Weekly Updates

The new EU-US Trans-Atlantic Data Privacy Framework is here.

Readers who have been with us for a while know we've been monitoring the development of the EU-US personal data transfer feud since Meta's billionaire fine from EU regulators (revisit our past issues here, here, here, and here).

If you are new here, let's make a quick recap. Since GDPR came into force, companies operating in the EU have been in a bit of a pickle, whether they are US-based, offering service to Europeans, or EU-based using US-based digital services. GDPR says companies can only send European personal data to other countries if they can guarantee that data will receive the same level of protection it would in the EU.

Firms are automatically considered GDPR-compliant if they transfer personal data to one of the European Commission's pre-approved jurisdictions. That was the case of the US for many years. However, every time an agreement was reached between US authorities and the European Commission (EC) to ensure the same level of protection, the European Union Court of Justice (EUCJ) struck down the agreement regarding it not good enough due to US national security surveillance practices. That happened in 2016 (the Schrems I case) and then again in 2020 (Schrems II). The real problem started after the 2020 decision. Trump's administration failed to expedite a new agreement with the EC, so firms were left between a rock and a hard place. Without a US-EC deal, companies had the impossible burden of proving they could somehow protect European data from US authorities.

Not surprisingly, the European data protection authorities concluded that even carefully tailored agreement terms couldn't shield US companies’ operations from US law. Hence the Meta 1 billion euro fine and protests from data protection authorities that no European company could use Google Analytics.

Finally, this week the new US-EU deal was announced.

On the very same day, noyb, the organization led by Max Schrems behind the first two EUCJ cases, published this:

“New Trans-Atlantic Data Privacy Framework largely a copy of "Privacy Shield". noyb will challenge the decision. Third attempt of the European Commission to get a stable agreement on EU-US data transfers will be likely back at the Court of Justice (CJEU) in a matter of months. The allegedly "new" Trans-Atlantic Data Privacy Framework is largely a copy of the failed "Privacy Shield". Despite the European Commission's public relations efforts, there is little change in US law or the approach taken by the EU. The fundamental problem with FISA 702 was not addressed by the US, as the US still takes the view that only US persons are worthy of constitutional rights”.

The post was readily shared by the European Data Protection Office (EDPO) on social media.

The open divergence between the European Commission and the European Court of Justice raises the question of who should have the final word on what "sufficient protection” really means. GDPR gave the job to the European Commission, an executive branch composed of elected representatives from all member states. Meanwhile, the EUCJ has the duty to protect Europeans’ rights and keep the other branches of central power in check, but it is not composed of elected representatives.

This kind of conflict usually takes a toll on the pool of political capital Courts accumulate through time. In the press conference announcing the new adequacy decision, European Commissioner for Justice Didier Reynders showed the frustration from the EC with the repetitive challenges when asked to comment noyb's statement that they will challenge the new deal. From Digital Journal:

“EU justice commissioner Didier Reynders told journalists he had “no illusion” about the coming likely legal challenge.

‘But it’s maybe useful to test the new US system before to challenge such an adequacy decision,’ he said.

Reynders added, in an apparent swipe at Schrems’s non-profit European Centre for Digital Rights, that “maybe the access to the court of justice is a small part of the business model of some civil society organisations”.

The decision was in fact approved by 24 member states, with 3 abstentions and no rejection. According to AIPP, the 24 member states represent over 424 million people.

Pix Evolution

The Brazilian Central Bank (BCB) issued a call for comments a few weeks ago in the context of the evolution of Pix. CTPI, as a member of the Pix Fórum, analyzed the call for comments and will send later today a written proposal. For you, valued subscriber, we’ll break down the issue at hand and the approach we are suggesting BCB.

Background

Pix is in its third year of operation, and companies have been exploring creative ways to use the rail to deliver cheaper, customized, resilient services to companies and merchants. One such case was the creation of an intermediary who would have an account connected to Pix and would issue QR Codes, reconcile transactions, and forward the appropriate funds to the transaction's ultimate beneficiary.

The advantage of this kind of service is that the intermediary can customize the pay-in and pay-out Pix experience and offer niche services to companies. Since they are the first destination of funds, they can absorb the complexity of integrating with Pix APIs provided by the banks, which can be a hustle.

Last year, BCB amended the Pix regulation to prohibit this kind of intermediation service altogether. BCB was concerned about anti-money laundering monitoring since the intermediaries mask the final beneficiary of transfers.

The need for a solution to simplify and customize the Pix experience for merchants and other companies was still latent in the market, though. So a few weeks ago, BCB announced they are considering formalizing the role of intermediary, calling it an “account manager” and setting specific obligations for banks to control the final destination of the funds.

CTPI’s contribution to the debate

Our contribution was based on our finding that BCB’s solution to formalizing the market’s workaround is not the best approach. We argue the need the market is showing is a result of three underlying issues.

The first is the perception that the Pix APIs offered by the banks to access Pix functionalities are not good enough. Here, we propose fixing that specific problem by implementing minimal user experience requirements for the APIs in the same way BCB has done with the bank apps since day one. If the APIs worked and gave access to all Pix functionalities, the intermediaries could manage pay-ins without participating in the money flow.

The second underlying issue is that outsourcing payouts is also very hard. Even simply registering payment orders for future approval can be difficult. Once again, Pix APIs could solve this issue by allowing generating credentials to operators even if the ultimate approval requires a higher level of credential.

Finally, the third issue is that participating in the money flow can greatly reduce the risk of default since the intermediary can discount their fee from what gets ultimately forwarded to the final beneficiary. To solve that particular use case, we proposed the implementation of a flow to accommodate split pay. That is: payments with multiple recipients. The split pay feature would be available for all payees in their bank apps or APIs so that account managers could set up QR Codes already with the split pay configured.

We also made an additional proposal regarding the second issue mentioned above. We suggested BCB to perceive automatic debit in Pix as just a new way of sending payment descriptions to the payer’s bank for confirmation from the payer and the start of the money flow. That means the message payer banks receive from payee banks in an automatic debit should be exactly the content of a QR Code a payer could scan. We also suggested both the autoPix and QR Codes can be single-time, recurrent, or single-time and recurrent. If the BCB accepts that suggestion, we could have large-scale push payments in Brazil in no time.

EU-US deal and Pix Forum