On 7 April, the European Data Protection Board (EDPB) adopted a statement on the announcement of a new international data transfer agreement between the EU and the US (the Statement). With its Statement, the EDPB welcomes the commitments made by the US to establish ‘unprecedented’ measures to “protect the privacy and personal data of individuals in the European Economic Area (EEA) when their data are transferred to the US” as a positive first step in the right direction.

The EDPB states that at this stage, this announcement does not constitute a legal framework on the basis of which EEA data exporters can transfer data to the US. Therefore, data exporters “must continue taking the necessary actions to comply with the case law of the Court of Justice of the European Union (CJEU), and in particular its Schrems II decision of 16 July 2020”.

The EDPB looks forward to assessing carefully the improvements that the new EU-US agreement may bring in light of EU law, the case law of the CJEU case law and the previous recommendations the EDPB has made.

In addition, the EDPB notes that it will prepare its opinion once it receives all supporting documents from the European Commission, in which it will analyse whether these reforms guarantee that the collection of personal data for national security purposes is limited to what is strictly necessary and proportionate. In the Statement, the EDPB further indicates that it will examine the extent to which the announced independent redress mechanism respects the EEA individuals’ right to an effective remedy and to a fair trial.

Finally, the EDPB restated that it remains committed to playing a constructive role in securing transatlantic transfers of personal data that benefit EEA individuals and organisations.

The EDPB statement can be found here.

The EDPB press release can be found here.