DP News – Week 44. Is ‘Schrems-III’ now just a matter of time?

Recently, in the Week 41 DP News release, DPOrganizer has already highlighted the developments covering Trans-Atlantic Data Privacy Framework and the U.S. President Joe Biden’s Executive Order “On Enhancing Safeguards For United States Signals Intelligence Activities”. Following that, Max Schrems voiced his concerns about the upcoming framework, mentioning that core issues previously raised in so-called ‘Schrems-I’ and ‘Schrems-II’ cases were not really solved, and this means that those will be back to the CJEU again sooner or later.

Now it turns out that it is not only Noyb.eu’s chairman who feels unhappy. The first data protection authority (DPA) in the EU, that of the German state of Baden-Wuerttemberg, has now also expressed its concerns as to the Executive Order serving as a basis for a new adequacy decision for EU-U.S. data transfers. In its statement published on 26 October, the DPA of Baden-Wuerttemberg tends to believe that the Executive Order fails to comply with the surveillance law standards accepted in the EU and ‘leaves many questions unanswered’.

In particular, the state commissioner raised the following issues:
– It is unclear to what extent the Executive Order can effectively implement the GDPR requirements as it ‘represents an internal instruction to the government and subordinate authorities and is not a law that has been passed by parliament and is therefore final’;
– Compliance with the EO is not legally enforceable, especially for EU citizens, and it is unclear how it relates to other existing U.S. regulations such as the Cloud Act;
– The legal concept of proportionality differs in Europe and the USA, so that it remains unclear when, from the USA’s point of view, access for the purpose of national security remains permissible;
– Significant requirements are placed on EU citizens filing complaints, while complainants are not informed whether they have been subject to intelligence activities by the U.S.;
– The Data Protection Review Court will be set up by order of the Minister of Justice and will, thus, lack independence.

As part of the procedure for an adequacy decision, the EDPB will provide its opinion on the draft decision. Being non-binding by nature, the opinion will still be of great interest for privacy practitioners as it might well raise the same or similar concerns already raised by Max Schrems and by the DPA of Baden-Wuerttemberg.