13 Amendments of Maite PAGAZAURTUNDÚA related to 2023/2501(RSP)
Amendment 5 #
Recital D a (new)
D a. Whereas the EDPB opinion on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU- US Data privacy Framework states that it does not expect the US data protection framework to replicate European data protection law, but rather ensure an “essentially equivalent” level of protection as also confirmed by the ECJ;
Amendment 10 #
Recital F
F. whereas the ability to transfer personal data across borders has the potential to be a key driver of innovation, productivity and economic competitiveness; whereas these transfers should be carried out with a level of protection equivalent to that guaranteed in the EU in full respect for the right to the protection of personal data and the right to privacy; whereas one of the fundamental objectives of the EU is the protection of fundamental rights, as enshrined in the Charter;
Amendment 12 #
Recital H
H. whereas mass surveillance, including the bulk collection of data, by state actors is detrimental toin the general interest of the protection of national or public security the bulk collection of data is legal provided that it is sufficiently justified, limited and proportionate to the aim, as confirmed by the EDPB and the Court; whereas, on the other hand, mass surveillance by state actors is illegal and impacts the trust of European citizens and businesses in digital services and, by extension, in the digital economy;
Amendment 17 #
Recital J
J. whereas there is no federal privacy and data protection legislation in the United States (US); whereas the EU and the US have differingO supports the convergence between the EU and the US of the definitions of key data protection concepts such as principles of necessity and proportionality as supported by the EDPB in its opinion;
Amendment 25 #
Paragraph 1
1. Recalls that privacy and data protection are legally enforceable fundamental rights enshrined in the Treaties, the Charter and the European Convention of Human Rights, as well as in laws and case-law; emphasises that they must be applied in a manner that does not unnecessarily hamper trade or international relations, but can be balanced only against other fundamental rights and not against commercial or political interestssuch as the right to security;
Amendment 31 #
Paragraph 2
2. Acknowledges the efforts made in the EO to lay down limits on US Signals Intelligence Activities, by referring to the principles of proportionality and necessity, and providing a list of legitimate objectives for such activities; points out, however, that these principles are long-standing key elements of the EU data protection regime and that their substantive definitions in the EO are not in line with their definition under EU law and their interpretation by the CJEUprovides for significant improvements to ensure that they are adequately equivalent under EU law; points out, furthermore, that for the purposes of the EU-US Data Privacy Framework, these principles will be interpreted solely in the light of US law and legal traditions as is the case with adequacy decisions; points out that the EO requires that signals intelligence must be conducted in a manner proportionate to the ‘validated intelligence priority’, which appears to be a broad interpretation of proportionality;
Amendment 38 #
Paragraph 3
3. RegretNotes the fact that the EO does not prohibit the bulk collection of data by signals intelligence in certain justified cases, including the content of communications in line with ECJ rulings; notes that the list of legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public;
Amendment 53 #
Paragraph 5
5. Points out that e room for improvement on the following procedures and calls on the Commission to improve them in its final adequacy draft decision : -the decisions of the Data Protection Review Court (‘DPRC’) willshall not be classified and notshall be made public or available to the complainant; points out that the DPRC is part of the executive branch and not the judiciary; points out that -a complainant will be represented by a ‘special advocate’ designated by the DPRC, for whom there is noshall be a requirement of independence; points out that- the redress process provided by the EO is based on secrecy and does notit shall set up an obligation to notify the complainant that their personal data has been processed, thereby underminensuring their right to access or rectify their data; notes that- the proposed redress process does notshall provide for an avenue for appeal in a federal court and therefore, among other things, does not provide any possibility for the complainant to claim damages; concludes that the DPRC does not meet the standards of independence and impartiality of Article 47 of the Charter;
Amendment 57 #
Paragraph 6
6. Notes that, while the US has provided for a new mechanism for remedy for issues related to public authorities’ access to data, the remedies available for commercial matters under the adequacy decision are insufficientunchanged; notes that these issues are largely left to the discretion of companies, which can select alternative remedy avenues such as dispute resolution mechanisms or the use of companies’ privacy programmes; Calls on the Commission to closely monitor the effectiveness of these redress mechanisms;
Amendment 66 #
Paragraph 7
7. Notes that European businesses need and deserve legal certainty; stresses that successive data transfer mechanisms, which were subsequently repealed by the CJEU, created additional costs for European businesses; notes that continuingacknowledges that legal uncertainty and the need to adapt to new legal solutions is particularly burdensome for micro, small and medium- sized enterprises;
Amendment 70 #
Paragraph 8
8. Points out that, unlike all other third countries that have received an adequacy decision under the GDPR, the US still does not have a federal data protection law; points out that the EO is not clear, precise or foreseeable in its application, as it can be amended at any time by the US President; is therefore concerned about the absence of a sunset clause which could provide that the decision would automatically expire four years after its entry into force; Therefore calls on the Commission to introduce such a clause in case of changes in the US law;
Amendment 79 #
Paragraph 9 a (new)
9 a. Calls on the Commission to monitor the proper implementation of the data protection rights as stated in the EO, especially as regards to the US agencies, who have until October 2023 to comply with the protection norms set in the executive order;
Amendment 89 #
Paragraph 11
11. Concludes that the EU-US Data Privacy Framework fails to create actual equivalence in the level of protection; calls on the Commission to continue negotiations with its US counterparts with the aim of creating a mechanism that would ensure such equivalence andalls on the Commission to continue negotiations with its US counterparts in order to include the remarks for improvement listed in this resolution and in the opinion of the EDPB with the aim of creating a mechanism which would provide the adequate level of protection required by Union data protection law and the Charter as interpreted by the CJEU; urges the Commission not to adopt the adequacy finto amend its draft adequacy decision accordingly;