Statement on US Adequacy Decision by the European Commission
Today, the European Commission issued a new adequacy decision replacing the"Privacy Shield" decision, that was previously invalidated by the Court of Justice of the EU (CJEU) over US surveillance. The CJEU required (1) that US surveillance is proportionate within the meaning of Article 52 of the Charter of Fundamental Rights (CFR) and (2) that there is access to judicial redress, as required under Article 47 CFR. Updated US law (Executive Order 14086) seems to fail on both requirements, as it does not change the situation from the previously applicable PPD-28. There is continuous "bulk surveillance" and a "court" that is not an actual court. Therefore, any EU "adequacy decision" that is based on Executive Order 14086 will likely not satisfy the CJEU.
As highlighted in noyb's earlier statement on the US Executive Order 14086, the changes in US law seem rather minimal. Certain amendments, such as the introduction of the proportionality principle or the establishment of a Court, sound promising - but on closer examination, it becomes obvious that the Executive Order oversells and underperforms when it comes to the protection of non-US persons. It seems obvious that any EU "adequacy decision" that is based on Executive Order 14086 will likely not satisfy the CJEU. This would mean that the third deal between the US Government and the European Commission may fail.
Max Schrems: "We will analyze the draft decision in detail the next days. As the draft decision is based on the known Executive Order, I can't see how this would survive a challenge before the Court of Justice. It seems that the European Commission just issues similar decisions over and over again - in flagrant breach of our fundamental rights."
The draft decision will now be reviewed by the European Data Protection Board (EDPB) and the European Member States. However, even negative statements by the EDPB and Member States are not binding on the Commission. Once the decision is published, European companies can rely on it when sending data to the US. The final decision is not expected before spring 2023. Users can then challenge the decision via national and European courts.
