Will US privacy-lite hollow out GDPR?

The European Union's General Data Protection Regulation (GDPR), which entered into force in 2018, introduced pioneering legislation that set data privacy standards for millions of citizens in the EU and beyond.

Some say that GDPR is currently the most developed data protection law in the world, but the United States (US) has opted for a very different approach.

The American National Institute of Standards and Technology (NIST) recently released (16 January) the long-awaited Privacy Framework, which is not a law or regulation, but rather a "voluntary tool".

This framework aims to help organisations manage privacy risks and technical capabilities to comply with laws that may affect them, but also helps industries to communicate from the executive to the implementation level about privacy practices, aiming to increase consumers' trust.

"I think about it as building foundational blocks for privacy that anybody [small and big enterprises] can use to meet their obligations and manage their privacy risks," the senior policy adviser and leader for the Privacy Framework at NIST, Naomi Lefkovitz, told journalists in Brussels.

This model, basically focussed on privacy risk management, is "very flexible" so it could also be adopted in Europe complementing existing EU law, she said.

"We look at privacy risks from embarrassment to discrimination as a result of data processing, [and] these are the same issues that Europe is looking at," Lefkovitz said.

"But there is no one right answer when it comes to privacy," she added.

The European rules on data privacy have contributed to the development of the US Privacy Framework, according to Lefkovitz, who hopes that this voluntary tool "can return the favour" to achieve more effective solutions within the GDPR.

The EU-US Privacy Shield

Despite their different approaches, the EU and the US have an agreement to share personal data for commercial purposes, under certain conditions, since the EU-US 'privacy shield' framework was adopted in 2016.

But this deal has repeatedly received criticism from civil society and MEPs, who believe that European citizens' rights might be not fully protected.

In June 2018, the European Parliament's civil liberties committee (Libe) called on the European Commission to suspend the EU-US data transfer pact - something that might happen due to the "Schrems II" ongoing case before the European Court of Justice.

However, after the commission gave the green light to the agreement in its third annual review last October, some members of the committee remain sceptical.

"The EU-US 'privacy shield' is inadequate as a safeguard, badly implemented, hardly enforced and weakly scrutinised," Dutch liberal MEP Sophie in 't Veld said earlier this month.

"This is not the way that we can protect our citizens. This [agreement] does not even take the EU seriously. We make laws, then we negotiate with the US and we give it all away," she told MEPs from Libe.

According to the international NGO Access Now, "the EU does not only enable the continuous violation of fundamental rights under this arrangement, but it is also undermining its global leadership role on the protection of personal data".

MEPs from the Libe committee will be travelling to the US from 23 to 29 February to discuss EU-US justice and home affairs, including the privacy shield framework.