hopes should be placed in the “Trans-Atlantic Data Privacy Framework” just yet. Under no circumstances should processes already initiated to secure U.S. transfers be stopped.

The principles proposed by the EU and the U.S. do take up specific points of the ECJ’s Schrems II decision, in that legal protection options are to be improved and complaints by those affected are to be decided by an independent body.

However, crucial questions remain unanswered. For example, whether there will be any obligation at all on the part of U.S. authorities to inform EU citizens about data access. Furthermore, it remains to be seen whether the powers of the Data Protection Review Court vis-à-vis U.S. authorities will also be sufficient to enforce compliance vis-à-vis U.S. authorities.

Another major criticism of the ECJ with respect to the predecessors of the proposed Trans-Atlantic Data Privacy Framework was that Section 702 of the Foreign Intelligence Surveillance Act (FISA) did not impose restrictions on surveillance activities or provide other safeguards for non-U.S. citizens. In response to this, surveillance measures are to be carried out in the future only if this is necessary to protect national security and appropriate with regard to the intrusion into privacy. However, past experience has shown that there are sometimes different understandings in the EU and the U.S. regarding the value of privacy rights and national security, and balancing the positions involves some challenges. The introduction of an adequacy test on the U.S. side is an essential and important step, although the actual implementation will only show whether sufficient account is taken of the restriction on the access rights of the U.S. authorities previously demanded by the EU.


Keep calm and stay on course

Efforts to officially regulate transatlantic data sharing on the basis of an adequacy decision could mean major benefits for all stakeholders, as this would allow data to be transferred without the need to enter into standard contractual clauses, which have since become complex, and to conduct time-consuming and costly transfer impact assessments. However, a “Privacy Shield 2.0” and the associated uncertainties must be prevented, because what companies need above all else is legal certainty; and they need it in the long term. In this regard, it remains to be seen how the U.S. will implement the announced measures and how the EU courts will assess this. It therefore remains essential for European companies to take individual measures to comply with data protection requirements when using U.S. providers and to work overall on maintaining their compliance with regard to data transfers to the United States.


Explore #more

13.06.2024 | Press releases

Handelsblatt and Best Lawyers honor KPMG Law Experts

Best Lawyers has once again identified the best commercial lawyers in Germany for 2024 exclusively for Handelsblatt. A total of 28 lawyers were honored by…

27.05.2024 | KPMG Law Insights

Agreement on ecodesign regulation: products to become more sustainable

After lengthy negotiations, the Council and Parliament of the European Union reached a provisional agreement on the Ecodesign Regulation on the night of December 5,…

22.05.2024 | KPMG Law Insights

The AI Act is coming: EU wants to get a grip on AI risks

For many people, artificial intelligence (AI) is the great hope for business, healthcare and science. But there are also plenty of critics who fear the…

17.05.2024 | KPMG Law Insights

Podcast series “KPMG Law on air”: When the family business is to be sold

Around 38,000 family businesses are currently handed over each year. In most cases, the change of ownership takes place within the family. But more and…

03.05.2024 | KPMG Law Insights

Doubts about inability to work? What employers can do

The certificate of incapacity for work (AU certificate) serves as proof of incapacity for work due to illness. However, only if the certificate meets certain…

27.03.2024 | KPMG Law Insights

EU Buildings Directive: life cycle greenhouse potential becomes relevant

On March 12, 2024, the EU Parliament approved the amendment to the EU Buildings Directive. The directive obliges member states and, indirectly, building owners and…

19.03.2024 | Business Performance & Resilience, KPMG Law Insights

CSDDD: Provisional agreement on the EU Supply Chain Directive

The EU member states agreed on the CSDDD, the EU Supply Chain Directive, on March 15, 2024. Germany abstained from the vote. Negotiators from the…

21.02.2024 | KPMG Law Insights, KPMG Law Insights

The Digital Services Act – what does it mean for companies?

The Digital Services Act (DSA) is a key component of the EU’s digital strategy and came into force on November 16, 2022. As a regulation,…

15.02.2024 | KPMG Law Insights

Data compliance management: How to implement it in practice

Part 3 of the article series “Professional tips for data compliance management”   The third part of this series of articles deals with data compliance

14.02.2024 | Business Performance & Resilience, PR Publications

Guest article in ZURe: Monitoring the implementation of the LkSG

The current issue of ZURe (p. 20 ff.) contains a guest article by KPMG Law Partner Thomas Uhlig (Head of General Business and Commercial Law),…


Francois Heynike, LL.M. (Stellenbosch)

Head of Technology Law

THE SQUAIRE Am Flughafen
60549 Frankfurt am Main

tel: +49-69-951195770

© 2024 KPMG Law Rechtsanwaltsgesellschaft mbH, associated with KPMG AG Wirtschaftsprüfungsgesellschaft, a public limited company under German law and a member of the global KPMG organisation of independent member firms affiliated with KPMG International Limited, a Private English Company Limited by Guarantee. All rights reserved. For more details on the structure of KPMG’s global organisation, please visit

 KPMG International does not provide services to clients. No member firm is authorised to bind or contract KPMG International or any other member firm to any third party, just as KPMG International is not authorised to bind or contract any other member firm.