On 11 May 2023 the European Parliament adopted a resolution against an EU adequacy decision on the grounds of the United States (US) Data Privacy Framework (Framework) in its current form. This is an unsurprising move, given the well-reported misgivings of the European Parliament. As previously mentioned, although the resolution is not legally binding on the EU Commission, it will be considered alongside the EDPB opinion.
Some key concerns from the resolution are:
- That bulk collection of personal data is still possible under the Framework, with a lack of adequate safeguards.
- Whether oversight is truly independent given that the Data Protection Review Court’s decisions are not public and the President retains the right to remove judges.
- Possible invalidation of the Framework by the Court of Justice of the European Union, as occurred with the adequacy decisions which came before it, which could lead to a ‘continuing lack of legal certainty, further costs and disruption for European citizens and businesses.’
This resolution, along with the opinion of the EDPB have the potential to delay matters if the EU Commission takes action to address the concerns raised. Conversely, if the concerns are not addressed, the adequacy decision may go through more quickly, but will it be long before challenges are raised as to its validity?
There have been suggestions that, with elections approaching, the US may be willing to give a little more ground to secure the adequacy decision as political capital, but only time will tell if this is the case.
A copy of the resolution can be found here.
