EU-USA trans-Atlantic data agreement milestone

On the 25th March, the European Commission and the U.S. Government announced that an important agreement has been reached regarding the transfer of data between the European Union and the United States. The agreement is only in principle so far, and full details have yet to be released, however the new Trans-Atlantic Data Privacy Framework will form the basis of it and it has been created to renegotiate and strengthen the data protection bridge between the two entities.

History of EU-U.S Data Sharing Agreements

In 2015, the Court of Justice in the EU invalidated the Safe Harbor framework (which allowed the data of European citizens to be transferred to the U.S.) following a two-year legal case led by privacy campaigner Max Schrems. Within a few months of the ruling, the European Commission and the U.S government drafted an alternative framework titled the ‘EU-US Privacy Shield,’ which was created to ensure some level of consistency with EU laws when transferring EU citizen data to the U.S. In July 2020, the EU-US Privacy Shield was also invalidated, following further campaign from Max Schrems in relation to U.S surveillance laws; this resulted in a ruling now known as “Schrems II.” As a result of the Schrems II ruling, organisations are now obliged to conduct individual assessments of every data transfer that is made to a non-EU country in order to maintain compliance, this has resulted in many organisations being prevented from carrying out basic data transfers to non-EU countries. In a post-pandemic world of increased remote working and use of cloud computing systems, the implications of Schrems II have been significant and complex for many organisations.

The new framework

The new Trans-Atlantic Data Privacy Framework announced this week by President Joe Biden and European Commission President Ursula von der Leyen, addresses the two main concerns that the Court of Justice in the EU had, regarding U.S. surveillance laws: 1) The scope and proportionality of U.S. surveillance activities in the name of national security, and 2) the availability of redress mechanisms for European citizens whose personal data has been improperly collected by U.S. intelligence agencies.

President Joe Biden stated in the Brussels press conference:

"Today we have agreed to unprecedented protections for data privacy and security for our citizens. This new arrangement will enhance the Privacy Shield framework, promote growth and innovation in Europe and in the United States and help companies, both small and large, compete in the digital economy…This framework underscores our shared commitment to privacy, data protection, and the rule of law. And it’s going to allow the European Commission to once again authorize trans-Atlantic data flows that facilitate $7.3 trillion in economic relationships with the EU."

European Commission President Ursula von der Leyen added that both sides had:

"found an agreement in principle for a new framework for trans-Atlantic data flows. This will enable predictable and trustworthy data flows between the EU and US, safeguarding privacy and civil liberties. And I really want to thank Commissioner (Didier) Reynders and Secretary (Gina) Raimondo for their tireless efforts over the past month to finish a balanced and effective solution.“

Whenever the new agreement is finalized and released, it is to be expected that there may be further legal challenges from the EU (particularly Schrems and NOYB the non-profit organisation co-founded by him in 2017). In a recent press release, Schrems stated:

"We already had a purely political deal in 2015 that had no legal basis. From what you hear we could play the same game a third time now… The final text will need more time, once this arrives we will analyze it in depth, together with our US legal experts. If it is not in line with EU law, we or another group will likely challenge it. In the end, the (CJEU) will decide a third time. We expect this to be back at the Court within months from a final decision."

Despite the fact that it could be quite some time before this agreement is finalised, if it does come into force, it would be positive news for privacy professionals. If the new agreement withstands scrutiny of privacy campaigners and legal professionals, it could mean that EU-U.S. data transfers may once again, be a simple and accessible process.

The Advisory Bureau will continue to monitor any developments relating to the Trans-Atlantic Data Privacy Framework as they become available.