EU & US Agree New Data Rules To Replace Privacy Shield
“The United States and the European Commission have committed to a new Trans-Atlantic Data Privacy Framework, which will regulate trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union when it struck down in 2020 the Commission’s adequacy decision underlying the EU-US Privacy Shield framework,” says the White House Statement. The new agreement brings to an end a long period of legal uncertainty between the two governments.
This is a new framework for cross-border data transfers, providing some much-needed relief for the bigh technology firms who manage large international loud data flows, including Meta, Microsoft and Google.
“We have found an agreement in principle on a new framework for trans-Atlantic data flows,” European Commission President Ursula von der Leyen said at a joint press conference with US President Joe Biden recently.... This will enable predictable, trustworthy data flows between the EU and the US, safeguarding privacy and civil liberties.”
The legal uncertainty hanging over EU-U.S. data flows has led to European data protection agencies issuing orders against flows of personal data passing via products such as Google Analytics, Google Fonts and Stripe and others. Facebook’s lead EU regulator, the Irish Data Protection Commissioner, has sent a new draft to Meta, in a multi-year complaint related to its EU-US data flows. At least, that is what Meta has been hoping would happen as it sought to delay earlier enforcement.
The detail of what has been agreed by the EU and US in principle although how exactly the two sides have managed to close the gap between what remain two very differently oriented legal systems, is not clear.
The sustainability of the deal will ultimately depend upon fine detail and uncertainty over EU-US data transfers extends further than 2020 when a long -standing predecessor agreement, called Safe Harbor, was invalidated by Europe’s top court in 2015 over the same disagreement between EU privacy rights and US surveillance laws. This dynamic means that any replacement deal faces the daunting prospect of fresh legal challenges to test how robust it is when it comes to ensuring that EU citizens’ rights are adequately protected when their data flows to the US.
“We managed to balance security and the right to privacy and data protection,” von der Leyen said. She referrred to the new agreement “balanced and effective” but provided no specifics on what has actually been decided.
EU citizens will now be able to seek redress from “a new multi-layer redress mechanism that includes an "independent Data Protection Review Court” that the US administration says would consist of individuals “chosen from outside the US Government who would have full authority to adjudicate claims and direct remedial measures as needed”.
The response from the technology industry to the news of another revived data transfer deal was universally positive. Both Google and Meta has been asking recently for the two sides to come up with a viable compromise, was quick to welcome the announcement.
European Commission: White House: CNBC: Techcrunch: Microsoft: Law360: Lexology:
You Might Also Read:
