DP News – Week 8. The EU Commission is looking to harmonize the enforcement approaches among national supervisory authorities, the EDPB’s decision on Meta’s EU-U.S. data transfers is expected by mid-April.

In Q2 2023, the European Commission is planning to introduce a fresh piece of legislation designed to enhance the GDPR enforcement by privacy regulators in the EU member states. Currently, this initiative has the status of ‘proposal for a regulation’.

As the summary at the EU Commission’s official website explains, “This initiative will streamline cooperation between national data protection authorities when enforcing the General Data Protection Regulation (GDPR) in cross-border cases. To this end, it will harmonise some aspects of the administrative procedure the national data protection authorities apply in cross-border cases. This will support a smooth functioning of the GDPR cooperation and dispute resolution mechanisms”.

In the EU Commission itself, it looks like the new proposal is perceived as ‘necessary evil’. As Olivier Micol (the Commission’s head of unit for data protection) says, “Nobody will be happy with the Commission proposal as usual, because the data protection authorities agree on the problem but they do not agree on the solutions” and also “Big Tech companies will not be very much happy with it because it will make the system more efficient to have more enforcement”.

***

The European Data Protection Board (EDPB) is expected to make a binding decision by 14 April on the validity of Meta’s EU-U.S. data transfers. The EDPB’s decision, made under a dispute resolution process as defined in Article 65 of the GDPR, focuses on Meta’s use of Standard Contractual Clauses to allow the transfer of data between the EU and the U.S., following the invalidation of the EU-U.S. Privacy Shield. In the event that the EDPB rules against Meta’s transfer procedures, the company has indicated that it will have to halt its operations in the European Union.

According to a EDPB’s spokesperson, the process of formally preparing a binding decision began on 14 February. This procedure will be carried out by the secretariat, and it must be completed within a period of two months. Interestingly, however, to see how this will be affected by an upcoming EU-U.S. Data Privacy Framework which, if finally approved, will lead to the U.S. being granted an ‘adequate’ status. The final decision on the Data Privacy Framework is preliminarily expected to be made in summer 2023.