A large-scale US intelligence surveillance scandal (PRISM and UPSTREAM) was unveiled by Edward Snowden in 2013. The US authorities were indiscriminately collecting, storing and analysing data on an unprecedented scale. This was found to be in violation of EU rules governing the rule of law, and the data protection and fundamental rights of at least 447 million citizens living in the EU. The scandal rocked transatlantic relations, security cooperation, and the trust of individuals and consumers in the digital economy. The breakdown in trust reverberated through the EU institutions.
In the space of five years, two legal cases before the Court of Justice concerning breaches of EU law were commenced by Maximilian Schrems (Schrems I and Schrems II). Twice, EU-US data sharing arrangements for ‘data transfers’ were struck down by the Luxembourg Court, arresting a 7.1 trillion dollar market and impacting the world’s largest bilateral trade and investment relationship and most integrated economic relationship.
The result of the rulings however has been legal uncertainty and mistrust. Individuals are still not sure if their rights are protected and lack avenues to seek legal redress because the US surveillance program continues to operate, and there is no current EU-US arrangement. And over 5,000 companies (and privacy-compliance professionals) are not clear on how data transfers can be carried out lawfully to protect their clients’ rights, which leaves them vulnerable to liability and hefty penalties under the EU General Data Protection Regulation (GDPR). Trade and diplomatic relations between the EU and US as ‘strategic partners’ have been fraught. And the implications reach far beyond those territories.
A new arrangement was agreed in March 2022, and it was followed by an Executive Order signed by US President Joe Biden on 7 October 2022. The European Data Protection Board (EDPB) issued its Opinion on 28 February 2023, and the European Parliament prepared its views on the new arrangement too. The new European Commission Adequacy Decision (EU-US Data Privacy Framework) was published in July 2023.
In such a dynamic and changing context, a new Task Force led by the Centre for European Policy Studies (CEPS) generating cutting edge research and evidence and providing an independent platform for knowledge-exchange and multi-actor interactions, will prove to be highly useful in conjunction with the unravelling of these highly-anticipated policy developments.
The new CEPS Task Force has the following four objectives:
- To assess the new EU-US Data Privacy Framework and the European Commission’s Decision
- examining its scope, key features and expected impacts;
- comparing it to the previous arrangements in light of key fundamental rights and rule of law benchmarks in EU and international law;
- analysing whether it will satisfy EU standards and the Court of Justice’s legal tests; and
- outlining the expected impacts of the arrangement to companies of all sizes in the US and EU covering small and medium-sized enterprises, and national regulators responsible for data protection in the EU.
- To show how the new arrangement relates to the wider international and EU legal context,
namely:- other relevant international agreements and arrangements;
- other related EU law as well as ongoing EU legislative proposals; and
- assessing how those instruments taken together ensure coherency, consistency and legal
- To explore:
- the current key issues for companies, regulators, and consumers;
- whether the authorised framework could foster a Luxembourg Court-proof, merited trust enhancing and a principled level-playing field in the private and public sectors – for both companies, the EU and US authorities and digital citizens; and
- highlight outstanding issues and dilemmas for companies in the US and Europe, including small and medium enterprises.
- To generate evidence-based policy recommendations.
Please see the links below for the full prospectus.
The first meeting of the Task Force will finally take place online on the 7 December between 13.00 and 16.00 (CET). You can access the meeting agenda under the “Downloads” section.
For further information, please send an e-mail to: [email protected]
