BEERG Newsletter - Data Transfers: EU + US political agreement on Privacy Shield 2.0

Derek Mooney writes: US President Joe Biden and European Commission President Ursula von der Leyen declared last Friday (25 March) that the US and EU had reached a political agreement in principle on a new "Trans-Atlantic Data Privacy Framework" that will govern future international data transfers. 

The statement came during President Biden’s high-profile visit to Brussels to meet NATO and EU heads of government. It marks considerable progress, though the two sides have yet to set out the terms of the new Framework in legal documents, and the timing for the passage and adoption of the Framework is still unclear.

But high-level political agreement is critically important. According to the briefing material from both the White House (see here and related fact sheet here) and by the European Commission (see here), the new Framework "marks an unprecedented commitment on the U.S. side to implement reforms that will strengthen the privacy and civil liberties protections applicable to U.S. signals intelligence activities."

The planned U.S. reforms include:

• New safeguards to ensure that signals surveillance activities are necessary and proportionate in the pursuit of defined national security objectives;
• Establishing a new two-level redress mechanism with independent and binding authority, including an independent Data Protection Review Court that would consist of individuals chosen from outside the U.S. government who would have full authority to adjudicate claims and direct remedial measures as needed; and
• Adopting procedures to ensure effective oversight of new privacy and civil liberties standards.

In addition participating organizations will need to adhere to certain privacy principles and self-certify their adherence through the U.S. Department of Commerce (similar to the self-certification mechanism under Safe Harbour and Privacy Shield). It is expected that the U.S. commitments will be included in an Executive Order.

This would be both side’s the third attempt to provide an effective and efficient system of EU-U.S. personal data transfers. The first two were struck down by the EU’s top court: Safe Harbour, in 2015 and Privacy Shield in 2020. 

The U.S. and the EU have committed to work on drafting the legal documents to be adopted on both sides, but there is no time line for the production of the texts or their full implementation. Within minutes of the announcement privacy activists were already taking to social media to say they will not hesitate to go to the CJEU to challenge the new framework. 

The joint declaration by the EU and US is both welcome and significant. A great deal of work remains to be done and – as has always been the case with data privacy – the devil will be in the detail… but if this marks a return to the core principles of having a data privacy framework that protects the privacy and integrity of personal data while recognising that processing such data is vital for trade and commerce, then it is progress. 

As we have remarked before, we have been straying ever further from the original purpose of GDPR - with the public being the biggest losers as privacy activists and regulators stymie commerce and trade and clog up the courts on matters that fascinate them but assist few others. 

And… as Prof Niko Härting remarked on Twitter last Friday:  [it is] doubtful if anyone apart from privacy lawyers and professional benefited from Schrems II. Plus: Europeans should take a critical look at surveillance by their own National Security Agencies before pointing fingers yet again.