‘Not any time soon’, says EU Data Protection Supervisor.

Business people who had hoped that the EU and the new US administration would soon conclude a new Transatlantic data transfer pact to replace the EU/US Privacy Shield, which was annulled by the European Court of Justice (EUCJ), will probably have a long time to wait. That is, at least, according to the European Data Protection Supervisor Wojciech Wiewiórowski.

The EU/US Privacy Shield, the last data transfer agreement concluded by Washington and Brussels, was overturned by Europe’s highest court last summer because, in the court’s view, the US intelligence services have surveillance capabilities that are too extensive.
See also our blog article: “What to do after the toppling of the EU-US Privacy Shield?”

It is expected that the new administration of the freshly elected US President Joe Biden will initially have another set of priorities than drawing up a new data transfer pact.

And what happens in the meantime?

Since the end of 2020, the European Union has been searching for other ways to find a workable basis for data transfers with the US. For example, the EU Commission has drawn up new standard contractual clauses for the transfer of personal data to third countries, the final adoption of which is expected soon. These contain more specific safeguards in the event that the laws of the country of destination (to which the data is sent) allow its authorities to disclose personal data.

However, the Commission has clarified that even when using the new clauses, supplementary measures may be necessary to adequately protect the transferred data from unrestricted access by the security authorities in a specific individual case. In the case of the USA, these measures are necessary in any case, due to the far-reaching access possibilities of the security authorities.

Therefore, even if the new standard contractual clauses are used, an appropriate concept should be coordinated with the data protection authorities in advance of any future data transfers to the USA. So the silver bullet is still a long way off.

In a nutshell:

What is certain is that nothing is certain: Until a new data protection pact is agreed between the EU and the US, the transfer of personal data remains legally uncertain.