-p-800.jpg)

President Biden Signs Executive Order Establishing New Framework for Data Transfers From the EU to the U.S.

The Executive Order on Enhancing Safeguards for United States Signals Intelligence Activities, signed by President Biden on October 7, provides further clarity about the Trans-Atlantic Data Privacy Framework (“the Framework”), announced in March 2022. The Framework is a new instrument to support the lawful data transfer between the European Union and the US. The Order and the Framework provide certainty about the legal basis for such transfers that has been absent since 2020. This was when the European Court of Justice (“ECJ”) declared the EU-U.S. Privacy Shield invalid.

Requirements for lawful transatlantic transfer mirror those of the Privacy Shield. The Order does not impose new obligations. Instead, it addresses the ECJ’s concerns about the Privacy Shield as they relate to government surveillance. These concerns include the lack of an adequate redress mechanism for EU individuals who may have been subject to such surveillance. The Order therefore outlines steps that government – not companies – must take.

Two-Tier Redress Mechanism to Address Complaints of Alleged Violations

The framework enhances protections for EU residents with respect to the activities of such agencies by restricting U.S. processing of EU data subjects’ personal data. It also establishes a two-tier redress mechanism to address complaints of alleged violations. In the first step, “EU individuals will be able to lodge a complaint with the so-called ‘Civil Liberties Protection Officer' of the US intelligence community (the Officer).” In the second, EU individuals would have the right to appeal the decision of the Officer to the newly-created Data Protection Review Court (DPRC).

Members from outside the U.S. government will comprise the DPRC, appointed based on specific qualifications. They can only face dismissal for serious cause. Significantly, they cannot receive instructions from the government.

The DPRC “will have powers to investigate complaints from EU individuals, including to obtain relevant information from intelligence agencies, and will be able to take binding remedial decisions. For example, if the DPRC would find that data was collected in violation of the safeguards provided in the Executive Order, it will be able to order the deletion of the data.”

The framework, explained in detail in a Fact Sheet released by the White House, must now be ratified by the European Data Protection Board, the European Parliament, and the European Commission. Following ratification, the framework is expected to come into effect in March 2023.

PRIVACY BLOG

New Fine Highlights the Necessity of EU-GDPR Article 27 Representation for US Companies](/content/blog/article-27-representation/index.html)

The Data Use and Access Act 2025 (DUAA) Key Changes to Data Protection Law](/content/blog/the-data-use-and-access-act-2025-duaa-key-changes-to-data-protection-law/index.html)

Privacy Compliance: Why Software Solutions Could Put You at Risk](/content/blog/privacy-compliance-why-software-solutions-could-put-you-at-risk/index.html)

The Troubling Cuts to Medical Research](/content/blog/the-troubling-cuts-to-medical-research/index.html)

ARE YOU CREATING PRIVACY ISSUES WITH AI?](/content/blog/are-you-creating-privacy-issues-with-ai/index.html)

European Commission Publishes New Standard Contractual Clauses and Guidance on Implementation](/content/blog/standard-contractual-clauses/index.html)

Dutch Data Protection Authority Fines Uber for Storing Personal Data in U.S. Without Required Protections](/content/blog/dutch-data-protection-authority-fines-uber-for-storing-personal-data-in-u-s-without-required-protections/index.html)

New York State Attorney General’s Office Issues Guidance on Tracking Technologies and Privacy](/content/blog/new-york-state-attorney-generals-office-issues-guidance-on-tracking-technologies-and-privacy/index.html)

Spanish Data Authority Fines Data Processor for Failure to Assess and Address Risks of Security Breach](/content/blog/spanish-data-authority-fines-data-processor-for-failure-to-assess-and-address-risks-of-security-breach/index.html)

Connecticut Attorney General’s Office Releases Report on New Data Privacy Law](/content/blog/connecticut-attorney-generals-office-releases-report-on-new-data-privacy-law/index.html)

Data Protection Commissioner of Ireland (DPC) Investigation Focuses on Location Data
The DPC recently wrote to inform data controllers who may be in receipt of or sharing location data that it has initiated the regulatory assessment. It also notified organizations linked to those whose activities are the subject of the DPC assessment and stressed that failure to meet statutory obligations pertaining to processing of location data will result in regulatory action.