GDPR Compliance in EU-US Data Transfers - Examining the impact of the EU Commission’s 2023 adequacy decision on surveillance risks

Sammanfattning: International data transfers serve to support the global economy, facilitating international collaboration and economic expansion. However this increased productivity comes at a cost, namely amplified personal data privacy and security risks. In an era dominated by rapid technological advancements, the clandestine actions of intelligence agencies have the potential to infringe upon the privacy and integrity of individuals on a near global scale. The revelations of mass surveillance programs, as exposed by whistleblowers like Edward Snowden in the United States, demonstrate the real risks of mass data collection to individuals. Consequently, public debate and concern has escalated pertaining to the contentious balance between national security protective measures and the preservation of human rights and civil liberties. The EU Commission's 2023 adequacy decision determined that the United States provided an essentially equivalent level of protection for European personal data. This decision follows the development of the EU-US Data Privacy Framework and has significant implications, as it permits European entities to transfer personal data directly to US companies participating in the framework. As a result, European businesses can conduct data transfers to their US counterparts without the necessity of additional protective measures, streamlining the exchange of personal data and facilitating collaboration in the modern digital economy. However, the high risk of personal data access by US state intelligence agencies makes this practice fraught with complications pertaining GDPR. This raises questions about how to achieve suitable balance between encouraging the free flow of information and protecting data privacy as well as about the validity of the EU Commission’s 2023 adequacy decision.