On July 10, 2023, the replacement to the Privacy Shield, the EU-US Data Privacy Framework was adopted. Many organizations are now asking themselves if it is a green light to process information in US cloud services?
We consider that it is still inappropriate.
Data protection expert Per Tuvall has summarized the main impacts of the EU-US Data Privacy Framework in a preliminary analysis where he gives a state of play of the agreement:
EU – US Data Privacy Framework
Preliminary summary by Per Tuvall (2023-07-11) – What does the new adequacy decision mean?
Using cloud services such as Microsoft Teams, Zoom, Amazon AWS and the like is likely to become legal once companies join the DPF framework. Which should happen soon. More info from the US Department of Commerce and the Privacy Shield website. However, there are question marks around transfer to US authorities from data processors like Microsoft, Zoom, Amazon etc.
The use of social media remains problematic, as the only possible legal basis for advertising based on profiling is consent. See press release from the European Court of Human Rights.
Classified data still cannot be transferred to US-based cloud services such as Teams, Zoom, AWS and the like because the data would be exposed. It is difficult to carry out a general review of large amounts of data that may contain classified information, even after the new breakthrough law has entered into force.
A new venture into US-based cloud services is a risky strategy. According to NOYB and Max Schrems, the adequacy decision is the result of political pressure and the US changes to surveillance laws are cosmetic. A Schrems III ruling with an uncertain outcome is to be expected.
In summary, there is still a high level of uncertainty associated with managing data in foreign clouds. We believe that Swedish data should be managed in Swedish clouds, under Swedish legislation and with Swedish integrity.
