Oversight Board Firings Spark European Debate over Fate of EU-US Data Flows
President Donald Trump's reported decision to fire the three Democratic members of the Privacy and Civil Liberties Oversight Board (PCLOB) is raising concerns about the future of the hard-won trans-Atlantic data privacy framework (DPF), privacy experts said. It's not yet clear what impact Trump's Executive Order might have, however, and the European Commission is monitoring the situation, it said.
Sign up for a free preview to unlock the rest of this article
The PCLOB is the key oversight authority over U.S. mass surveillance laws. Jettisoning three members would bring it below its quorum "and question the independence of all other executive redress bodies in the US," Austrian privacy activist group Noyb posted.
The EU relies on U.S. boards and tribunals to support its finding that the country provides "adequate" protection of personal data, Noyb said. In addition, it relies on the PCLOB and other mechanisms to allow free data flows under the DPF, as do thousands of European businesses, government agencies and schools. Without that underpinning, "they would need to stop using U.S. Cloud Providers like Apple, Google, Microsoft or Amazon instantly."
One of the EOs Trump signed this week said that all Biden decisions, including those on which EU-U.S. data transfers rely, are under review and could potentially be scrapped within 45 days, Noyb wrote. Since the DPF is entirely based on Biden EOs, it said, "Trump could scrap all key elements of the deal with a single signature -- leading to instantly illegal" trans-Atlantic data transfers.
The PCLOB was created to scrutinize U.S. surveillance practices and review their alignment with privacy and civil liberty requirements, including the DPF; it underpins some U.S. commitments under the DPF, wrote Isabelle Roccia of the International Association of Privacy Professionals. The Department of Justice also had some of its top-level career officials in national security dismissed, she added.
While "this purge is not specific to areas of data protection or transfers ... it is fair to say these actions are sending up flares European officials won't fail to pick up," Roccia wrote. However, there are no firm signals from the Trump camp that trans-Atlantic data flows might be at risk, or any indication that it plans on scrapping other building blocks that support the DPF, she noted.
The European Commission wouldn't speculate on what the PCLOB firings might mean for the data flow deal. U.S. rules remain applicable irrespective of the makeup of the PCLOB, a spokesperson said at a briefing Thursday. Under the General Data Protection Regulation, the official added, all adequacy decisions are subject to continuous monitoring.