Europe and US Agree Trans-Atlantic Data Sharing Deal

The United States and the European Union have reached a new data sharing agreement, which will be a relief for some big name tech players.

The agreement in principle between the the EU and US was revealed late on Friday, and is called the new Trans-Atlantic Data Privacy Framework.

It comes after Meta last month warned if it was not allowed to transfer, store and process European user data on US-based servers, it could shut down Facebook and Instagram in Europe.

Troubled transfers

The EU had published its draft Data Act last month governing the rules, rights and obligations for companies transferring European personal data to offshore (mostly US) servers and data centres.

The issue of transferring European user data to American servers has long been a bug bear for the European Commission and privacy campaigners.

Data used to be transferred to the US under the Safe Habour agreement, but the European Court of Justice in 2015 suspended the original Safe Harbour agreement.

It was suspended in the wake of the Edward Snowden revelations about the scale of US and its NSA agency spying on friends and allies.

The Privacy Shield (or Safe Harbour 2.0) was then drafted, but the United States and the European Union were forced to change it after an initial agreement submitted in February 2016 was rejected by European Watchdogs for not being robust enough.

The two sides then agreed to stricter rules for American companies holding information on Europeans and clearer limits on US surveillance. And this reworked Privacy Shield agreement was then approved by EU member states and adopted in July 2016.

The European Commission’s Privacy Shield data framework replaced the EU-US Safe Harbour deal which had been in place since 2000, but right from the start it proved controversial with ongoing concerns about US spying.

The Privacy Shield had been designed to help firms on both sides of the Atlantic to move the personal data of European citizens to the United States without breaking strict EU data transfer rules.

Then in July 2020 the European Court of Justice struck down the transatlantic data transfer deal, and cast transfers into doubt.

Trans-Atlantic Data Privacy Framework

Now the European Commission and the United States announce that they have agreed in principle on a new data sharing deal, which they said “will foster trans-Atlantic data flows and address the concerns raised by the Court of Justice of the European Union in the Schrems II decision of July 2020.”

The EC said the new Trans-Atlantic Data Privacy Framework “marks an unprecedented commitment on the US side to implement reforms that will strengthen the privacy and civil liberties protections applicable to US signals intelligence activities.”

Under this agreement, the US is to put in place new safeguards to ensure that signals surveillance activities are necessary and proportionate in the pursuit of defined national security objectives.

America will also establish a two-level independent redress mechanism with binding authority to direct remedial measures, and the US enhance rigorous and layered oversight of signals intelligence activities to ensure compliance with limitations on surveillance activities.

The Trans-Atlantic Data Privacy Framework reflects more than a year of detailed negotiations between the U.S. and E.U. led by Secretary of Commerce Gina Raimondo and Commissioner for Justice Didier Reynders.

It will provide a durable basis for trans-Atlantic data flows, which are critical to protecting citizens’ rights and enabling trans-Atlantic commerce in all sectors of the economy, including for small and medium enterprises.

Going forward the US government and the European Commission will now continue their co-operation with a view to translate this arrangement into legal documents that will need to be adopted on both sides to put in place this new Trans-Atlantic Data Privacy Framework.

EU, US co-operation

For that purpose, these US commitments will be included in an Executive Order that will form the basis of the Commission’s assessment in its future adequacy decision.

In joint remarks with EU President Ursula von der Leyen, US President Joe Biden said Friday discussed Europe’s decision to reduce its reliance on Russia gas imports, and the ongoing situation in Ukraine.

They also commented on the new Trans-Atlantic Data Privacy Framework

They said the new partnership will “once again authorise transatlantic data flows that help facilitate $7.1 trillion in economic relationships with the EU.”

“This will enable predictable and trustworthy data flows between the EU and U.S., safeguarding privacy and civil liberties,” von der Leyen said.