The adequacy decision, adopted despite the reluctance of the EDPS and the European Parliament, is nevertheless controversial and risks being referred to the CJEU in the coming months. Indeed, several data protection specialists including Max Schrems have highlighted the maintenance of the FISA 702 regulation that the CJEU had deemed not proportionate within the meaning of the Charter of Fundamental Rights of the European Union and that the United States has refused to reform. The Noyb association has already planned to lodge an appeal with the CJEU.
What the adequacy decision contains
In its adequacy decision of 10 July 2023, the Commission first ghana phone number library ensured that ! each principle of personal data protection provided for by the GDPR is found in the DPF. Thus, we find the principles of purpose ! limitation, minimisation, security and accuracy through the ” Data integrity and purpose limitation ! principle” and the ” Security principle ” which provide for provisions similar to the GDPR.
In addition to the information required by the GDPR in accordance ! with the transparency principle, the “ Notice Principle ” requires certified organizations to provide certain information ! relating to the DPF such as the available appeal mechanisms and the list of certified organizations.
The rights of data subjects such as the right of access, information, modification or erasure are found in the “ Access Principle ”.
Onward transfers of data are Governed by the Principle
Accountability for Onward Transfer ” which requires that onward transfers only take place: (i) for a limited and specific purpose, (ii) on the basis of a contract between the certified body and the third party recipient and (iii) only if this contract requires the third party to provide the same level of protection as that guaranteed by the DPF principles.
The European Commission then examined the various remedies available to data subjects affected by the processing of personal data. Thus, the latter may, at their choice, lodge a complaint directly with the certified ! body concerned, with an independent dispute resolution body designated by the certified body, with the ! European national data protection it’s adapting to reality authorities, with the DoC or with the FTC. In the event that none of the other available remedies have ! satisfactorily resolved the complaint, the data subject may invoke the right to resort to binding arbitration.
The Commission has finally assessed the limitations and new bfb directory safeguards of the ! law concerning access to data by US public authorities. Indeed, to address the issues raised by the CJEU in its Schrems II ! judgment, the United States adopted ! on 7 October 2022 Decree 14086 entitled “Enhancing Safeguards for US Signals Intelligence Activities ! supplemented by the regulation relating to the Data Protection Review Court (DPRC). According to the Commission, these texts provide: