On October 7, 2022, the U.S. president issued an Executive Order1 aimed at lifting restrictions on the flow of personal data between the EU and the United States. It is the day after the anniversary of the Schrems ruling, issued on October 6, 2015 by the CJEU, that this act is adopted. Since this ruling, data exchanges with the United States are prohibited in theory, subject to the implementation of appropriate safeguards. The Privacy Shield, which was intended to address this problem, was a short term solution.
With this Executive Order, the United States commits to adopting measures aimed at compensating for its legal shortcomings, which could affect the rights of individuals located in
the EU, in the event of the transfer of their data. The United States therefore announces the upcoming implementation of the following guarantees:
The Executive Order marks an important step towards further liberalisation of EU-US data flows. However, it does not yet permit free transfers to the US. For this, an adequacy decision
will still have to be adopted by the European Commission. Organisations should therefore continue to implement the standard contractual clauses (SCC) and conduct an analysis of the
U.S. laws (Transfer Impact Assessment - TIA). The US has responded to the shortcomings identified by the EU, which implies an update of the existing TIAs.
The EDPB had already announced that a detailed analysis of the Executive Order will be published, to gauge the level of adequacy. In the US, the Department of Justice has
confirmed the creation of a dedicated jurisdiction (the DPRC).
This act seems to provide a better framework for surveillance measures and the question of recourse/compensation for data subjects than what was established in the Safe Harbor and the Privacy Shield. They were invalidated because they did not lead to substantial changes in US law.
It is now up to the European Commission and probably soon the CJEU to judge the adequacy of the new measures.
1 Executive Order On Enhancing Safeguards For United States Signals Intelligence Activities, The White House, 7 octobre 2022 (Data Privacy Framework)
Oct 03 2023
Oct 02 2023