My Department and our officials in the Embassy in Washington DC are aware of the draft legislation proposed in the US Senate. The proposed bill aims to amend the US export control regime in order to limit the sale and transfer of US citizens’ data to countries which are deemed to have insufficient safeguards for the protection of personal data and inadequate enforcement of data protection legislation.
The draft legislation was proposed in April and is still in the very early stages of the US legislative process. It may be the case that the final legislation differs from what is proposed, or indeed that the draft legislation will not become law. As such, it is not appropriate for me to comment on the draft legislation or any impact it may have.
I would also recall that rules and legislation regarding the transfer of data to countries outside the EU is a competence of the European Commission. The transfer of personal data from the EU to third countries is carried out under a number of transfer mechanisms set out in Chapter V of the General Data Protection Regulation (GDPR). The default transfer mechanism is known as an ‘adequacy decision’. This is an implementing decision by the Commission which guarantees that the third country in question provides an equivalent level of protection of personal data as exists in the EU. Once a third country has been assessed by the Commission as providing an equivalent level of protection, transfers of EU citizens’ data can take place between the EU and the selected third country under that adequacy decision, without limitation or additional safeguards.
Following a recent court case, the European Commission and the US authorities are currently engaged in discussions regarding a new adequacy decision, focusing on enforceable rights and safeguards for EU citizens’ data.
Officials in our Embassy in Washington DC continue to monitor developments regarding EU–US data transfers and proposed legislative changes concerning same.