• Background on the EU-US data transfer saga
• TADPF information PDF by the EU
• TADPF program page by the US Government
• TADPF Decision (EU) 2023/1795
• CJEU: Schrems I and Schrems II
• Report on the removal of PCLOB members

The EU-US Data Transfer System – a mix of EU and US law. Generally, EU law prohibits exporting personal data to countries outside of the EU since 1995, unless there is an absolute need (e.g. when sending an email to any non-EU country). Data can be sent abroad when the non-EU country provides “essentially equivalent” protection of Europeans’ personal data. The US, on the other hand, has very strong mass surveillance laws (e.g. FISA702 or EO 12.333), that allow the US government to access any data stored with Amazon, Meta, Microsoft, Google and any other US Big Tech firm without probable cause or individual judicial approval. Therefore, the European Court of Justice has held twice (Schrems I and Schrems II) that US law is not “essentially equivalent”. However, Ursula von der Leyen has insisted to pass a third EU-US deal, called “Transatlantic Data Privacy Framework” (TADPF).

TADPF was built on sand. On 10.7.2023 the European Commission issued Implementing Decision (EU) 2023/1795, formally passing the TADPF. This allowed any EU business to freely transfer data to US providers, despite US surveillance laws. The European Commission relied on (very questionable) executive orders or letters by the US government, including the PCLOB, to find that the US is “essentially equivalent”. However, these elements are not reflected in US statutes and codified law, because there was no majority in the US Congress to pass such laws. It was long criticised that the next US president could kill these protections with the strike of a pen. This scenario is now on the horizon. In its decision, the European Commission mentioned the PCLOB a whopping 31 times to explain why the US has “essentially equivalent” protections. The PCLOB is the only general “oversight” body that monitors if US services actually compy with laws, orders and other promises. Other elements of US law, like various redress mechanisms, require a plaintiff to become active. The US has traditionally blocked access to these bodies via various “standing” rules, leading to basically no lawsuits ever beeing admitted. This means that the PCLOB is the only relevant oversight mechanism that the TADPF relied upon.

Max Schrems: “This deal was always built on sand, but the EU business lobby and the European Commission wanted it anyways. Instead of stable legal limitations, the EU agreed to e