US president Joe Biden on Friday signed an executive order to implement a European Union-United States data transfer framework announced in March that adopts new American intelligence gathering privacy safeguards.
The deal seeks to end the limbo in which thousands of companies found themselves after Europe’s top court threw out two previous pacts due to concerns about US surveillance.
US commerce secretary Gina Raimondo told reporters the executive order “is the culmination of our joint effort to restore trust and stability to transatlantic data flows” and “will ensure the privacy of EU personal data”.
The framework addresses the concerns of the Court of Justice of the European Union (ECJ), which in July 2020 struck down the prior EU-US Privacy Shield framework as a valid data transfer mechanism under EU law.
Your work questions answered: My hours have been cut but someone new has been hired. Can my employer do this?
Cliff Taylor: How the return of SSIA-style incentives might be on the cards for Irish households
From intern to CEO: does it pay to be a company lifer?
My remuneration ‘was substantial’: The interview transcript Derek Quinlan didn’t want made public
European commissioner for justice Didier Reynders said he was “quite sure” there would be a fresh legal challenge, but he was confident that the pact met the demands of the court.
“We have a real improvement relative to the Privacy Shield . . . It’s totally different,” he said. “Maybe the third attempt will be the good one.”
The White House said “transatlantic data flows are critical to enabling the $7.1 trillion (€7.35 trillion) EU-US economic relationship” and the framework “will restore an important legal basis for transatlantic data flows”.
The US chamber of commerce and Microsoft welcomed the executive order, but digital rights activist group Access Now and European consumer organisation BEUC said it did not appear that people’s rights were being sufficiently protected.
The White House said Mr Biden’s order bolstered current “privacy and civil liberties safeguards” for US intelligence gathering and created an independent, binding multilayer redress mechanism for individuals who believe their personal data was illegally collected by US intelligence agencies.
Mr Reynders said it would take about six months to complete a complex approval process, noting the previous system only had redress to an ombudsperson inside the US administration, which the EU court rejected.
Mr Biden’s order adopts new safeguards on the activities of US intelligence gathering, requiring they do only what is necessary and proportionate, and creates a two-step system of redress – first to an intelligence agency watchdog then to a court with independent judges, whose decisions would bind the agencies.
The US president and European Commission president Ursula von der Leyen in March said the provisional agreement offered stronger legal protections and addressed the EU court’s concerns.
Ms Raimondo on Friday will transmit a series of letters to the EU from US agencies “outlining the operation and enforcement of the EU-US data privacy framework” that “will form the basis for the European Commission’s assessment in a new adequacy decision”, she said.
Under the order, the civil liberties protection officer in the US office of the director of national intelligence will investigate complaints and make decisions. The US justice department is establishing a data protection review court to independently review officer’s decisions. Judges with experience in data privacy and national security will be appointed from outside the US government.
European privacy activists have threatened to challenge the framework if they did not think it adequately protects privacy. Austrian Max Schrems, whose legal challenges have brought down the previous two EU-US data flow systems, said he still needed to analyse the package.
“At first sight, it seems that the core issues were not solved and it will be back to the ECJ sooner or later,” he said.
– Reuters
