Trans-Atlantic Data Privacy Framework

Personal data is an important factor of production in the XXI century economies. At the same time, personal data protection is one of the key values and fundamental rights of the EU, and it must be affirmed both within its borders, as well as in the wider context of its international relations.

On 25 March 2022, the European Commission and the US announced the agreement ‘in principle’ on a new Trans-Atlantic Data Privacy Framework. However, the technical details remain to be seen, in a drafting process which can take up to six months, or more. Meanwhile, European startups, scale-ups and SMEs continue to need to be able to operate competitively in a global and interconnected market, without being prevented from using all the available market solutions they think are right to tap the potential of their products and services due to the lack of legal certainty. For startups, being able to make these choices is the measure for success or failure.

In this position letter, the Portugal Tech League shares its views on the importance of a new trans-atlantic data privacy framework, calling on all players involved to speed up negotiations, having in mind that startups and scaleups are negatively impacted by the absence of a legally robust mechanism for trans-atlantic data flows, as well as the outcome of the last two EU-US transfer legal mechanisms.

Available for download here, startups and innovative SMEs outlined the following key aspects:

• One year and a half into the CJUE Schrems II ruling, we welcome the agreement in principle on a new and durable Trans-Atlantic Data Privacy Framework, announced on 25 March. However, continuing to leave EU and US businesses at the mercy of legal uncertainty and with limited options to continue to trade, or to access digital services, is unsustainable, both for businesses and for citizens.
• In this sense, we call on European and US legislators to speed up negotiations with a view to quickly finding a legal translation to the political agreement in order to enable the establishment of a legally robust and durable data transfer framework as soon as possible, and one that is able to withstand the immediate challenge at Europe’s highest court.
• Once all the legal and administrative details regarding the agreement ‘in principle’ are sorted out, and in the process of the European Commission adequacy process, EU Member States will be requested to approve the draft adequacy determination drafted by the European Commission. Portugal, within the scope of its agenda for the development of a digital and sustainable economy, not to mention its strategic position between these two huge markets, can take a leading role in this process. Through mobilizing the European Commission and the Council of the EU to support a reasonable solution with the US counterparts, it is essential for the Privacy Shield to be replaced by a new and durable legal framework for EU-US data transfers.
  Contrarily to our previous cycles, the Portugal Tech League hasn’t provided a comprehensive analysis on the topic nor opened a timeframe for the ecosystem at large to get involved due to the fact that the process leading to the trans-Atlantic Data Privacy Framework between the EU and the US is a political initiative, instead of a legislative one – thus, leading us to a different approach thanks to the nature and urgency of the topic at stake.