意大利国际关系学会（IAI）：欧盟-美国数据保护框框：平衡经济安全和隐私考虑

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

1

TheEU–USDataProtection

Framework:BalancingEconomic,

SecurityandPrivacyConsiderations

byFedericaMarconi

Shieldin20162–assertingthattheUSprovidedalevelofdataprotectionfordatatransfersessentiallyequivalenttothatguaranteedintheEU.However,despiteinitialoptimism,bothadequacydecisionsfacedasignificantsetback

whentheCourtofJusticeoftheEuropeanUnioninvalidatedtheminwhatiscommonlyreferredtoasthe“Schremssaga”,3namedafterthe

Therapidevolutionofdigital

technologyhasusheredinadata-

centriceconomy,wheredata

accessibilitydrivesmarketplace

efficiencyandeconomicgrowthacross

variousindustries.However,thisshift,

ontheAdequacyoftheProtectionProvidedbytheSafeHarbourPrivacyPrinciplesandRelatedFrequentlyAskedQuestionsIssuedbytheUSDepartmentofCommerce,

http://data.europa.

eu/eli/dec/2000/520/oj

.

2EuropeanCommission,Commission

ImplementingDecision(EU)2016/1250of12July2016PursuanttoDirective95/46/EContheAdequacyoftheProtectionProvidedbytheEU-U.S.PrivacyShield,

http://data.europa.eu/eli/

dec_impl/2016/1250/oj

.

3CourtofJusticeoftheEuropeanUnion(CJEU),JudgmentoftheGrandChamberinCaseC-362/14:MaximillianSchremsv.DataProtectionCommissioner[SchremsI],6October2015,

https://eur-lex.europa.eu/legal-content/

en/TXT/?uri=celex:62014CJ0362

;andJudgmentoftheGrandChamberinCaseC-311/18:DataProtectionCommissionv.FacebookIrelandLimitedandMaximillianSchrems[SchremsII],16July2020,

https://eur-lex.europa.eu/legal

-

content/en/TXT/?uri=celex:62018CJ0311.

whileofferingnumerousbenefits,

introducessignificantprivacyand

datasecuritychallenges,particularly

inthecontextoftransatlanticdata

transfers.Consideringthevast

economictiesbetweentheEUandthe

US,thetransatlanticdataflowvividly

illustratesthecomplexitiesinvolved

ingoverningandtransferringdata.It

grappleswiththeongoingchallengeof

strikingasatisfactorybalancebetween

economicadvantagesstemmingfrom

datautilisationandvariousconcerns

pertainingtonationalsecurity,digital

sovereigntyandindividualrights.

Inrecentyears,theEuropean

Commissionapprovedtwodifferent

frameworksontransatlanticdataflow

–SafeHarbourin20001andPrivacy

1EuropeanCommission,CommissionDecision

of26July2000PursuanttoDirective95/46/EC

FedericaMarconiisaResearcherintheMultilateralismandGlobalGovernance

ProgrammeattheIstitutoAffariInternazionali(IAI).

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

TheEU–USDataProtectionFramework:

BalancingEconomic,SecurityandPrivacyConsiderations

andmedium-sizedenterprises.6Infact,thevolumeoftransatlanticdataflowexceedsthatofanyotherglobalrelationship,contributingtotherobust7.1trillionUSdollarsUS–EUeconomicpartnership.7

Nevertheless,theregulationofdataexchangebetweentheEUandtheUShasbeenacontentiousmatter,primarilyduetotheirdifferinginterpretationsoffundamentalrightsandvaryingdataprotectionstandards.IntheUS,theoversightofhowcompanieshandleandsecurepersonaldataispredominantlymarkedbytheabsenceofcomprehensivefederallegislation.Thus,privacyanddataprotectionregulationsvaryacrossindustriesandareenforced

bydifferentagencies,resultinginadiverseandfragmentedprivacylandscape.Incontrast,theEUoperatesunderacomprehensivedataprotectionframeworkprimarilygovernedbytheGeneralDataProtectionRegulation(GDPR),whichplacesastrongemphasisonindividualrightsandimposesstringentobligationsondataholdersandprocessors.Tothiseffect,theGDPRunequivocallyforbidsthetransferofpersonaldatatothirdcountrieslacking

Austrianactivistwhofirstchallenged

bothframeworksbeforetheEuropean

Court.Thecoreargumentscentredon

theabsenceofadequatesafeguardsfor

personaldatawithinUSdomesticlaw

andtheextentofstatesurveillanceover

suchdatawhenitwastransferred,as

initiallydisclosedbyEdwardSnowden

in2013.4

Thislegaldevelopmentledtoa

periodofsignificantuncertainty

andfurtherheightenedtheongoing

debateconcerningtheregulationof

transatlanticdatatransfer.Toaddress

theconsequencesofthislegalturmoil,

bothEUandtheUScommittedto

establishing“arenewedandsound

frameworkfortransatlanticdataflows”,5

seekingalong-termsolutiontoaddress

thecomplexitiesofdataprivacyand

security,eventuallyleadingtothe

recentlyadoptedEU–USDataPrivacy

Framework(“DPF”).

Whytransatlanticdataflowsmatter

Dataflowsholdimmensesignificance

forthe

relationship

economicbusinesses

transatlantic

andimpact

6DigitalEurope,GoodNewsforThousandsofBusinesses’:ReactiontoEUAssessmentofUSDataProtectionofPersonalData,10July2023,

https://ww/news/good

-

news-for-thousands-of-businesses-reaction

-

to-eu-assessment-of-us-data-protection-of

-

personal-data

.

7WhiteHouse,FactSheet:UnitedStatesandEuropeanCommissionAnnounceTrans-AtlanticDataPrivacyFramework,25March2022,

/briefing

-

room/statements-releases/2022/03/25/

fact-sheet-united-states-and-european

-

commission-announce-trans-atlantic-data

-

privacy-framework

.

ofallsizesandindustries.Thesedata

exchangesinvolveparticipationfrom

morethan90percentofEUbusinesses

thatconducttransactionswiththeUS,

withanotable70percentbeingsmall

4CasparBowden,TheUSSurveillance

ProgrammesandTheirImpactonEUCitizens’

FundamentalRights,Brussels,European

Parliament,September2013,

https://op.europa.

eu/s/y0iF

.

5EuropeanCommission,CommissionIssues

GuidanceonTransatlanticDataTransfers

andUrgestheSwiftEstablishmentofaNew

FrameworkFollowingtheRulingintheSchrems

Case,6November2015,

https://ec.europa.eu/

commission/presscorner/detail/en/IP_15_6015

.

2

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

TheEU–USDataProtectionFramework:

BalancingEconomic,SecurityandPrivacyConsiderations

departurefromtheEU’sbroadergoalsofadvancingitsdigitalsovereignty.

Restoringtrustinthedigital

environment

InresponsetothelegaluncertaintiesstemmingfromtheCourtofJustice’sdecisions,extensivecollaborationbetweentheUSandtheEUresultedinanagreementinprinciplein2022.Thisagreement,endorsedbyUSPresidentJoeBidenandEuropeanCommissionPresidentUrsulavonderLeyen,reflectedthesharedcommitmenttofacilitatedataflowsbetweenbothjurisdictionsinamannerthatprotectsindividualrightsandpersonaldata.

ExecutiveOrder14086,titled

“EnhancingSafeguardsforU.S.SignalsIntelligenceActivities”,wasissuedbytheBidenadministrationon7October2022.Inconjunctionwiththisexecutiveorder,USAttorneyGeneralMerrickGarlandissuedaRegulationtoestablishaDataProtectionReviewCourt.9Throughtheseactions,theUScommittedtointroducingadditionalprotectivemeasuresaimedataddressingtheconcernsraisedbytheCourtofJusticeregardingmasspersonaldatacollectionandthelackofobjectivecriteriaforlimitingaccesstoandutilisationofthisdatabypublicauthorities.

Inthefollowingmonths,beforefinalisingitsadequacydecisionontheDPF,theEuropeanCommissionsoughttheopinionoftheEuropean

sufficientdataprotectionmeasures

unlesstheEuropeanCommission

issuesadequacydecisionscertifying

whetheracountryconformstothe

requisitestandards.

Consequently,discrepanciesindata

standardshaveledtouncertainties

foreconomicactorsinvolvedin

transatlanticeconomicrelations,

promptingindividualcompaniesto

seekwaystoalignwithEuropean

requirementsandpreventpotential

GDPRviolations.Theseviolationscan

resultinsanctionsofupto4percent

ofthecompany’sannualrevenue,as

exemplifiedbyseveralcasesinvolving

techgiants:Meta,forinstance,received

arecord-breakingGDPRfineof1.3

billionUSdollarslastMay–thelargest

inGDPRhistory.8

Lastly,positionedatthecrossroadsof

dataprotection,internationaltrade

andnationalsecurity,thetopicof

transatlanticdataflowisintricately

linkedtotheEU’sstrategytoassert

digitalsovereigntyandsecurestrategic

autonomy.Thisstrategyplacesa

significantemphasisonthelocalisation

andretentionofdatabelongingto

EuropeancitizenswithintheEU

borders.Thisapproachisdrivenby

thecommitmenttoensurethatdataof

Europeancitizensremainsunderthe

EU’sestablishedlawsandregulations,

whichprioritiseprivacyprotection.

Consequently,eventhoughthenew

frameworkdoesstreamlinethetransfer

ofpersonaldatabetweentheEUandthe

US,itcangiverisetoconcernsabouta

9USCodeofFederalRegulation,Part201:DataProtectionReviewCourt,

/

current/title-28/part-201

.

8EuropeanDataProtectionBoard,1.2Billion

EuroFineforFacebookasaResultofEDPB

BindingDecision,22May2023,

https://edpb.

europa.eu/node/6052

.

3

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

TheEU–USDataProtectionFramework:

BalancingEconomic,SecurityandPrivacyConsiderations

tovalidlyjustifygovernmentintrusionintoprivacy.Consequently,thisraisedconcernsaboutthepossibilityoftheCJEUinvalidatingtheDPF,asithaddonewithpreviousframeworks.

Despitetheseconcerns,on10July,theEuropeanCommissionadoptedtheadequacydecisionontheDPF,

confirmingthatitadequatelevelof

providedprotection

anfor

personaldata.Consequently,personaldatacannowmovefreelyfromtheEUtoUScompaniesthathaveself-certifiedtheiradherencetotheDPFprinciples.UrsulavonderLeyenstatedthatthenewframeworkwill“ensuresafedataflowsforEuropeansandbringlegalcertaintytocompaniesonbothsidesoftheAtlantic”,12while

strengtheningeconomictiesandreaffirmingsharedvalues.PresidentJoeBidenalsowelcomedtheadequacydecision,emphasisingthejointEU–UScommitmenttorobustdataprivacyprotectionsandforeseeingincreasedeconomicopportunitiesforbothjurisdictionsandtheircompanies.

Thirdtime’sacharm?

Onapositivenote,theDPFnowallowsforthetransferofpersonaldatafromtheEUtotheUSthroughacertificationsystem.UScompaniescommittoasetofprivacyprinciples,eliminatingtheneedforadditionaltransfermechanismslikeStandardContractualClausesorbindingcorporaterules,aswellastransferimpactassessments.

DataProtectionBoard(EDPB)onthe

draftdecision.10TheEDPBrecognised

theimprovementsbroughtaboutby

ExecutiveOrder14086,particularlyin

termsofrestrictingaccesstoEUdata

byUSintelligenceservicestowhatis

necessaryandproportionatetoprotect

nationalsecurity.Nevertheless,it

expressedseveralconcerns,including

thoserelatedtoinadequateassurances

regarding“temporarybulkcollection”

andthesubsequentstorageandsharing

ofdatacollectedinbulkwithintheUS

legalframework.Additionally,on11

May,theEuropeanParliamentconveyed

itsreservationsregardingthecontent

oftheDPF.11Whileacknowledgingthat

thecapacitytotransferpersonaldata

acrossbordershas“thepotentialtobe

akeydriverofinnovation,productivity

andeconomiccompetitiveness”,the

Parliamentunderscoredthecritical

necessityforrobustsafeguardstobe

firmlyestablished.Thesesafeguardsare

essentialforprotectingprivacyrights,

preventingillegalmasssurveillance

bytheUSandrestoringthetrustof

bothEUcitizensandbusinessesin

digitalservices,ultimatelypreserving

thevitalityofthedigitaleconomy.

TakingintoconsiderationtheCJEU’s

reasoninginSchremsII,theEuropean

ParliamentcontendedthattheDPFdid

notentirelymeetEUlegalstandards

duetoitslackofan“objectivecriterion”

10EuropeanDataProtectionBoard,Opinion

5/2023ontheEuropeanCommissionDraft

ImplementingDecisionontheAdequate

ProtectionofPersonalDataundertheEU-US

DataPrivacyFramework,28February2023,

https://edpb.europa.eu/node/5132

.

12EuropeanCommission,DataProtection:EuropeanCommissionAdoptsNewAdequacyDecisionforSafeandTrustedEU-USDataFlows,10July2023,

https://ec.europa.eu/commission/

presscorner/detail/en/ip_23_3721

.

11EuropeanParliament,Resolutionof11May

2023ontheAdequacyoftheProtectionAfforded

bytheEU-USDataPrivacyFramework,

https://

www.europarl.europa.eu/doceo/document/TA-

9-2023-0204_EN.html

.

4

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

TheEU–USDataProtectionFramework:

BalancingEconomic,SecurityandPrivacyConsiderations

transactionsorvoluntarydatasharingagreements.

PrivacyactivistMaxSchremsarguesthatthenewframeworkis“largelyacopy”ofpreviousones.14TheUSDepartmentofCommercealsoconsidersthatit“doesnotcreatenewsubstantiveobligationsforparticipatingorganizationswithregardstoprotectingEUpersonaldata”and“[t]heprivacyprinciplesandtheprocesstoinitiallyself-certifyandannuallyre-certifyremainsubstantivelythesame”.15Moreover,SchremsstressesthatsubstantialchangesinUSsurveillancelawareneededfortrueeffectivenessandhassignalledhisintentiontobring“thenewdealbackbeforetheCJEU”.16

Alegalchallengehasthereforebeenannounced,possiblyreachingtheCJEUbylate2023orearly2024whichmayresultinatemporarysuspensionoftheDPF.WhileEUJusticeCommissionerDidierReyndersremainsconfidentintheframework’sresilienceagainstlegalchallenges,manycompaniesarechoosingtostickwithEU-approvedstandardcontractualclausestomaintainGDPRcompliance,despitetheassociatedchallengesandexpenses,inthefaceofongoingrisksanduncertainties.

Companiesarerequiredtocomplete

theirself-certificationbyOctober

2023tobeincludedontheDPFList,

maintainedbytheUSDepartment

ofCommerce.Additionally,the

DPFintroducesvarioussafeguards,

suchasrestrictingUSsurveillance

accesstodatathatis“necessaryand

proportionate”fornationalsecurity,

theestablishmentofaDataProtection

ReviewCourttoaddressconcerns

aboutaccesstopersonaldatabyUS

intelligenceagenciesandmandating

UScompaniestodeletepersonaldata

whenitisnolongerneededforthe

originalpurposeofcollection.

Despitesignificantprogress,however,

thepathtowardsestablishingastable

andreliableframeworkfortransatlantic

datatransfersremainsfraughtwith

difficulties.Persistentconcernsrevolve

aroundhowtheUSwillinterpretthe

conceptof“proportionate”accessto

databyUSauthoritiesanditsadherence

totheCJEU’scriteria.

14NOYB,EuropeanCommissionGivesEU-USDataTransfersThirdRoundatCJEU,10July2023,

https://noyb.eu/en/node/1324

.

15DataPrivacyFrameworkProgramwebsite:

FAQs-EU-U.S.DataPrivacyFramework(EU-U.S.DPF),lastupdated17July2023,

https://

www.dataprivacy/s/article/

FAQs-EU-U-S-Data-Privacy-Framework-EU-U

-

S-DPF-dpf

.

16NOYB,EuropeanCommissionGivesEU-USDataTransfersThirdRoundatCJEU,cit.

Moreover,thereareconcernsabout

theDataProtectionReviewCourt’s

composition:whilemadeupofmembers

fromoutsidetheUSgovernment,there

aredoubtsaboutitsappointment

process,leadingtopotentialissueswith

fairandtransparentdecision-making.

Furthermore,theEuropeanParliament

hashighlightedanadditionalweakness

intheframework,whichliesinits

failuretoaddressdataaccessedby

publicauthoritiesthroughalternative

avenues.13Thisincludesmethodssuch

astheUSCloudActortheUSPatriotAct,

dataacquisitionthroughcommercial

13EuropeanParliament,Resolutionof11May

2023,cit.

5

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

TheEU–USDataProtectionFramework:

BalancingEconomic,SecurityandPrivacyConsiderations

Strikingthedelicatebalancebetween

privacyconcerns,freetradeimperatives

andnationalsecurityinterestswithin

therealmofdataremainsaformidable

challenge,althoughrecenttrends

aroundtransatlanticdataflowsare

encouraging.TheSchremssagahas

vividlyhighlightedtheimperative

tobridgelegaldisparitiesbetween

theEUandtheUS,emphasising

theimportanceofcreatingadigital

internationalenvironmentfounded

ontrust,cooperationandregulatory

alignment.

19September2023

6

IAICOMMENTARIES23|46-SEPTEMBER2023ISSN2532-6570©2023IAI

TheEU–USDataProtectionFramework:

BalancingEconomic,SecurityandPrivacyConsiderations

IstitutoAffariInternazionali(IAI)

TheIstitutoAffariInternazionali(IAI)isaprivate,independentno