Data transfer to the USA: Data protectionists consider new rules on data transfer to be insufficient

"US President Joe Biden has promised the EU to improve data protection. Data protection officer Stefan Brink now finds that this is not enough.

Companies will have to wait even longer for a viable solution for their transatlantic data traffic. This is the result of an internal assessment by Baden-Württemberg's data protection officer, Stefan Brink.

He does not assume that the decree recently presented by American President Joe Biden will stand up to the strict requirements of the European Court of Justice (ECJ).

Even under the new rules, mass surveillance is still possible, criticized Brink. In its “Schrems II” judgment more than two years ago, the ECJ not only demanded legal remedies against state spying, but also a complete end to surveillance without cause. "But there can be no question of that at the moment," emphasizes the data protection officer. "The system change requested by the ECJ is not taking place."

Just a regulation, not a law

Brink also complained that Biden had only issued an executive order around two weeks ago and had not introduced any law. It is only an internal instruction to the government and subordinate authorities and can be changed or withdrawn at any time by the next president. Without a law passed by parliament, there would be no legal certainty for all those involved. 

"In order not to lose Europe as an important trade and business partner in the long term, the USA must move towards the European Commission and the European data protection principles," Brink demanded.

With the enacted regulation, the American President is implementing an agreement with the European Commission from March. In it, both sides have agreed on a new data protection framework that allows companies to transfer their data in a legally secure manner. This had become necessary because the ECJ had declared the previously valid EU-US Privacy Shield invalid in its landmark decision. Since then, data can no longer be transmitted on this legal basis.

The decree now introduces a two-stage procedure. European citizens can first contact a special officer who is an independent body to investigate complaints and take action. At a second level, a "data protection review court" comes into play, which consists of at least six independent people and should also have two data protection lawyers.

"Clear progress for securing international data transfers"

In his assessment, Brink did not spare his criticism of the EU Commission, which has announced that it will now initiate the procedure for an equivalence decision. This would make it clear that the rules in the USA largely correspond to the European requirements. Against the background of the points of criticism mentioned, this behavior is “astonishing”, says the data protection officer.

In doing so, the Commission is accused of once again allowing the fundamental rights of EU citizens to take second place to the economic interests of European and American companies.

The German digital industry, on the other hand, assessed the American development much more positively. "The executive order from US President Joe Biden is clear progress in securing international data transfers," said Susanne Dehmel, member of the management board of the digital association Bitkom. She emphasized the importance of a follow-up agreement to the Privacy Shield. “The individual case checks that are currently necessary are still a major burden for the economy, especially for small and medium-sized companies. They need legal certainty so that the existing data blockade can finally be resolved.” Data transfers are an essential part of the entire economy and also of science. "The impediment or even prevention of data transfers is at least as serious for German and European companies as the interruption of supply chains," explained Dehmel."