2023/2501(RSP) | [ParlTrack]

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Citation 13

— having regard to the Commission proposal of 10 January 2017 for a regulation of the European Parliament and of the Council concerning the respect for private life and the protection of personal data in electronic communications and repealing Directive 2002/58/EC (RegulaDirective 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection o~~n P~~f privacy ~~and E~~in the electronic Ccommunications) (COM(2017)0010), to the decision to enter into interinstitutional negotiations confirmed by Parliament’s plenary on 25 October 2017, and to the Council’s general approach adopted on 10 February 2021 (6087/21) sector,

Amendment 10 #

Recital F

F. whereas the ability to transfer personal data across borders has the potential to be a key driver of innovation, productivity and economic competitiveness; whereas these transfers should be carried out with a level of protection equivalent to that guaranteed in the EU in full respect for the right to the protection of personal data and the right to privacy; whereas one of the fundamental objectives of the EU is the protection of fundamental rights, as enshrined in the Charter;

Amendment 11 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Recital F

F. whereas the ability to transfer personal data across borders has the potential to be a key driver of innovation, productivity and economic competitiveness as long as adequate safeguards are provided; whereas these transfers should be carried out in full respect for the right to the protection of personal data and the right to privacy; whereas one of the fundamental objectives of the EU is the protection of fundamental rights, as enshrined in the Charter;

Amendment 12 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Recital H

H. whereas ~~mass surveillance, including the bulk collection of data, by state actors is detrimental to~~in the general interest of the protection of national or public security the bulk collection of data is legal provided that it is sufficiently justified, limited and proportionate to the aim, as confirmed by the EDPB and the Court; whereas, on the other hand, mass surveillance by state actors is illegal and impacts the trust of European citizens and businesses in digital services and, by extension, in the digital economy;

Amendment 13 #

Recital H

H. whereas mass surveillance, including the bulk collection of data, by state actors is detrimental to the trust of European citizens and businesses in digital services and, by extension, in the digital economy; however, acknowledges that bulk collection of data by state actors can be permissible according to European Court of Justice jurisprudence if sufficiently strong safeguards are in place;

Amendment 14 #

Recital H

H. whereas mass surveillance~~, including the bulk collection of data,~~ by state actors is detrimental to the trust of European citizens and businesses in digital services and, by extension, in the digital economy;

Amendment 15 #

Recital H a (new)

H a. whereas previous jurisprudence of the European Court of Human Rights acknowledges that bulk interception to protect national security and other essential national interests against serious external threats is not prohibited, and States enjoy a margin of appreciation in deciding what type of interception regime is necessary;

Amendment 16 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Recital J

J. whereas there is no federal privacy and data protection legislation in the United States (US); whereas the EU and the US have differing definitions of key data protection concepts such as principles of necessity and proportionality; whereas, however, the GDPR requires not identical but essentially equivalent personal data protection for adequacy decisions;

Amendment 17 #

Recital J

J. whereas there is no federal privacy and data protection legislation in the United States (US); whereas the E~~U and the US have differing~~O supports the convergence between the EU and the US of the definitions of key data protection concepts such as principles of necessity and proportionality as supported by the EDPB in its opinion;

Amendment 18 #

Recital J

J. whereas there is no federal privacy and data protection legislation in the United States (US); whereas the ~~EU and the US have differing definitions of key data protection concepts such as principles of necessity and proportionality~~new EO introduces definitions of principles of necessity and proportionality in line with those used in the EU legal system;

Amendment 19 #

Recital J a (new)

J a. whereas, while the US provides for a new mechanism for remedy for issues related to public authorities’ access to data, the remedies available for commercial matters under the adequacy decision are insufficient; notes that these issues are largely left at the discretion of companies which can select alternative remedy avenues such as dispute resolution mechanisms or the use of companies’ privacy programs;

Amendment 2 #

Citation 14

— having regard to the Adequacy Referential of the Article 29 Working Party (WP 251 rev.01) as endorsed by the European Data Protection Board (EDPB), to the EDPB Recommendations 01/2020 on measures that supplement transfer tools to ensure compliance with the EU level of protection of personal data, and to the EDPB Recommendations 02/2020 on the European Essential Guarantees for surveillance measures,

Amendment 20 #

Recital J a (new)

J a. whereas the Charter does not discriminate by citizenship or residence when it comes to the rights to privacy and data protection;

Amendment 21 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 1

1. Recalls that privacy and data protection are legally enforceable fundamental rights enshrined in the Treaties, the Charter and the European Convention of Human Rights, as well as in laws and case-law; emphasises that they must be applied in a manner that does not unnecessarily hamper trade or international relations, but can be balanced only against other fundamental rights and not against commercial or political interests; whereas, according to consolidated case law of the Court of Justice of the European Union and the European Court of Human Rights, fundamental rights can be balanced against objectives of general interest, such as the protection of national security, provided that any limitation to the rights and freedoms of individuals is necessary and proportionate to meet such objectives;

Amendment 22 #

Paragraph 1

1. Recalls that the respect for privacyte and ~~data protection~~family life and the protection of personal data are legally enforceable fundamental rights enshrined in the Treaties, the Charter and the European Convention of Human Rights, as well as in laws and case-law; emphasises that they must be applied in a manner that does not unnecessarily hamper trade or international relations, but can be balanced only against other fundamental rights and not against commercial or political interests;

Amendment 23 #

Paragraph 1

Amendment 24 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 1

Amendment 25 #

Paragraph 1

Amendment 26 #

Paragraph 2

2. Acknowledges the ~~efforts made~~significant steps taken in the EO to lay down limits on US Signals Intelligence Activities, by ~~referring to~~introducing the principles of proportionality and necessity into the US legal framework on signals intelligence, and providing a list of legitimate objectives for such activities; notes that these principles will be binding on all US intelligence agencies and can be invoked by data subjects; points out~~, however,~~ that these principles are long-standing key elements of the EU data protection regime and that questions remain whether their substantive definitions in the EO are ~~not~~ in line with their definition under EU law and their interpretation by the CJEU; points out, furthermore, that for the purposes of the EU-US Data Privacy Framework, these principles will be interpreted ~~solely~~ in the light of US law and legal traditions; points out that the EO requires that signals intelligence must be conducted in a manner proportionate to the ‘validated intelligence priority’~~, which appe~~ and that questions remain with regards to ~~be a broad~~the interpretation of ~~proportionality~~this concept;

Amendment 27 #

Paragraph 2

2. Acknowledges the efforts made in the EO to lay down limits on US Signals Intelligence Activities, by referring to the principles of proportionality and necessity, and providing a list of legitimate objectives for such activities; points out, however, that these principles which are long- standing key elements of the EU data protection regime and that their substantive definitions in the EO are not in line with their definition under EU law and their interpretation by the CJEU; points out, furthermore, that for the purposes of the EU-US Data Privacy Framework, these principles will be interpreted solely in, will have to be operationalised and implemented, in the policies and procedures of US intelligence agencies within one year; notes that the EU lists 12 legitimate objectives that may be pursued when conducting signals intelligence collection and 5 objectives for which signals intelligence collection is prohibited; notes that the lighst of ~~US law and legal traditions~~legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public; points out that the EO requires that signals intelligence must be conducted in a manner necessary and proportionate to the ‘validated intelligence priority’, which ~~appears to be a broad interpretation of proportionality;~~ further justifies the purpose for which intelligence collection may take place;

Amendment 28 #

Paragraph 2

2. ~~Acknowledges~~Takes note of the efforts made in the EO to lay down limits on US Signals Intelligence Activities, by referring to the principles of proportionality and necessity, and providing a list of legitimate objectives for such activities; points out, however, that these principles are long-standing key elements of the EU data protection regime and that their substantive definitions in the EO are not in line with their definition under EU law and their interpretation by the CJEU; points out, furthermore, that for the purposes of the EU-US Data Privacy Framework, these principles will be interpreted solely in the light of US law and legal traditions; points out that the EO requires that signals intelligence must be conducted in a manner proportionate to the ‘validated intelligence priority’, which appears to be a broad interpretation of proportionality; is concerned that it is not a requirement that analysts conduct a proportionality assessment for each surveillance decision;

Amendment 29 #

Paragraph 2

2. ~~Acknowledges the effort~~Takes note of the changes made in the EO to lay down limits on US Signals Intelligence Activities, by referring to the principles of proportionality and necessity, and providing a list of 12 legitimate objectives for such activities; points out, however, that these principles are long- standing key elements of the EU data protection regime and that their substantive definitions in the EO are not in line with their definition under EU law and their interpretation by the CJEU; further points out that the US President can, in secret, add new ‘legitimate objectives’ to this list; points out, furthermore, that for the purposes of the EU-US Data Privacy Framework, these principles will be interpreted solely in the light of US law and legal traditions; points out that the EO requires that signals intelligence must be conducted in a manner proportionate to the ‘validated intelligence priority’, which appears to be a very broad interpretation of proportionality;

Amendment 3 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Recital A

A. whereas in the ‘Schrems I’ judgment, the Court of Justice of the European Union (CJEU) invalidated the Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce9, and pointed out that indiscriminate access by intelligence authorities to the content of electronic communications violates the essence of the fundamental right to confidentiality of communications provided for in Article 7 of the Charter; whereas the Court pointed out that, for the purpose of an adequacy decision, a third country does not have to ensure an identical, but "essentially equivalent" level of protection to that guaranteed in EU law, which may be ensured through different means; _________________ 9 OJ L 215, 25.8.2000, p. 7.

Amendment 30 #

Paragraph 2

Amendment 31 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 2

2. Acknowledges the efforts made in the EO to lay down limits on US Signals Intelligence Activities, by referring to the principles of proportionality and necessity, and providing a list of legitimate objectives for such activities; points out, ~~however,~~ that these principles are long-standing key elements of the EU data protection regime and that their substantive definitions in the EO ~~are not in line with their definition under EU law and their interpretation by the CJEU~~provides for significant improvements to ensure that they are adequately equivalent under EU law; points out, furthermore, that for the purposes of the EU-US Data Privacy Framework, these principles will be interpreted ~~solely~~ in the light of US law and legal traditions as is the case with adequacy decisions; points out that the EO requires that signals intelligence must be conducted in a manner proportionate to the ‘validated intelligence priority’, which appears to be a broad interpretation of proportionality;

Amendment 32 #

Paragraph 3

Amendment 33 #

Paragraph 3

3. Regrets the fact that the EO ~~does not prohibit~~still provides for the bulk collection of data by signals intelligence, including the content of communications; notes that the list of legitimate national security objectives can be expanded by the US President, ~~who can determine not to make the relevant updates public;~~ notes that the EO limits the purposes of bulk collection to twelve legitimate purposes and four prohibited purposes; points out that the EO explicitly provides for amendments and expansion of the legitimate purposes by a secret EO; underlines that already the twelve purposes foreseen now are extremely broad; reminds that in "Schrems II", the Court explained that US surveillance failed to satisfy EU law because it failed to require an “objective criterion” “capable of justifying” the government interference with privacy;

Amendment 34 #

Paragraph 3

3. RDeeply regrets the fact that the EO does not prohibit the bulk collection of data by signals intelligence, including the content of communications; notes with concern that the list of legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public; Notes therefore that the executive order does allow for disproportionate bulk collection of data, including the content of communications, leading to serious discrepancies in the understanding of the requirement of necessity and proportionality;

Amendment 35 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 3

3. ~~Regrets the fact that the EO does not prohibit~~Notes that the EO allows the bulk collection of data by signals intelligence, including the content of communications; ~~notes that the list of legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public~~reminds that the EO provides that targeted collection should be prioritized over bulk collection; notes that, while the EO contains several safeguards in case of bulk collection, it does not provide for independent prior authorisation for bulk collection, which is also not foreseen under EO 12333;

Amendment 36 #

Paragraph 3

3. Regrets the fact that the EO does not prohibit the bulk collection of data by signals intelligence, including the content of communications; notes that the list of legitimate national security objectives can be amended and expanded by the US President, w~~ho can determine not~~ith no obligation to make the relevant updates public nor to inform EU counterparts; points out that this would undermine the purpose of the objectives as a safeguard to limit US intelligence activities;

Amendment 37 #

Moritz KÖRNER, Sophia IN 'T VELD

Paragraph 3

3. Regrets the fact that the EO does not prohibit the bulk collection of data by signals intelligence, including the content of communications; notes that the list of legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public; is convinced that electronic mass surveillance of EU citizens by US authorities will continue;

Amendment 38 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 3

3. ~~Regret~~Notes the fact that the EO does not prohibit the bulk collection of data by signals intelligence in certain justified cases, including the content of communications in line with ECJ rulings; notes that the list of legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public;

Amendment 39 #

Paragraph 3

3. ~~Regrets the fact~~Notes that the EO does not prohibit the bulk collection of data by signals intelligence, including the content of communications; notes that ~~the list of legitimate national security objectives can be expanded by the US President, who can determine not to make the relevant updates public~~CJEU jurisprudence also does not prohibit the bulk collection of data by signals intelligence but that safeguards and conditions apply;

Amendment 4 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Recital A

A. whereas in the ‘Schrems I’ judgment, the Court of Justice of the European Union (CJEU) invalidated the Commission Decision of 26 July 2000 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequacy of the protection provided by the safe harbour privacy principles and related frequently asked questions issued by the US Department of Commerce9, and pointed out that ~~indiscriminate~~access by intelligence authorities to the content of electronic communications violates the essence of the fundamental right to confidentiality of communications provided for in Article 7 of the Charter if such access is indiscriminate and not limited by clear and precise rules governing the scope and application of a measure and imposing minimum safeguards; _________________ 9 OJ L 215, 25.8.2000, p. 7.

Amendment 40 #

Paragraph 3 a (new)

3 a. Stresses the EDPB’s concerns over the EO’s failure to provide safeguards in bulk data collection, namely the lack of independent prior authorisation, lack of clear and strict data retention rules and lack of stricter safeguards concerning dissemination of data collected in bulk; points particularly to the specific concern that without further restrictions on dissemination to US authorities, law enforcement authorities will be enabled to access data they would otherwise have been prohibited from collecting;

Amendment 41 #

Paragraph 3 a (new)

3 a. Takes note that the draft adequacy decision tries to manoeuvre around this by playing word-games with “bulk” and “mass” surveillance, which does not change the practice of mass surveillance;

Amendment 42 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 3 b (new)

3 b. Does not expect the EO will change the scope of US surveillance in practice; reminds that after Presidential Policy Directive (PPD) 28, which formed the basis for the "Privacy Shield" adequacy decision, the Privacy and Civil Liberties Oversight Board (PCLOB) issued a review report [1] and concluded that PPD-28 had essentially memorialized what the intelligence community was already doing before; expects the same conclusion under the new EO as well; [1] https://documents.pclob.gov/prod/Docume nts/OversightReport/caec5956-e1e4-4d11- a840-6e13114962c1/PPD- 28%20Report%20(for%20FOIA%20Relea se)%20-%20Completed%20508%20- %2012082022.pdf

Amendment 43 #

Paragraph 3 b (new)

3 b. Shares the concern of the EDPB regarding the use of temporary bulk data collection as an additional ground for collecting data in bulk; is particularly concerned over the vaguely defined notion of “temporarily” in this context, and the fact that the safeguards concerning bulk data collection provided by the EO would not apply when data is collected in bulk temporarily;

Amendment 44 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 3 c (new)

3 c. Reminds that onward transfers effectively multiply the risks to the protection of data and notes that the EDPB has called for the inclusion of a legally binding obligation to analyse and determine whether the third country offers an acceptable minimum level of safeguards while taking into account the effect of any existing international agreements that may provide for the transfer of personal data by intelligence services;

Amendment 45 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 3 d (new)

3 d. Shares the calls from the EDPB that the entry into force and adoption of the adequacy decision be conditional upon, inter alia, the adoption of updated policies and procedures to implement the EO by all US intelligence agencies; calls on the Commission to assess these updated policies and procedures and share its assessment with the European Parliament and the EDPB;

Amendment 46 #

Paragraph 4

4. Points out that the EO does not apply to data accessed by public authorities via other means, for example through the US Cloud Act or the US Patriot Act, by commercial data purchases, or by voluntary data sharing agreements;deleted

Amendment 47 #

Paragraph 4 a (new)

4 a. Understands that in the US interpretation, “signals intelligence” covers all data access methods provided for in the Foreign Intelligence Surveillance Act (FISA), including from “remote computing service” providers ad added with the FISA Amendment Act §1881a in 2008; calls on the Commission to clarify the definition and scope of “signals intelligence” in the U.S. legal meaning;

Amendment 48 #

Paragraph 4 a (new)

4 a. Points out that a new redress mechanism has been created allowing EU data subjects to lodge a complaint, free of charge and without having to prove that their personal data was processed as part of surveillance activities;

Amendment 49 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 4 a (new)

4 a. Points out that the EO as a result fails to create actual equivalence in the level of protection, but merely paints over the differences;

Amendment 5 #

Recital D a (new)

D a. Whereas the EDPB opinion on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU- US Data privacy Framework states that it does not expect the US data protection framework to replicate European data protection law, but rather ensure an “essentially equivalent” level of protection as also confirmed by the ECJ;

Amendment 50 #

Paragraph 4 b (new)

4 b. Reminds that under FISA Section 702, the U.S. government still claims the power to target any non-U.S. person abroad to obtain foreign intelligence, broadly defined;

Amendment 51 #

Paragraph 5

5. Points out that the ~~decisions of the~~ Data Protection Review Court (‘DPRC’) ~~will be classified and not made public or available to the complainant; points out that the DPRC is part of the executive branch and not the judiciary; points out~~is part of the executive branch and not the judiciary; notes, however, that only an administrative body within executive branch can enjoy both requisite independence and overcome standing requirement applicable to US federal courts; considers that EO 14086 foresees several guarantees to ensure the independence of DPRC judges, as also recognised by the EDPB in its opinion; calls on the Commission to closely monitor the application of these safeguards for independence in practice; recognises that the DPRC will adopt reasoned decision; notes, however, that the decisions of the DPRC will be classified and not made public; notes that athe complainant will be ~~represented by a ‘special advocate’ designated by the DPRC, for whom there is no requirement of independence~~informed that "the review either did not identify any covered violations or the DPRC issued a determination requiring appropriate remediation"; points out that the redress process provided by the EO is based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed~~, thereby undermining their right to access or rectify their data; notes that the proposed~~; notes, however, that the complainant will be notified if the information included in the decision of the DPRC has been declassified; points out that a complainant will be redpres~~s process~~ented by a ‘special advocate’ does not provide for an avenue for appeal in a federal court and therefore, among other things, does not provide any possibility for the complainant to claim damages; concludes that the DPRC does not meet the standards of independence and impartiality of Article 47 of the Charter; ignated by the DPRC; points out that the DPRC has the power to access all necessary information and to remedy violations (e.g. to order the deletion of data); notes that the PCLOB will independently review the functioning of the new redress mechanism; points out that the new redress mechanism does not allow for the US Attorney General to dismiss and supervise the DPRC Judges; calls on the Commission to closely monitor this new framework;

Amendment 52 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 5

5. Points out that the decisions of the Data Protection Review Court (‘DPRC’) will be classified and not made public or available to the complainant; points out that the DPRC is part of the executive branch and not the judiciary; ~~points out that a complainant will be represented by a ‘special advocate’ designated by the DPRC, for whom there is no requirement of independence;~~ points out that the redress process provided by the EO is based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed, thereby undermining their right to access or rectify their data; notes that the proposed redress process does not provide for an avenue for appeal in a federal court and therefore, among other things, does not provide any possibility for the complainant to claim damages; concludes that the DPRC does not meet the standards of independence and impartiality of Article 47 of the Charter;

Amendment 53 #

Paragraph 5

5. Points out that e room for improvement on the following procedures and calls on the Commission to improve them in its final adequacy draft decision : -the decisions of the Data Protection Review Court (‘DPRC’) ~~will~~shall not be classified and ~~not~~shall be made public or available to the complainant; ~~points out that the DPRC is part of the executive branch and not the judiciary; points out that~~ -a complainant will be represented by a ‘special advocate’ designated by the DPRC, for whom there ~~is no~~shall be a requirement of independence; ~~points out that~~- the redress process provided by the EO is based on secrecy and ~~does not~~it shall set up an obligation to notify the complainant that their personal data has been processed, thereby ~~undermin~~ensuring their right to access or rectify their data; ~~notes that~~- the proposed redress process ~~does not~~shall provide for an avenue for appeal in a federal court and therefore, among other things, ~~does not provide any~~ possibility for the complainant to claim damages; ~~concludes that the DPRC does not meet the standards of independence and impartiality of Article 47 of the Charter;~~

Amendment 54 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV

Paragraph 5

5. Points out that the decisions of the Data Protection Review Court (‘DPRC’) will be classified and not made public or available to the complainant; ~~points out that the DPRC is part of the executive branch and not the judiciary~~meaning that and a person bringing a case will have no chance of being informed about the substantive outcome of the case; points out that the DPRC is part of the executive branch and not the judiciary; its judges are appointed for only four years and can be removed by the US President at will; and the President can overrule its decisions, even in secret; points out that a complainant will be represented by a ‘special advocate’ designated by the DPRC, for whom there is no requirement of independence; points out that the redress process provided by the EO is based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed, thereby undermining their right to access or rectify their data; notes that the proposed redress process does not provide for an avenue for appeal in a federal court and therefore, among other things, does not provide any possibility for the complainant to claim damages; concludes that the DPRC does not meet the standards of independence and impartiality of Article 47 of the Charter;

Amendment 55 #

Draft motion for a resolution
Paragraph 5

5. Points out that the decisions of the Data Protection Review Court (‘DPRC’) will be classified and not made public or available to the complainant and that they will be final and non-appealable with the DPRC; points out that the DPRC is part of the executive branch and not the judiciary; stresses that it should be prohibited for the US President to remove DPRC judges and calls on the Commission to clarify this matter; points out that a complainant will be represented by a ‘special advocate’ designated by the DPRC, for whom there is no requirement of independence; points out that the redress process provided by the EO is based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed, thereby undermining their right to access or rectify their data; notes that the proposed redress process does not provide for an avenue for appeal in a federal court and therefore, among other things, does not provide any possibility for the complainant to claim damages; concludes that the DPRC does not meet the standards of independence and impartiality of Article 47 of the Charter and that it is not compatible with the basic principles of justice and due process;

Amendment 56 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 5

5. Points out that the decisions of the Data Protection Review Court (‘DPRC’) will be binding; notes that the decisions will also be classified and not made public or available to the complainant; points out that the DPRC is part of the executive branch and not the judiciary; points out, however, that the DPRC Judges shall have an independent mandate; points out that a complainant will be represented by a ‘special advocate’ designated by the DPRC~~, for whom there is no requirement of independence~~; points out that the redress process provided by the EO is based on secrecy and does not set up an obligation to notify the complainant that their personal data has been processed, thereby ~~undermi~~weakening their right to access or rectify their data; notes that the proposed redress process does not provide for an avenue for appeal in a federal court and therefore, among other things, does not provide any possibility for the complainant to claim damages; concludes that ~~the DPRC does no~~questions remain regarding the functioning of the DPRC and whether it meets the standards of independence and impartiality of Article 47 of the Charter;

Amendment 57 #

Paragraph 6

6. Notes that, while the US has provided for a new mechanism for remedy for issues related to public authorities’ access to data, the remedies available for commercial matters under the adequacy decision are ~~insufficient~~unchanged; notes that these issues are largely left to the discretion of companies, which can select alternative remedy avenues such as dispute resolution mechanisms or the use of companies’ privacy programmes; Calls on the Commission to closely monitor the effectiveness of these redress mechanisms;

Amendment 58 #

Paragraph 6

6. Notes that, while the US has provided for a new mechanism for remedy for issues related to public authorities’ access to data, the remedies available for commercial matters under the adequacy decision are insufficient; notes that these issues are largely left to the discretion of companies, which can select alternative remedy avenues such as dispute resolution mechanisms or the use of companies’ privacy programmemain the same; calls on the Commission to closely monitor the effectiveness of these redress mechanisms;

Amendment 59 #

Paragraph 6

6. Notes that, while the US has provided for a new mechanism for remedy for issues related to public authorities’ access to data, ~~the~~questions remain with regards to the effectiveness of remedies available for commercial matters under the adequacy decision ~~are insufficient~~; notes that these issues are largely left to the discretion of companies, which can select alternative remedy avenues such as dispute resolution mechanisms or the use of companies’ privacy programmes;

Amendment 6 #

Recital E

E. whereas, when examining the level of protection afforded by a third country, the Commission is obliged to assess the content of the rules applicable in that country deriving from its domestic law or its international commitments, as well as the practice designed to ensure compliance with those rules; Whereas, if the US does not enforce data protection regulation in line with the agreement and if a new US administration decides on new rules that compromise the protection of personal data of EU citizens, the Commission can suspend the adequacy when there is no longer equivalence;

Amendment 60 #

Moritz KÖRNER, Sophia IN 'T VELD

Paragraph 6

6. Notes that, while the US has provided for a new mechanism for remedy for issues related to public authorities’ access to data, the remedies available for commercial matters under the adequacy decision are in~~sufficient~~effective; notes that these issues are largely left to the discretion of companies, which can select alternative remedy avenues such as dispute resolution mechanisms or the use of companies’ privacy programmes;

Amendment 61 #

Paragraph 6 a (new)

6 a. Requests that the EO is amended in order to incorporate measures that stipulate that EU citizens shall have the same rights and privileges that US citizens have, when it comes to the activities of the US Intelligence Community and access to US courts;

Amendment 62 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 6 a (new)

6 a. Points out that the underlying problem is the surveillance of non-US persons under US law, and the inability for European citizens to seek redress in this regard;

Amendment 63 #

Paragraph 7

7. Notes that European businesses need and deserve legal certainty; stresses that successive data transfer mechanisms, which were subsequently repealed by the CJEU, created additional costs for European businesses; notes that continuing uncertainty and the need to adapt to new legal solutions is particularly burdensome for micro, small and medium-sized enterprises; is concerned that the adequacy decision could (like its predecessors) be invalidated by the Court of Justice, leading to a continuing lack of legal certainty, further costs and disruption for European citizens and businesses;

Amendment 64 #

Paragraph 7

7. Notes that European businesses need ~~and deserve~~ legal certainty; stresses that successive data transfer mechanisms, which were subsequently repealed by the CJEU, created additional costs for European businesses; ~~notes that continuing uncertainty and the need to adapt to new legal solutions is particularly burdensome for micro, small and medium-sized enterprises;~~

Amendment 65 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 7

7. Notes that European businesses need and deserve legal certainty; stresses that successive data transfer mechanisms, which were subsequently repealed by the CJEU, created additional costs for European businesses; notes th~~at continuing uncertainty and the need to adapt to new legal solutions~~erefore the need to ensure legal certainty and avoid a situation that is particularly burdensome for micro, small and medium- sized enterprises; regrets that the lack of an adequacy decision increases financial and administrative burden;

Amendment 66 #

Paragraph 7

Amendment 67 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 8

8. Points out that, unlike all other third countries that have received an adequacy decision under the GDPR, the US still does not have a federal data protection law; points out that the EO is not clear, precise or foreseeable in its application, as it can be amended at any time by the US President~~; is therefore~~, who is also empowered to issue secret executive orders; is concerned ~~about~~regarding the absence of a sunset clause which could provide that the decision would automatically expire four years after its entry into force; after which the Commission would have to make a new determination; is concerned that the lack of a sunset clause in this adequacy decision represents a more lenient approach to the US, despite the fact that the US privacy framework is based on an Executive Order which allows for secret amendments, and which can be amended without consulting Congress or informing EU counterparts;

Amendment 68 #

Paragraph 8

8. Points out that, unlike all other third countries that have received an adequacy decision under the GDPR, the US still does not have a federal data protection law, and that the federal proposals so far do not meet all the requirements of the GDPR for an adequacy finding; strongly encourages again the US legislator to enact legislation that meets those requirements, and to thereby contribute to ensuring that US law provides an essentially equivalent level of protection to that currently guaranteed in the EU; points out that the EO is not clear, precise or foreseeable in its application, as it can be amended at any time by the US President; is therefore concerned about the absence of a sunset clause which could provide that the decision would automatically expire four years after its entry into force;

Amendment 69 #

Paragraph 8

8. Points out that, unlike all other third countries that have received an adequacy decision under the GDPR, the US still does not have a federal data protection law; ~~points out~~acknowledges that the EO is not clear, precise or foreseeable in its application, as it can be amended at any time by the US President; is therefore concerned about the absence of a sunset clause which could provide that the decision would automatically expire four years after its entry into forcecan be amended by the US President; expects therefore the Commission to suspend the decision, in case the President decides to restrict the safeguards included in the EO; notes that the review of the adequacy finding will take place after one year from the date of the notification of the adequacy decision to the Member States and subsequently at least every four years; calls on the Commission to carry out the subsequent reviews at least every three years, as requested by the EDPB in its opinion;

Amendment 7 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Recital E

E. whereas, when examining the level of protection afforded by a third country, the Commission is obliged to assess the content of the rules applicable in that country deriving from its domestic law or its international commitments, as well as the practice designed to ensure compliance with those rules; whereas, if such assessment were to be found unsatisfactory in terms of adequacy and equivalence, the Commission should refrain from establishing an adequacy decision since it is conditional to the implementation;

Amendment 70 #

Paragraph 8

8. Points out that, unlike all other third countries that have received an adequacy decision under the GDPR, the US ~~still~~ does not have a federal data protection law; points out that the EO is ~~not clear, precise or~~ foreseeable in its application, as it can be amended at any time by the US President; is therefore concerned about the absence of a sunset clause which could provide that the decision would automatically expire four years after its entry into force; Therefore calls on the Commission to introduce such a clause in case of changes in the US law;

Amendment 71 #

Paragraph 8

8. ~~Points out~~Notes that, unlike all other third countries that have received an adequacy decision under the GDPR, the US ~~still~~ does not have a federal data protection law; points out that ~~the EO is not clear, precise or foreseeable~~ some questions remain witsh regards to the application, a~~s it can be amended at any time by the US President; is therefore concerned about the absence of a sunset clause which could provide that the decision would automatically expire four years after its~~ nd effectiveness of the EO; underlines that the adequacy decision would be subject to continuous review, taking into account legal and practical developmentrys in~~to force~~ the US;

Amendment 72 #

Paragraph 8

Amendment 73 #

Paragraph 8 a (new)

8 a. Underlines the fact that the possibility for the US President to modify the effect of the EO through acts that are not public, and not even made available to the Commission and the CJEU, put into question whether the EO meets the requirements of “law” as understood by European courts and a prerequisite for limitations to fundamental rights;

Amendment 74 #

Paragraph 8 a (new)

8 a. Notes that the Data Privacy Framework principles issued by the US Department of Commerce have not undergone sufficient amendments, in comparison to those under the Privacy Shield, to provide essentially equivalent protection to that provided under the General Data Protection Regulation (GDPR);

Amendment 75 #

Paragraph 8 b (new)

8 b. Underlines the concerns of the European Data Protection Board regarding the rights of data subjects, the absence of key definitions and specific rules on automated decision-making and profiling, the lack of clarity about the application of the DPF principles to processors, the need not to undermine the level of protection by onward transfers,

Amendment 76 #

Paragraph 8 b (new)

8 b. Reminds that the Commission when assessing the adequacy of a third country based on legislation and practices in place not only in substance but also in practice as established under Schrems I, Schrems II and the GDPR;

Amendment 77 #

Paragraph 8 c (new)

8 c. Is concerned about the exemptions for not having to adhere to the DPF Principles; stresses the importance of effective redress, oversight and enforcement;

Amendment 78 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 9

9. Emphasises that adequacy decisions must include clear and strict mechanisms for monitoring and review in order to ensure that decisions are future proof or repealed or amended as necessary, and that EU citizens’ fundamental right to data protection is guaranteed at all times;

Amendment 79 #

Paragraph 9 a (new)

9 a. Calls on the Commission to monitor the proper implementation of the data protection rights as stated in the EO, especially as regards to the US agencies, who have until October 2023 to comply with the protection norms set in the executive order;

Amendment 8 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Recital E

Amendment 80 #

Paragraph 10

10. Recalls that, in its resolution of 20 May 2021, Parliament called on the Commission not to adopt any new adequacy decision in relation to the US, unless meaningful reforms were introduced, in particular for national security and intelligence purposes; reiterates that the Commission should not leave proper enforcement of EU data protection law to the Court of Justice of the European Union following complaints by individual citizens;

Amendment 81 #

Paragraph 10

10. Recalls that, in its resolution of 20 May 2021, Parliament called on the Commission not to adopt any new adequacy decision in relation to the US, unless meaningful reforms were introduced, in particular for national security and intelligence purposes; does not consider the Executive Order issued by President Biden on 7nd October 2022 as meaningful enough;

Amendment 82 #

Paragraph 10 a (new)

10 a. Recalls that the European Commission must assess the adequacy of a third country based on legislation and practices in place not only in substance but also in practice as established under Schrems I, Schrems II and the GDPR (recital 104);

Amendment 83 #

Paragraph 10 b (new)

10 b. Notes that while the US is making important commitment to improve access to remedy and rules on data processing by public authorities, the US Intelligence Community has until October 2023 to update their policies and practices in line the commitment of the EO (see adequacy decision recital 120) and that the US Advocate General has yet to name the EU and its Members States as qualifying countries to be eligible to access the remedy avenue available under the DPRC; underlines that this means that the Commission was not able to assess “in practice” the effectiveness of the proposed remedies and proposed measures on access to data; therefore, calls on the Commission to only proceed with next step of any adequacy decision once these deadlines and milestones have first been completed by the US to ensure that the commitments have been delivered in practice; in the event that all aspects are sufficiently addressed, points at the EDPB recommendation to conduct reviews every three years;

Amendment 84 #

Paragraph 11

Amendment 85 #

Paragraph 11

11. Concludes that the EU-US Data Privacy Framework fails to create actual equivalence in the level of protection; believes that the adequacy finding is unlikely to satisfy the CJEU, should it be brought before them; calls on the Commission to continue negotiations with its US counterparts with the aim of creating a mechanism that would ensure such equivalence and which would provide the adequate level of protection required by Union data protection law and the Charter as interpreted by the CJEU; urges the Commission not to adopt the adequacy finding;

Amendment 86 #

Paragraph 11

11. Concludes that ~~the EU-US Data Privacy Framework fails to create actual equivalence in the level of protection~~questions remain with regards to the EU-US Data Privacy Framework; calls on the Commission to clarify and if necessary continue negotiations with its US counterparts ~~with the aim of creating a mechanism that would~~in order to ensure ~~such~~ equivalence and ~~which would provide the~~an adequate level of protection of personal data as required by Union data protection law and the Charter as interpreted by the CJEU; ~~urges the Commission not to adopt the adequacy finding;~~

Amendment 87 #

Marina KALJURAND, Birgit SIPPEL, Juan Fernando LÓPEZ AGUILAR, Petar VITANOV, Paul TANG, Matjaž NEMEC

Paragraph 11

11. Concludes that the EU-US Data Privacy Framework fails to create actual equivalence in the level of protection; calls on the Commission to continue negotiations with its US counterparts with the aim of creating a mechanism that would ensure such equivalence and which would provide the adequate level of protection required by Union data protection law and the Charter as interpreted by the CJEU; urges the Commission not to adopt the adequacy finding; urges the Commission to not make the same mistake three times;

Amendment 88 #

Paragraph 11

11. Concludes that the EU-US Data Privacy Framework fails to create ~~actu~~essential equivalence in the level of protection; calls on the Commission to continue negotiations with its US counterparts with the aim of creating a mechanism that would ensure such equivalence and which would provide the adequate level of protection required by Union data protection law and the Charter as interpreted by the CJEU; ~~urges~~calls on the Commission not to adopt the adequacy finding;

Amendment 89 #

Fabienne KELLER, Malik AZMANI, Maite PAGAZAURTUNDÚA

Paragraph 11

11. Concludes that the EU-US Data Privacy Framework fails to create actual equivalence in the level of protection; calls on the Commission to continue negotiations with its US counterparts with the aim of creating a mechanism that would ensure such equivalence andalls on the Commission to continue negotiations with its US counterparts in order to include the remarks for improvement listed in this resolution and in the opinion of the EDPB with the aim of creating a mechanism which would provide the adequate level of protection required by Union data protection law and the Charter as interpreted by the CJEU; urges the Commission ~~not to adopt the adequacy fin~~to amend its draft adequacy decision accordingly;

Amendment 9 #

Moritz KÖRNER, Sophia IN 'T VELD

Recital F

F. whereas the ability to transfer personal data across borders has the potential to be a key driver of innovation, productivity and economic competitiveness; whereas these EU is currently lagging behind other major economies when it comes to innovation and the digital economy; whereas any personal data transfers should be carried out in full respect for the right to the protection of personal data and the right to privacy; whereas one of the ~~fundamental objectives of the EU i~~aims of the EU is the promotion of its values, which includes the protection of fundamental rights, as enshrined in the Charter;

Amendment 90 #

Paragraph 11 a (new)

11 a. Believes that the Commission should only adopt the adequacy finding when the Commission-President is ready to personally guarantee that the adequacy decision will not be overturned by the CJEU; expects the Commission-President to step down if the CJEU for the third time finds the Commission’s efforts to safeguard the citizens’ fundamental rights to be insufficient and consequently invalidates the Commission’s Implementing Decision;

Amendment 91 #

Paragraph 11 a (new)

11 a. Calls on the Commission to assure EU businesses and citizens that the adequacy decision will provide a solid, sufficient and future-oriented legal basis for EU-US data transfers; underlines the importance of making sure that this adequacy decision will be deemed acceptable if reviewed by the CJEU and stresses that recommendations made in the EDPB opinion should therefore be taken on board;

Amendment 92 #