The US undermines the Transatlantic Data Privacy Framework with the EU by firing PCLOB staff

At the end of January 2025, three staff members of the Privacy and Civil Liberties Oversight Board(PCLOB) were fired by the US president. The EU-US Data Privacy Framework with the EU relies heavily on proper oversight from this board, which raises serious legal concerns on the EU-side for the agreement if the US board can no longer properly function.

Background

The initial framework for EU-US data transfers was called Safe Harbor, which was deemed inadequate in 2015 by the European Court of Justice in the case Schrems I. In 2016, the European Commission issued an adequacy decision on the EU-U.S. Privacy Shield Framework, making it the replacement of the Safe Harbor program. In 2020, this framework is also deemed inadequate by the European Court of Justice in the case Schrems II. Enhanced oversight was needed going forward, as compliance with European General Data Protection Regulation continued to be at risk with the frameworks so far. The Schrems II ruling validated the existing Standard Contractual Clauses(SCC's), but added stricter requirements for implementation, significantly increasing oversight requirements to make transfer of personal data from the EU to the US lawful. The current EU-US Data Privacy Framework (DPF) represents the third major attempt at establishing a stable transatlantic data transfer mechanism.

Consequences

Under the GDPR, personal data exported outside the EU must be protected with standards that are "essentially equivalent" to EU laws. This includes transparency, limited government access, and strong rights for individuals over their personal data. If that cannot be guaranteed, using US companies for European software infrastructure is at risk as not being legal in the EU. That affects large cloud platforms like AWS, Azure, Google Cloud and other American cloud infrastructure.