The European Data Protection Board ('EDPB') published, on 28 February 2023, Opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework ('EU-US DPF'). In particular, the EDPB welcomed the improvements under the EU-US DPF, but highlighted some concerns.

You can read the full story here.

Data protection authorities and government bodies

Germany - BfDI

The Federal Commissioner for Data Protection and Freedom of Information ('BfDI') issued, on 28 February 2023, a statement in which it welcomed the improvements of the EU-US DPF compared to the previous mechanism, the Privacy Shield, whilst also sharing the areas of concern expressed by the EDPB. In particular, the BfDI highlighted the progress made, including the establishment of a new redress mechanism to provide effective legal protection for data subjects in the EU.

However, the BfDI expressed concern as to whether the EU-US DPF guarantees a level of protection that is essentially equivalent to EU data protection standards. Further, the BfDI noted that it shares the EDPB's concern on the mass collection of data, for which neither an independent prior control nor a systematic independent subsequent review by a court or an independent body is provided.

You can read the press release, only available in German, here.

Hamburg - HmbBfDI

The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI') issued, on 1 March 2023, a statement in which it supported the EDPB's position on the EU-US DPF draft adequacy decision. In particular, the HmbBfDI noted that the issuance of the finalised adequacy decision is now expected and commented that the same would create urgently needed legal certainty and would be a success for data protection, despite some points that could be improved. In particular, the HmbBfDI outlined that, in the course of the negotiations, the US made unprecedented concessions and adapted its national security law to European fundamental rights standards.

However, the the HmbBfDI commented that the adequacy decision cannot be a carte blanche, highlighting that only the EU-US DPF implementation in practice can show whether and to what extent intelligence activities are actually reduced to a proportionate level and whether effective legal protection is guaranteed. As such, the HmbBfDI pointed out that it will be the responsibility of the European data protection authorities and the European Commission to monitor the situation, and the task of the U.S. administration to enable in-depth audits.

You can read the statement, only available in German, here.

Estonia - DPI

The Data Protection Inspectorate ('DPI') issued, on 1 March 2023, its statement on the EDPB's opinion, noting that although significant improvements have been made compared to the previous adequacy decision, a number of shortcomings in the US enforcement regime remains. In particular, the Head of International Law at the DPI, Kirsika Berit Reino, stated that questions remain in the area of judicial protection, and that the EDPB is doubtful whether the pre-judicial and judicial institutions established under the U.S. Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities are independent in their decision-making, and whether the established institutions' complaint review process is adequate. Notably, the DPI highlighted that similar shortcomings were pointed out by the European Parliament's Committee on Civil Liberties, Justice and Home Affairs ('LIBE') in its draft motion presented on 14 February 2023.

You can read the statement, only available in Estonian, here.

Portugal - CNPD

The Portuguese data protection authority ('CNPD') issued, on 1 March 2023, a statement summarising the opinion of the EDPB on the EU-US DPF. In particular, the CNPD noted that the EDPB will be heard on 1 March 2023 at the European Parliament, in the LIBE Committee, regarding the proposal for an implementing decision by the European Commission, presented in December 2022, under Article 45 of the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR').

You can read the press release, only available in Portuguese, here.

Denmark - Datatilsynet 

The Danish data protection authority ('Datatilsynet') issued, on 28 February 2023, a statement in which it summarised the EDPB's opinion on the EU-US DPF and noted that the opinion is of an advisory nature only, which must now be assessed by the European Commission. Additionally, the Datatilsynet reminded that the European Parliament must also issue a non-binding opinion of its own, after which the European Commission must submit its draft adequacy decision to the Article 93 Committee, which consists of representatives of the Member States' Governments (in Denmark that is the Ministry of Justice), before the European Commission can finally adopt the decision.

You can read the press release, only available in Danish, here.