DP News – Week 16. The EU-US Data Privacy Framework was rejected in the European Parliament, the EDPB issued a decision for the Meta’s case and launched a ChatGPT task force.

Last Thursday, The European Parliament Committee on Civil Liberties, Justice and Home Affairs passed a non-binding resolution stating that the European Commission should not grant the United States an adequacy decision that would allow for the transfer of personal data between the EU and the US.

The major concern is that the EU-US Data Privacy Framework is seen as an improvement on previous frameworks, but it still does not have enough safeguards to protect the EU-originated personal data. The members of the committee argue that the framework still allows for bulk collection of personal data in certain cases, lacks clear rules on data retention, and does not require independent prior authorization for bulk data collection. They also noted that, while the Data Privacy Framework created a Data Protection Review Court aimed at providing redress to EU data subjects, its decisions would be secret, violating citizens’ right to access and rectify data about them. Finally, the members believe that the Review Court is not truly independent since its judges could be dismissed by the US President, who could also overrule its decisions.

As a next step, the resolution will be taken for a future plenary session of the European Parliament.

***

The European Data Protection Board (EDPB), on the basis of Article 65 GDPR, has adopted a decision as to the legality of the data transfers to the United States by Meta for its Facebook service.

The lead supervisory authority (that is DPC in Ireland) will now have to adopt its final decision, which will be based on the EDPB’s binding decision and legal assessment. The final decision will then be communicated to the data controller (Meta). After that, the EDPB will publish its decision on the official website.

As a matter of another activity, the EDPB has discussed the recent enforcement actions against ChatGPT and has decided “to launch a dedicated task force to foster cooperation and to exchange information on possible enforcement actions conducted by data protection authorities”.