"Privacy Shield 2.0"? - First Reaction by Max Schrems
Today Commission President Ursula von der Leyen and President Biden have announced an "agreement in principle" on a new EU-US data sharing system.
Some facts upfront:
- There is only a political announcement, not a text that can be analyzed. As far as noyb is informed, such a text does not exist yet and will take a couple of months to be drafted.
- This is probably meant by an "agreement in principle": lawyers still have to find solutions to the problems raised by the Court of Justice (CJEU). So far no fully functioning solutions were delivered despite two years of discussions.
- What noyb hears is that the US is not planning to change its surveillance laws, but only foreseen executive reassurances (using EU language like "proportionality"). It is unclear how this would remotely pass the test by the CJEU, as US surveillance was already held not to be "proportionate" by the CJEU. Previous agreements failed twice in this respect.
- There seems to be no update to the "Privacy Shield" principled for commercial data usage, despite the coming into force of the GDPR since the passing of Privacy Shield.
- Any new deal would not be a bilateral agreement, but an executive decision by the European Commission, that would have to be reviewed by the European Data Protection Board (EDPB) first. This process can only be initiated once there is a legal text. An actual "adequacy decision" would therefore need a couple more months.
- Companies cannot use a deal until it is formally passed, which will take months.
- A decision can quickly be challenged with the European Court of Justice. noyb expects to be able to get any new agreement that does not meet the requirements of EU law back to the CJEU within a matter of months e.g. via civil litigation and preliminary injunctions. The CJEU may even take preliminary action, if a deal is clearly violating previous judgements.
- Overall a political announcement without a solid text, seems to generate even more legal uncertainty for the time being.
Statement:
"We already had a purely political deal in 2015 that had no legal basis. From what you hear we could play the same game a third time now. The deal was apparently a symbol that von der Leyen wanted, but does not have support among experts in Brussels, as the US did not move. It is especially appalling that the US has allegedly used the war on Ukraine to push the EU on this economic matter."
"The final text will need more time, once this arrives we will analyze it in depth, together with our US legal experts. If it is not in line with EU law, we or another group will likely challenge it. In the end, the Court of Justice will decide a third time. We expect this to be back at the Court within months from a final decision."
"It is regrettable that the EU and US have not used this situation to come to a 'no spy' agreement, with baseline guarantees among like-minded democracies. Customers and businesses face more years of legal uncertainty."
- Max Schrems, Honorary Chairman of noyb and lead litigant in the "Schrems I" and "Schrems II" cases before the CJEU.
