On 28 February 2023, the European Data Protection Board (EDPB) adopted the opinion 5/2023 on the European Commission Draft Implementing Decision on the adequate protection of personal data under the EU-US Data Privacy Framework (DPF). The EDPB assessed and issued recommendations to the Commission on the level of protection for individuals whose personal data is transferred to the US. The opinion covers a range of data protection aspects, including concerns about access and use of personal data by US public authorities, particularly intelligence agencies. The EDPB highlighted specific concerns related to the rights of data subjects, such as exceptions to the right of access, timing and modalities of the right to object, the lack of key definitions, the ambiguous application of DPF Principles to processors, and the broad exemption for publicly available information. Additionally, the EDPB emphasised that the level of protection for individuals whose data is transferred must not be weakened by onward transfers. Finally, the EDPB stressed the need for specific automated decision-making and profiling regulations to ensure sufficient safeguards for individuals, including the right to challenge decisions and receive human intervention.
Original source