EU-US Data Privacy Framework gets a green light from the EU

The backstory: Back in 2020, the EU's top court made a big decision on a data transfer agreement it had with the US. It shot down an agreement called Privacy Shield because it was concerned about how much access the US had to the personal data of Europeans. The thing is, the EU has pretty strict data protections in place to protect its citizens’ private info, and the bloc feels that US laws don’t offer the same level of protection.

This ruling created a lot of uncertainty over data flows between the EU and the US, which are crucial for the economy. According to the White House, more data flows between the US and the EU than anywhere else in the world, supporting around US$7.1 trillion in economic activities.

More recently: To address these concerns, in 2022, US President Joe Biden issued an executive order putting new restrictions on US intelligence agencies like the National Security Agency (NSA) on accessing people’s private info. It also created new protections for both European and American citizens and a body for investigating cases where someone’s data rights might have been violated.

The development: The EU has given the green light to a new agreement with the US that focuses on data privacy. It’s called an “adequacy decision,” which basically means the US has met good enough data protection standards according to the EU. This now allows thousands of businesses to freely transfer data to the US without worrying about breaking the EU’s privacy laws. But, it may still be challenged in the EU’s court system, so we’ll have to see how that plays out. Max Schrems, the privacy activist who had a hand in getting two other privacy agreements tossed out, said he plans to challenge the decision by the end of August.

Key comments:

"Following the agreement in principle I reached with President Biden last year, the US has implemented unprecedented commitments to establish the new framework, said European Commission President Ursula von der Leyen. "Today we take an important step to provide trust to citizens that their data is safe, to deepen our economic ties between the EU and the US and at the same time to reaffirm our shared values."

“They say, the definition of insanity is doing the same thing over and over again and expecting a different result,” said privacy campaigner Max Schrems to Bloomberg. “It seems the commission is trapped in such a political circle. We have various options for a challenge already in the drawer, even if we are equally as sick and tired of this legal ping-pong.”

“This new framework is substantially different than the EU-U.S. Privacy Shield,” said Justice Commissioner Didier Reynders. “When deciding whether and to what extent U.S. intelligence agencies should access data, they will be required to balance the same factors as those required by the case law of the EU Court of Justice.”

“We welcome the new Data Privacy Framework, which will safeguard the goods [and] services relied on by people and businesses on both sides of the Atlantic,” said Nick Clegg, Meta’s president for global affairs.