The election of Donald Trump could invalidate the Adequacy Decision for data transfer to the US

Donald Trump is the nominee of the Republican Party. In 2020 Donald Trump tried to overturn the democratic election in the US. In an interview he said as President he will be a Dictator only “at day one“. Therefore, Donald Trump cannot be expected to respect the rule of law when elected as President. The respect to the rule of law is the first aspect the EU Commission asseses while taking an Adequacy Decision.1 The EU Commission must monitor any Adequacy Decision on an ongoing basis2 and has to review the Decision if any information indicates that a country no longer ensures an adequate level.3 The election of Donald Trump will most likely cause such a review of the EU Commission and will put the transfer of personal data to the US at risk.

Data transfer outside the EU

As a general rule, the data transfer outside of the EU requires a level of protection in the third country which is essentially equivalent to the level within the EU. This is the principle developed by the CJEU for any cross boarder transfer of personal data of EU Citizen in the decision “Schrems II“.4 The legal mechanisms for the data transfer outside the EU are regulated in Chapter 5 of the GDPR. The data transfer to third countries can be based on

*standard data protection clauses (Art. 46, 2. lit. c GDPR),

*binding corporate rules (Art. 47 GDPR) or

*an Adequacy Decision of the EU Commission (Art. 45 GDPR).

The other instruments mentioned in Chapter 5 are not relevant in practise. The Adequacy Decision of the EU Commission has been the relevant legal instrument for the data transfer to the US.

The CJEU invalidated the data transfer to the US twice: in 2015 the Safe Habor Privacy Principles and on 16th July 2020 the Privacy Shield. In his last decision “Schrems II“, the court required a limited access by US authorities to personal data and the possibility for European Citzens to seek redress. The Adequacy Decision of the EU Commission is a reaction to this new requirements of the CJEU deriving from the GDPR.

The Adequacy Decision for the US

The data transfer to the US is essential for private companies and public bodies within the EU since US companies are providing key services of the IT-industry – like for example Microsoft or Amzon (Cloud Services). On the other hand, the EU is a main market for the US IT-business.

The Adequacy Decision of the EU Commission states that the US ensures an adequate level of protection when personal data is transferred under EU-U.S. Data Privacy Framework.5 The EU-U.S. Data Privacy Framework Principles are issued by the Department of Commerce. The EU-U.S. Data Privacy Framework contents a self assessment mechanism for US companies which is similar to the approach of the Privacy Shield. In addition, the Executive Order 140866 limits the data processing of the “Intelligence Communitiy“. The Order grants a legal remedy for EU Citizen with a Data Protection Review Court (DPRC). The Executive Order is an order of the US President since Congress did not vote on this topic.

In the Adequacy Decision, the EU Commission justifies in broad terms that the changes implemented by the Executive Order and the EU-U.S. Data Privacy Framework are significant compared to the Privacy Shield and meet the adequate level test. The Adequacy Decision has been critisized by Max Schrems and others. However, the focus here is on the circumstances under which the EU Commission has to provide a review of the Adequacy Decision.

Aspects of a review of the Adequacy Decision

The EU Commission has to review each Adequacy Decision periodically.7 The first periodic review for the Adequacy Decision concerning the US is defined in the Adequacy Decision itself and will take place one year after its entry into force on 9 July 2024.8 In addition, the EU Commission has to monitor the Adequacy Decision on an ongoing basis.9 If the Commission receives information that a country no longer ensures an adequate level such a review is indicated. Therefore, the EU Commission shall re-evaluate the Adequacy Decision no later than 5 November 2024 if Donald Trump were to be elected as President. However, some information is already available to the EU Commission in advance of the election date and must be used to prepare for a review.

Some aspekts for the review of the EU Commission may include:

Donald Trump

*lied about the outcome of the election,

*tried to overturn the election,

*tried to pressure Vice President Mike Pence to change the results of the election while the electroral votes were beeing counted,

*instructed a mop to storm the Capitol,

*attempted to install fake electors,

*tried to pressure Mr. Rafenberger on the phone to call to find “enough votes“,

*gave an interview that he will be dictator only “at day one“ after elected President10,

*tried to abolish the independent role of the Attorney General (in his first term),

*plans to put pressure on the administration not to oppose any order of the President (whester legal or illegal)11.

On basis of the available information the EU Commission has to prepare a review of the Adequacy Decision.

DPAs will challenge the review of the EU Commission

The power to take an Adequacy Decision lies with the EU Commission. However, any national DPA can challenge the the Commission’s decision. This follows from CJEU “Schrems II“ where the Irish DPC hesitated to review the Privacy Shields compliance with the requirements of the GDPR. It follows from “Schrems II“, that each national DPA has the competence, firstly, to proove whether the EU Commission has to undergo a review of an Adequacy Decision and, secondly, whether the result of the review complies with GDPR.

This option of the national DPA will put additional pressure on the EU Commission to carry out a reassessment. In addition, the option of the DPA will become an obligation to act of the DPA if a data subject files a complaint against the EU Commission with a national DPA. A complaint from one EU Citizen will leave a national DPA with no choice but to challenge the review of the Adequacy Decision by the EU Commission.

Assessment

The aspect of international data transfer just highlights what seems to be at stake in the US election: to be – or not to be – a society with the respect to the rule of law.