The battle for data transfer to the United States is not over

Immediately after the deal was announced, privacy activist Max Schrems was already there like the chickens. He predicts, among other things, a process of several months before a final legal agreement is reached. He has also already announced that he will seek a Schrems III ruling from the European Court of Justice. And you know: he won the first two rounds at the European Court with flying colors.

The EDPS now goes further in his statement. First, the EDPB informs the Commission that it must first seek a preliminary opinion from the EDPB on the legal agreement. Secondly, the EDPS warns that he will then be “in detailwill examine whether the new agreement ensures that data collection for national security purposes in the United States is limited to what is “strictly necessary” and “proportionate”.

The EDPS then comes to the heart expressed by the European Court in the Schrems II judgment. I take the liberty of first quoting this core from the official English message of the EDPB itself:

the EDPS will also examine the extent to which the announced independent redress mechanism respects the right of EEA individuals to an effective remedy and to a fair trial. In particular, the EDPS will examine whether any new authority forming part of this mechanism has access to relevant information, including personal data, in the exercise of its mission and can adopt decisions binding on the intelligence services. The EDPS will also examine whether there is a judicial remedy against the decisions or inaction of this authority.

In short, the EDPS will focus on whether EU citizens now really have rights that they can enforce in court against the US administration. Because the European Court established in the Schrems II judgment that this was in no way the case under Privacy Shield (for enthusiasts: see legal consideration 181 of the judgment).

Finally, I noticed something in the AP press release regarding the EDPB statement. After all, we’re still eagerly awaiting Google Analytics’ decision from the watchdog, which also has this transmission problem. And we’ve already seen that the EU watchdogs who have already made this decision take the position that further action by Google does not solve the problem of US law. And thus banned Google Analytics.

But the AP press release seems to leave the door ajar. Just read:

Currently, US laws do not sufficiently protect the personal data of Europeans. (…) Since the end of the Privacy Shield, it is only possible for organizations to export personal data from the EU to the United States if they (…) guarantee additional additional measures that this personal data is safe. If this (…) fails, the transfer of personal data to the United States is not permitted.

I actually read in there that the AP thinks that with the right, additional measures, a transfer to America is indeed possible. I wonder if more people are reading this.

But one conclusion is now clear. †Never a dull momentin the battle for American transfers, andthe saga continues† So I will definitely come back to AG Connect.