The European Parliament announced, on 11 May 2023, that it had adopted a resolution opposing the adoption of an US Adequacy Decision under the EU-US Data Privacy Framework ('DPF'). In particular, the Parliament highlighted that according to the resolution, the EU-US DPF is an improvement on previous frameworks, but does not provide for sufficient safeguards.

More specifically, the Parliament noted that the Members of the European Parliament ('MEPs') outlined issues surrounding bulk collection, including that the EU-US DPF still allows for bulk collection of personal data in certain cases, does not make bulk data collection subject to independent prior authorisation, and does not provide for clear rules on data retention. Moreover, the Parliament detailed that the MEPs also raised concerns regarding the Data Protection Review Court's ('DPRC') decisions being secret, and thus violating citizens' right to access and rectify data about them, as well as the U.S. President's ability to dismiss DPRC judges and overrule their decisions, concluding that the DPRC would not be truly independent.

To this end, the Parliament provided that the MEPs emphasised that the framework for data transfers must be 'future-proof', and the assessment of adequacy must be based on the practical implementation of rules, noting that the U.S. Intelligence Community is still updating its practices based on the EU-US DPF and that therefore, an assessment of its impact on the ground is not yet possible. Finally, the Parliament highlighted that the MEPs urged the European Commission to ensure that the future framework can withstand legal challenges and provide legal certainty to EU citizens and businesses, providing that the Commission should not grant an adequacy decision based on the current regime and should instead negotiate a data transfer framework that is likely to be held up in court.

You can read the press release here.