EU-US transfer framework to replace the Privacy Shield?

 

Created with Microsoft Bing Image Creator powered by DALL-E

           President Biden signed a new European Union - United States transfer framework which will replace the Privacy Shield framework that EU courts had struck down. The Privacy Shield framework, which until two years ago governed rules over personal data flows from the EU to the US to ensure they met GDPR requirements, was invalidated by the Court of Justice of the EU's "Schrems II" decision. The court found that US surveillance programs went beyond what was 'strictly necessary and proportional', and moreover did not have any means of effective remedy for EU data subjects. Since this ruling, with the absence of any framework for data transfers from the EU to the US, such data transfers have become a legal grey zone, with much confusion and legal costs for US tech firms. The new changes in the framework include a change in the definition of 'personal data' to that which the GDPR uses (information that relates to an identified or identifiable individual), a new redress system (including a new Data Protection Review Court) for complaints regarding surveillance activities, and the imposing of necessity and proportionality limits for government surveillance as well as oversight mechanisms. However, this new framework is not in action yet, as it must go through an adequacy determination from the European Commission. 

            For canadian-based commercial organizations, since Canada is included as a country with an adequate (by GDPR standards) level of protection for personal data, there is no current worry about the legal grey zones plaguing US companies seeking to transfer EU data to the US due to the invalidation of the Privacy Shield. However, this ongoing development does demonstrate how data protection and privacy will continue to progress globally, if only to enable data transfers from the EU.