As the summer holidays have now come to an end and the holiday season fast approaches, many organisations that specialise in hiring a large number of seasonal workers have their busiest recruitment periods. These businesses experience a surge in demand during these peak periods and relatively quieter, more steady windows outside of their busy seasons.
This pattern is particularly noticeable in the aviation sector and in retail as the holiday season approaches. The pressure to scale up workforces quickly while ensuring the right people are hired can be overwhelming. To tackle this challenge effectively, businesses need to streamline their hiring processes and consider essential elements like background checks for seasonal workers.
"They're really good to work with. They understand your business and what matters, and they always provide a friendly, professional service. "
Adequacy decision for the New EU-U.S. data privacy framework adopted by the European commission
On the 10th of July 2023, the European Commission made a significant decision by adopting the long-awaited Adequacy Decision for the EU-U.S. Data Privacy Framework. This decision marks the end of a three-year process to establish a successor to the EU-U.S. The Privacy Shield mechanism was declared invalid by the Court of Justice of the European Union (CJEU) on the 16th of July 2020. U.S. President Joe Biden warmly welcomed the Adequacy Decision, emphasizing its potential to enhance data privacy protections and create new economic opportunities.
The Adequacy Decision confirms that the U.S. meets the necessary level of protection under the EU's General Data Protection Regulation (GDPR) when handling the personal data of individuals in the European Economic Area (EEA). This adequacy determination applies specifically to U.S. companies that are certified under the new EU-U.S. Data Privacy Framework.
Alongside the Adequacy Decision, the European Commission released a fact sheet and a Q&A document to provide additional context and clarification.
The decision was influenced by certain changes in U.S. law, particularly Executive Order 14086, issued on the 7th of October 2022. This executive order and its accompanying regulations introduced additional safeguards and oversight measures to ensure that U.S. signals intelligence activities are proportionate and necessary for national security objectives. Moreover, it established a new independent redress mechanism to address complaints about data access by U.S. national security authorities. This mechanism includes two levels of investigation and resolution, aiming to address complaints from individuals whose data was transferred from the EEA and who have concerns about the collection and use of their data by U.S. intelligence agencies.
As part of the EU-U.S. Data Privacy Framework, U.S. companies seeking to receive data transfers from the EU must agree to comply with a set of privacy principles (DPF Principles), encompassing data minimization, purpose limitation, data retention, data security, and sharing with third parties. Companies that self-certify under this framework are required to recertify annually.
While the Adequacy Decision primarily applies to transfers from the EU to U.S. recipients under the EU-U.S. Data Privacy Framework, it also has indirect effects on other GDPR transfer mechanisms, such as the Standard Contractual Clauses and Binding Corporate Rules. All data transfers from the EEA to U.S. companies will benefit from the safeguards introduced by Executive Order 14086.
Despite the European Commission's confidence in the Adequacy Decision, legal challenges are expected before the CJEU, led by activists like Max Schrems. However, the Commission believes that the decision is legally sound and will defend it vigorously if necessary.
The European Commission will continually review the Adequacy Decision's implementation in the U.S. legal framework to ensure it remains effective and adequate. If any developments affect the level of protection in the U.S., the Commission retains the option to adapt or withdraw the Adequacy Decision accordingly. The first review will occur within one year of the decision's enactment.
For now, companies have a strong legal basis to transfer data from the EEA to the U.S. under the new framework. However, the potential for a "Schrems III" CJEU decision may impact the future validity of the Adequacy Decision.
