Schrems III: Gauging the Validity of the GDPR Adequacy Decision for the United States

International Center for Law & Economics Issue Brief 2023-09-25

19 Pages Posted: 25 Oct 2023

See all articles by Mikolaj Barczentewicz

Mikolaj Barczentewicz

University of Surrey; University of Oxford

Date Written: September 25, 2023

Abstract

The EU Court of Justice’s (CJEU) July 2020 Schrems II decision generated significant uncertainty, as well as enforcement actions in various EU countries, as it questioned the lawfulness of transferring data to the United States under the General Data Protection Regulation (GDPR)1 while relying on “standard contractual clauses.”

President Joe Biden signed an executive order in October 2022 establishing a new data-protection framework to address this uncertainty. The European Commission responded in July 2023 by adopting an “Adequacy Decision” under Article 45(3) of the GDPR, formally deeming U.S. data-protection commitments to be adequate.

A member of the French Parliament has already filed the first legal challenge to the Adequacy Decision and another from Austrian privacy activist Max Schrems is expected soon.

This paper discusses key legal issues likely to be litigated:

1. The legal standard of an “adequate level of protection” for personal data. Although we know that the “adequate level” and “essential equivalence” of protection do not necessarily mean identical protection, the precise degree of flexibility remains an open question that the EU Court may need to clarify to a much greater extent.

2. The issue of proportionality of “bulk” data collection by the U.S. government. It examines whether the objectives pursued can be considered legitimate under EU law and, if so, whether the existing CJEU precedents preclude such collection from being considered proportionate under the GDPR.

3. The problem of effective redress—a cornerstone of the Schrems II decision. This paper explores debates around Article 47 of the EU Charter of Fundamental Rights, whether the new U.S. framework offers redress through an impartial tribunal, and whether EU persons can effectively access the redress procedure.

4. The issue of access to information about U.S. intelligence agencies’ data-processing activities.

Keywords: EU privacy law, GDPR, data flows, EU-US data transfers

Suggested Citation

Barczentewicz, Mikolaj, Schrems III: Gauging the Validity of the GDPR Adequacy Decision for the United States (September 25, 2023). International Center for Law & Economics Issue Brief 2023-09-25, Available at SSRN: https://ssrn.com/abstract=4585431

Mikolaj Barczentewicz (Contact Author)

University of Surrey ( email )

Guildford
Guildford, Surrey GU2 5XH
United Kingdom

University of Oxford ( email )

Mansfield Road
Oxford, Oxfordshire OX1 4AU
United Kingdom

Do you have negative results from your research you’d like to share?

Paper statistics

Downloads
88
Abstract Views
216
Rank
526,794
PlumX Metrics